From 94927afb50ca8a6466c89c060847e2140778485f Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Tue, 20 Feb 2024 17:14:52 -0800 Subject: [PATCH 01/12] AppArmor API changes --- pkg/api/pod/util.go | 35 ++- pkg/api/pod/util_test.go | 131 ++++----- pkg/apis/core/annotation_key_constants.go | 13 + pkg/apis/core/types.go | 42 +++ pkg/apis/core/validation/validation.go | 45 ++++ pkg/apis/core/validation/validation_test.go | 254 +++++++++++++++++- .../api/core/v1/annotation_key_constants.go | 5 +- staging/src/k8s.io/api/core/v1/types.go | 43 +++ 8 files changed, 491 insertions(+), 77 deletions(-) diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go index cf0ff826a83..dc7d96ddb17 100644 --- a/pkg/api/pod/util.go +++ b/pkg/api/pod/util.go @@ -20,7 +20,6 @@ import ( "strings" "github.com/google/go-cmp/cmp" - v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metavalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation" utilfeature "k8s.io/apiserver/pkg/util/feature" @@ -540,12 +539,21 @@ func dropDisabledFields( podSpec = &api.PodSpec{} } - if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorInUse(oldPodAnnotations) { + if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorInUse(oldPodAnnotations, oldPodSpec) { for k := range podAnnotations { - if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, api.AppArmorContainerAnnotationKeyPrefix) { delete(podAnnotations, k) } } + if podSpec.SecurityContext != nil { + podSpec.SecurityContext.AppArmorProfile = nil + } + VisitContainers(podSpec, AllContainers, func(c *api.Container, _ ContainerType) bool { + if c.SecurityContext != nil { + c.SecurityContext.AppArmorProfile = nil + } + return true + }) } // If the feature is disabled and not in use, drop the hostUsers field. @@ -940,13 +948,28 @@ func procMountInUse(podSpec *api.PodSpec) bool { } // appArmorInUse returns true if the pod has apparmor related information -func appArmorInUse(podAnnotations map[string]string) bool { +func appArmorInUse(podAnnotations map[string]string, podSpec *api.PodSpec) bool { + if podSpec == nil { + return false + } + for k := range podAnnotations { - if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, api.AppArmorContainerAnnotationKeyPrefix) { return true } } - return false + if podSpec.SecurityContext != nil && podSpec.SecurityContext.AppArmorProfile != nil { + return true + } + hasAppArmorContainer := false + VisitContainers(podSpec, AllContainers, func(c *api.Container, _ ContainerType) bool { + if c.SecurityContext != nil && c.SecurityContext.AppArmorProfile != nil { + hasAppArmorContainer = true + return false + } + return true + }) + return hasAppArmorContainer } // restartableInitContainersInUse returns true if the pod spec is non-nil and diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go index 104a007950f..81604556526 100644 --- a/pkg/api/pod/util_test.go +++ b/pkg/api/pod/util_test.go @@ -23,6 +23,8 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" v1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/resource" @@ -704,83 +706,84 @@ func TestDropProcMount(t *testing.T) { } func TestDropAppArmor(t *testing.T) { - podWithAppArmor := func() *api.Pod { - return &api.Pod{ - ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.AppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, - Spec: api.PodSpec{}, - } - } - podWithoutAppArmor := func() *api.Pod { - return &api.Pod{ - ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, - Spec: api.PodSpec{}, - } - } - - podInfo := []struct { + tests := []struct { description string hasAppArmor bool - pod func() *api.Pod - }{ - { - description: "has AppArmor", - hasAppArmor: true, - pod: podWithAppArmor, + pod api.Pod + }{{ + description: "with AppArmor Annotations", + hasAppArmor: true, + pod: api.Pod{ + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.AppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, + Spec: api.PodSpec{}, }, - { - description: "does not have AppArmor", - hasAppArmor: false, - pod: podWithoutAppArmor, + }, { + description: "with pod AppArmor profile", + hasAppArmor: true, + pod: api.Pod{ + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }, }, - { - description: "is nil", - hasAppArmor: false, - pod: func() *api.Pod { return nil }, + }, { + description: "with container AppArmor profile", + hasAppArmor: true, + pod: api.Pod{ + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, + Spec: api.PodSpec{ + Containers: []api.Container{{ + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + }, }, - } + }, { + description: "without AppArmor", + hasAppArmor: false, + pod: api.Pod{ + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, + Spec: api.PodSpec{}, + }, + }} - for _, enabled := range []bool{true, false} { - for _, oldPodInfo := range podInfo { - for _, newPodInfo := range podInfo { - oldPodHasAppArmor, oldPod := oldPodInfo.hasAppArmor, oldPodInfo.pod() - newPodHasAppArmor, newPod := newPodInfo.hasAppArmor, newPodInfo.pod() - if newPod == nil { - continue + for _, test := range tests { + for _, enabled := range []bool{true, false} { + t.Run(fmt.Sprintf("%v/enabled=%v", test.description, enabled), func(t *testing.T) { + defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AppArmor, enabled)() + + newPod := test.pod.DeepCopy() + + if actual := appArmorInUse(newPod.Annotations, &newPod.Spec); actual != test.hasAppArmor { + t.Errorf("appArmorInUse does not match expectation: %t != %t", actual, test.hasAppArmor) } - t.Run(fmt.Sprintf("feature enabled=%v, old pod %v, new pod %v", enabled, oldPodInfo.description, newPodInfo.description), func(t *testing.T) { - defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AppArmor, enabled)() + DropDisabledPodFields(newPod, newPod) + require.Equal(t, &test.pod, newPod, "unchanged pod should never be mutated") - DropDisabledPodFields(newPod, oldPod) + DropDisabledPodFields(newPod, nil) - // old pod should never be changed - if !reflect.DeepEqual(oldPod, oldPodInfo.pod()) { - t.Errorf("old pod changed: %v", cmp.Diff(oldPod, oldPodInfo.pod())) + if enabled { + assert.Equal(t, &test.pod, newPod, "pod should not be mutated when AppArmor is enabled") + } else { + if appArmorInUse(newPod.Annotations, &newPod.Spec) { + t.Errorf("newPod should not be using appArmor after dropping disabled fields") } - switch { - case enabled || oldPodHasAppArmor: - // new pod should not be changed if the feature is enabled, or if the old pod had AppArmor - if !reflect.DeepEqual(newPod, newPodInfo.pod()) { - t.Errorf("new pod changed: %v", cmp.Diff(newPod, newPodInfo.pod())) - } - case newPodHasAppArmor: - // new pod should be changed - if reflect.DeepEqual(newPod, newPodInfo.pod()) { - t.Errorf("new pod was not changed") - } - // new pod should not have AppArmor - if !reflect.DeepEqual(newPod, podWithoutAppArmor()) { - t.Errorf("new pod had EmptyDir SizeLimit: %v", cmp.Diff(newPod, podWithoutAppArmor())) - } - default: - // new pod should not need to be changed - if !reflect.DeepEqual(newPod, newPodInfo.pod()) { - t.Errorf("new pod changed: %v", cmp.Diff(newPod, newPodInfo.pod())) - } + if test.hasAppArmor { + assert.NotEqual(t, &test.pod, newPod, "pod should be mutated to drop AppArmor") + } else { + assert.Equal(t, &test.pod, newPod, "pod without AppArmor should not be mutated") } - }) - } + } + }) } } } diff --git a/pkg/apis/core/annotation_key_constants.go b/pkg/apis/core/annotation_key_constants.go index 60cff22b9d4..de7d73fa9d2 100644 --- a/pkg/apis/core/annotation_key_constants.go +++ b/pkg/apis/core/annotation_key_constants.go @@ -52,6 +52,19 @@ const ( // Deprecated: set a pod or container security context `seccompProfile` of type "RuntimeDefault" instead. DeprecatedSeccompProfileDockerDefault string = "docker/default" + // AppArmorContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. + // Deprecated: use a pod or container security context `appArmorProfile` field instead. + AppArmorContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" + + // AppArmorProfileRuntimeDefault is the profile specifying the runtime default. + AppArmorProfileRuntimeDefault = "runtime/default" + + // AppArmorProfileLocalhostPrefix is the prefix for specifying profiles loaded on the node. + AppArmorProfileLocalhostPrefix = "localhost/" + + // AppArmorProfileNameUnconfined is the Unconfined AppArmor profile + AppArmorProfileNameUnconfined = "unconfined" + // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized) // in the Annotations of a Node. PreferAvoidPodsAnnotationKey string = "scheduler.alpha.kubernetes.io/preferAvoidPods" diff --git a/pkg/apis/core/types.go b/pkg/apis/core/types.go index ddc78e3207e..2330cac7a6c 100644 --- a/pkg/apis/core/types.go +++ b/pkg/apis/core/types.go @@ -3325,6 +3325,7 @@ type PodSpec struct { // - spec.hostPID // - spec.hostIPC // - spec.hostUsers + // - spec.securityContext.appArmorProfile // - spec.securityContext.seLinuxOptions // - spec.securityContext.seccompProfile // - spec.securityContext.fsGroup @@ -3334,6 +3335,7 @@ type PodSpec struct { // - spec.securityContext.runAsUser // - spec.securityContext.runAsGroup // - spec.securityContext.supplementalGroups + // - spec.containers[*].securityContext.appArmorProfile // - spec.containers[*].securityContext.seLinuxOptions // - spec.containers[*].securityContext.seccompProfile // - spec.containers[*].securityContext.capabilities @@ -3598,6 +3600,10 @@ type PodSecurityContext struct { // Note that this field cannot be set when spec.os.name is windows. // +optional SeccompProfile *SeccompProfile + // appArmorProfile is the AppArmor options to use by the containers in this pod. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + AppArmorProfile *AppArmorProfile } // SeccompProfile defines a pod/container's seccomp profile settings. @@ -3625,6 +3631,37 @@ const ( SeccompProfileTypeLocalhost SeccompProfileType = "Localhost" ) +// AppArmorProfile defines a pod or container's AppArmor settings. +// +union +type AppArmorProfile struct { + // type indicates which kind of AppArmor profile will be applied. + // Valid options are: + // Localhost - a profile pre-loaded on the node. + // RuntimeDefault - the container runtime's default profile. + // Unconfined - no AppArmor enforcement. + // +unionDescriminator + Type AppArmorProfileType + + // localhostProfile indicates a profile loaded on the node that should be used. + // The profile must be preconfigured on the node to work. + // Must match the loaded name of the profile. + // Must be set if and only if type is "Localhost". + // +optional + LocalhostProfile *string +} + +type AppArmorProfileType string + +const ( + // AppArmorProfileTypeUnconfined indicates that no AppArmor profile should be enforced. + AppArmorProfileTypeUnconfined AppArmorProfileType = "Unconfined" + // AppArmorProfileTypeRuntimeDefault indicates that the container runtime's default AppArmor + // profile should be used. + AppArmorProfileTypeRuntimeDefault AppArmorProfileType = "RuntimeDefault" + // AppArmorProfileTypeLocalhost indicates that a profile pre-loaded on the node should be used. + AppArmorProfileTypeLocalhost AppArmorProfileType = "Localhost" +) + // PodQOSClass defines the supported qos classes of Pods. type PodQOSClass string @@ -6028,6 +6065,11 @@ type SecurityContext struct { // Note that this field cannot be set when spec.os.name is windows. // +optional SeccompProfile *SeccompProfile + // appArmorProfile is the AppArmor options to use by this container. If set, this profile + // overrides the pod's appArmorProfile. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + AppArmorProfile *AppArmorProfile } // ProcMountType defines the type of proc mount diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 9457ef47eb4..43583928b48 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -4234,6 +4234,9 @@ func validateWindows(spec *core.PodSpec, fldPath *field.Path) field.ErrorList { securityContext := spec.SecurityContext // validate Pod SecurityContext if securityContext != nil { + if securityContext.AppArmorProfile != nil { + allErrs = append(allErrs, field.Forbidden(fldPath.Child("securityContext").Child("appArmorProfile"), "cannot be set for a windows pod")) + } if securityContext.SELinuxOptions != nil { allErrs = append(allErrs, field.Forbidden(fldPath.Child("securityContext").Child("seLinuxOptions"), "cannot be set for a windows pod")) } @@ -4280,6 +4283,9 @@ func validateWindows(spec *core.PodSpec, fldPath *field.Path) field.ErrorList { // TODO: Think if we need to relax this restriction or some of the restrictions if sc != nil { fldPath := cFldPath.Child("securityContext") + if sc.AppArmorProfile != nil { + allErrs = append(allErrs, field.Forbidden(fldPath.Child("appArmorProfile"), "cannot be set for a windows pod")) + } if sc.SELinuxOptions != nil { allErrs = append(allErrs, field.Forbidden(fldPath.Child("seLinuxOptions"), "cannot be set for a windows pod")) } @@ -4657,6 +4663,43 @@ func validateSeccompProfileType(fldPath *field.Path, seccompProfileType core.Sec } } +func validateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field.Path) field.ErrorList { + if profile == nil { + return nil + } + + allErrs := field.ErrorList{} + + switch profile.Type { + case core.AppArmorProfileTypeLocalhost: + if profile.LocalhostProfile == nil { + allErrs = append(allErrs, field.Required(fldPath.Child("localhostProfile"), "must be set when AppArmor type is Localhost")) + } else { + localhostProfile := strings.TrimSpace(*profile.LocalhostProfile) + if localhostProfile != *profile.LocalhostProfile { + allErrs = append(allErrs, field.Invalid(fldPath.Child("localhostProfile"), *profile.LocalhostProfile, "must not be padded with whitespace")) + } else if localhostProfile == "" { + allErrs = append(allErrs, field.Required(fldPath.Child("localhostProfile"), "must be set when AppArmor type is Localhost")) + } + } + + case core.AppArmorProfileTypeRuntimeDefault, core.AppArmorProfileTypeUnconfined: + if profile.LocalhostProfile != nil { + allErrs = append(allErrs, field.Invalid(fldPath.Child("localhostProfile"), profile.LocalhostProfile, "can only be set when AppArmor type is Localhost")) + } + + case "": + allErrs = append(allErrs, field.Required(fldPath.Child("type"), "type is required when appArmorProfile is set")) + + default: + allErrs = append(allErrs, field.NotSupported(fldPath.Child("type"), profile.Type, + []core.AppArmorProfileType{core.AppArmorProfileTypeLocalhost, core.AppArmorProfileTypeRuntimeDefault, core.AppArmorProfileTypeUnconfined})) + } + + return allErrs + +} + func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *core.PodSpec, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} for k, p := range annotations { @@ -4799,6 +4842,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp allErrs = append(allErrs, validateSeccompProfileField(securityContext.SeccompProfile, fldPath.Child("seccompProfile"))...) allErrs = append(allErrs, validateWindowsSecurityContextOptions(securityContext.WindowsOptions, fldPath.Child("windowsOptions"))...) + allErrs = append(allErrs, validateAppArmorProfileField(securityContext.AppArmorProfile, fldPath.Child("appArmorProfile"))...) } return allErrs @@ -7084,6 +7128,7 @@ func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path) fiel } allErrs = append(allErrs, validateWindowsSecurityContextOptions(sc.WindowsOptions, fldPath.Child("windowsOptions"))...) + allErrs = append(allErrs, validateAppArmorProfileField(sc.AppArmorProfile, fldPath.Child("appArmorProfile"))...) return allErrs } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 3c7cfe631a8..4c6bd0366f7 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -10289,7 +10289,7 @@ func TestValidatePod(t *testing.T) { DNSPolicy: core.DNSDefault, }, }, - "default AppArmor profile for a container": { + "default AppArmor annotation for a container": { ObjectMeta: metav1.ObjectMeta{ Name: "123", Namespace: "ns", @@ -10299,7 +10299,7 @@ func TestValidatePod(t *testing.T) { }, Spec: validPodSpec(nil), }, - "default AppArmor profile for an init container": { + "default AppArmor annotation for an init container": { ObjectMeta: metav1.ObjectMeta{ Name: "123", Namespace: "ns", @@ -10314,7 +10314,7 @@ func TestValidatePod(t *testing.T) { DNSPolicy: core.DNSClusterFirst, }, }, - "localhost AppArmor profile for a container": { + "localhost AppArmor annotation for a container": { ObjectMeta: metav1.ObjectMeta{ Name: "123", Namespace: "ns", @@ -10324,6 +10324,107 @@ func TestValidatePod(t *testing.T) { }, Spec: validPodSpec(nil), }, + "runtime default AppArmor profile for a pod": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeRuntimeDefault, + }, + }, + }, + }, + "runtime default AppArmor profile for a container": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + "unconfined AppArmor profile for a pod": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeUnconfined, + }, + }, + }, + }, + "unconfined AppArmor profile for a container": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeUnconfined, + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + "localhost AppArmor profile for a pod": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("example-org/application-foo"), + }, + }, + }, + }, + "localhost AppArmor profile for a container field": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("example-org/application-foo"), + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, "syntactically valid sysctls": { ObjectMeta: metav1.ObjectMeta{ Name: "123", @@ -11880,6 +11981,143 @@ func TestValidatePod(t *testing.T) { Spec: validPodSpec(nil), }, }, + "unsupported pod AppArmor profile type": { + expectedError: `Unsupported value: "test"`, + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: "test", + }, + }, + }, + }, + }, + "unsupported container AppArmor profile type": { + expectedError: `Unsupported value: "test"`, + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: "test", + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + }, + "missing pod AppArmor profile type": { + expectedError: "Required value: type is required when appArmorProfile is set", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: "", + }, + }, + }, + }, + }, + "missing AppArmor localhost profile": { + expectedError: "Required value: must be set when AppArmor type is Localhost", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + }, + }, + }, + }, + }, + "empty AppArmor localhost profile": { + expectedError: "Required value: must be set when AppArmor type is Localhost", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To(""), + }, + }, + }, + }, + }, + "invalid AppArmor localhost profile type": { + expectedError: `Invalid value: "foo-bar"`, + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeRuntimeDefault, + LocalhostProfile: ptr.To("foo-bar"), + }, + }, + }, + }, + }, + "invalid AppArmor localhost profile": { + expectedError: `Invalid value: "foo-bar "`, + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("foo-bar "), + }, + }, + }, + }, + }, "invalid extended resource name in container request": { expectedError: "must be a standard resource for containers", spec: core.Pod{ @@ -21579,6 +21817,12 @@ func TestValidateWindowsSecurityContext(t *testing.T) { expectError: true, errorMsg: "cannot be set for a windows pod", errorType: "FieldValueForbidden", + }, { + name: "pod with AppArmorProfile", + sc: &core.PodSpec{Containers: []core.Container{{SecurityContext: &core.SecurityContext{AppArmorProfile: &core.AppArmorProfile{Type: core.AppArmorProfileTypeRuntimeDefault}}}}}, + expectError: true, + errorMsg: "cannot be set for a windows pod", + errorType: "FieldValueForbidden", }, { name: "pod with WindowsOptions, no error", sc: &core.PodSpec{Containers: []core.Container{{SecurityContext: &core.SecurityContext{WindowsOptions: &core.WindowsSecurityContextOptions{RunAsUserName: utilpointer.String("dummy")}}}}}, @@ -21613,6 +21857,7 @@ func TestValidateOSFields(t *testing.T) { // - Add documentation to the os field in the api // - Add validation logic validateLinux, validateWindows functions to make sure the field is only set for eligible OSes osSpecificFields := sets.NewString( + "Containers[*].SecurityContext.AppArmorProfile", "Containers[*].SecurityContext.AllowPrivilegeEscalation", "Containers[*].SecurityContext.Capabilities", "Containers[*].SecurityContext.Privileged", @@ -21623,6 +21868,7 @@ func TestValidateOSFields(t *testing.T) { "Containers[*].SecurityContext.SELinuxOptions", "Containers[*].SecurityContext.SeccompProfile", "Containers[*].SecurityContext.WindowsOptions", + "InitContainers[*].SecurityContext.AppArmorProfile", "InitContainers[*].SecurityContext.AllowPrivilegeEscalation", "InitContainers[*].SecurityContext.Capabilities", "InitContainers[*].SecurityContext.Privileged", @@ -21633,6 +21879,7 @@ func TestValidateOSFields(t *testing.T) { "InitContainers[*].SecurityContext.SELinuxOptions", "InitContainers[*].SecurityContext.SeccompProfile", "InitContainers[*].SecurityContext.WindowsOptions", + "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.AppArmorProfile", "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.AllowPrivilegeEscalation", "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.Capabilities", "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.Privileged", @@ -21644,6 +21891,7 @@ func TestValidateOSFields(t *testing.T) { "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.SeccompProfile", "EphemeralContainers[*].EphemeralContainerCommon.SecurityContext.WindowsOptions", "OS", + "SecurityContext.AppArmorProfile", "SecurityContext.FSGroup", "SecurityContext.FSGroupChangePolicy", "SecurityContext.HostIPC", diff --git a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go index 106ba14c3df..4c6969e9fbb 100644 --- a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go +++ b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go @@ -55,11 +55,8 @@ const ( SeccompLocalhostProfileNamePrefix = "localhost/" // AppArmorBetaContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. + // Deprecated: use a pod or container security context `appArmorProfile` field instead. AppArmorBetaContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" - // AppArmorBetaDefaultProfileAnnotationKey is the annotation key specifying the default AppArmor profile. - AppArmorBetaDefaultProfileAnnotationKey = "apparmor.security.beta.kubernetes.io/defaultProfileName" - // AppArmorBetaAllowedProfilesAnnotationKey is the annotation key specifying the allowed AppArmor profiles. - AppArmorBetaAllowedProfilesAnnotationKey = "apparmor.security.beta.kubernetes.io/allowedProfileNames" // AppArmorBetaProfileRuntimeDefault is the profile specifying the runtime default. AppArmorBetaProfileRuntimeDefault = "runtime/default" diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go index e1d058f1e30..aceab6bfce2 100644 --- a/staging/src/k8s.io/api/core/v1/types.go +++ b/staging/src/k8s.io/api/core/v1/types.go @@ -3757,6 +3757,7 @@ type PodSpec struct { // - spec.hostPID // - spec.hostIPC // - spec.hostUsers + // - spec.securityContext.appArmorProfile // - spec.securityContext.seLinuxOptions // - spec.securityContext.seccompProfile // - spec.securityContext.fsGroup @@ -3766,6 +3767,7 @@ type PodSpec struct { // - spec.securityContext.runAsUser // - spec.securityContext.runAsGroup // - spec.securityContext.supplementalGroups + // - spec.containers[*].securityContext.appArmorProfile // - spec.containers[*].securityContext.seLinuxOptions // - spec.containers[*].securityContext.seccompProfile // - spec.containers[*].securityContext.capabilities @@ -4158,6 +4160,10 @@ type PodSecurityContext struct { // Note that this field cannot be set when spec.os.name is windows. // +optional SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,10,opt,name=seccompProfile"` + // appArmorProfile is the AppArmor options to use by the containers in this pod. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty"` } // SeccompProfile defines a pod/container's seccomp profile settings. @@ -4194,6 +4200,38 @@ const ( SeccompProfileTypeLocalhost SeccompProfileType = "Localhost" ) +// AppArmorProfile defines a pod or container's AppArmor settings. +// +union +type AppArmorProfile struct { + // type indicates which kind of AppArmor profile will be applied. + // Valid options are: + // Localhost - a profile pre-loaded on the node. + // RuntimeDefault - the container runtime's default profile. + // Unconfined - no AppArmor enforcement. + // +unionDiscriminator + Type AppArmorProfileType `json:"type"` + + // localhostProfile indicates a profile loaded on the node that should be used. + // The profile must be preconfigured on the node to work. + // Must match the loaded name of the profile. + // Must be set if and only if type is "Localhost". + // +optional + LocalhostProfile *string `json:"localhostProfile,omitempty"` +} + +// +enum +type AppArmorProfileType string + +const ( + // AppArmorProfileTypeUnconfined indicates that no AppArmor profile should be enforced. + AppArmorProfileTypeUnconfined AppArmorProfileType = "Unconfined" + // AppArmorProfileTypeRuntimeDefault indicates that the container runtime's default AppArmor + // profile should be used. + AppArmorProfileTypeRuntimeDefault AppArmorProfileType = "RuntimeDefault" + // AppArmorProfileTypeLocalhost indicates that a profile pre-loaded on the node should be used. + AppArmorProfileTypeLocalhost AppArmorProfileType = "Localhost" +) + // PodQOSClass defines the supported qos classes of Pods. // +enum type PodQOSClass string @@ -7213,6 +7251,11 @@ type SecurityContext struct { // Note that this field cannot be set when spec.os.name is windows. // +optional SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,11,opt,name=seccompProfile"` + // appArmorProfile is the AppArmor options to use by this container. If set, this profile + // overrides the pod's appArmorProfile. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty"` } // +enum From b7f620c12b7f2dbd7907ccad1ca63811a5c5766b Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Tue, 20 Feb 2024 20:04:35 -0800 Subject: [PATCH 02/12] Generated code --- api/openapi-spec/swagger.json | 35 +- api/openapi-spec/v3/api__v1_openapi.json | 44 +- .../v3/apis__apps__v1_openapi.json | 44 +- .../v3/apis__batch__v1_openapi.json | 44 +- pkg/apis/core/v1/zz_generated.conversion.go | 36 + pkg/apis/core/zz_generated.deepcopy.go | 31 + pkg/generated/openapi/zz_generated.openapi.go | 61 +- .../src/k8s.io/api/core/v1/generated.pb.go | 2688 +++++++++-------- .../src/k8s.io/api/core/v1/generated.proto | 32 + staging/src/k8s.io/api/core/v1/types.go | 8 +- .../core/v1/types_swagger_doc_generated.go | 14 +- .../api/core/v1/zz_generated.deepcopy.go | 31 + .../api/testdata/HEAD/apps.v1.DaemonSet.json | 16 + .../api/testdata/HEAD/apps.v1.DaemonSet.pb | Bin 10589 -> 10733 bytes .../api/testdata/HEAD/apps.v1.DaemonSet.yaml | 12 + .../api/testdata/HEAD/apps.v1.Deployment.json | 16 + .../api/testdata/HEAD/apps.v1.Deployment.pb | Bin 10602 -> 10746 bytes .../api/testdata/HEAD/apps.v1.Deployment.yaml | 12 + .../api/testdata/HEAD/apps.v1.ReplicaSet.json | 16 + .../api/testdata/HEAD/apps.v1.ReplicaSet.pb | Bin 10519 -> 10663 bytes .../api/testdata/HEAD/apps.v1.ReplicaSet.yaml | 12 + .../testdata/HEAD/apps.v1.StatefulSet.json | 16 + .../api/testdata/HEAD/apps.v1.StatefulSet.pb | Bin 11690 -> 11834 bytes .../testdata/HEAD/apps.v1.StatefulSet.yaml | 12 + .../HEAD/apps.v1beta1.Deployment.json | 16 + .../testdata/HEAD/apps.v1beta1.Deployment.pb | Bin 10611 -> 10755 bytes .../HEAD/apps.v1beta1.Deployment.yaml | 12 + .../HEAD/apps.v1beta1.StatefulSet.json | 16 + .../testdata/HEAD/apps.v1beta1.StatefulSet.pb | Bin 11695 -> 11839 bytes .../HEAD/apps.v1beta1.StatefulSet.yaml | 12 + .../testdata/HEAD/apps.v1beta2.DaemonSet.json | 16 + .../testdata/HEAD/apps.v1beta2.DaemonSet.pb | Bin 10594 -> 10738 bytes .../testdata/HEAD/apps.v1beta2.DaemonSet.yaml | 12 + .../HEAD/apps.v1beta2.Deployment.json | 16 + .../testdata/HEAD/apps.v1beta2.Deployment.pb | Bin 10607 -> 10751 bytes .../HEAD/apps.v1beta2.Deployment.yaml | 12 + .../HEAD/apps.v1beta2.ReplicaSet.json | 16 + .../testdata/HEAD/apps.v1beta2.ReplicaSet.pb | Bin 10524 -> 10668 bytes .../HEAD/apps.v1beta2.ReplicaSet.yaml | 12 + .../HEAD/apps.v1beta2.StatefulSet.json | 16 + .../testdata/HEAD/apps.v1beta2.StatefulSet.pb | Bin 11695 -> 11839 bytes .../HEAD/apps.v1beta2.StatefulSet.yaml | 12 + .../api/testdata/HEAD/batch.v1.CronJob.json | 16 + .../api/testdata/HEAD/batch.v1.CronJob.pb | Bin 11152 -> 11296 bytes .../api/testdata/HEAD/batch.v1.CronJob.yaml | 12 + .../api/testdata/HEAD/batch.v1.Job.json | 16 + .../k8s.io/api/testdata/HEAD/batch.v1.Job.pb | Bin 10778 -> 10922 bytes .../api/testdata/HEAD/batch.v1.Job.yaml | 12 + .../testdata/HEAD/batch.v1beta1.CronJob.json | 16 + .../testdata/HEAD/batch.v1beta1.CronJob.pb | Bin 11157 -> 11301 bytes .../testdata/HEAD/batch.v1beta1.CronJob.yaml | 12 + .../k8s.io/api/testdata/HEAD/core.v1.Pod.json | 16 + .../k8s.io/api/testdata/HEAD/core.v1.Pod.pb | Bin 11376 -> 11520 bytes .../k8s.io/api/testdata/HEAD/core.v1.Pod.yaml | 12 + .../testdata/HEAD/core.v1.PodTemplate.json | 16 + .../api/testdata/HEAD/core.v1.PodTemplate.pb | Bin 10355 -> 10499 bytes .../testdata/HEAD/core.v1.PodTemplate.yaml | 12 + .../HEAD/core.v1.ReplicationController.json | 16 + .../HEAD/core.v1.ReplicationController.pb | Bin 10477 -> 10621 bytes .../HEAD/core.v1.ReplicationController.yaml | 12 + .../HEAD/extensions.v1beta1.DaemonSet.json | 16 + .../HEAD/extensions.v1beta1.DaemonSet.pb | Bin 10602 -> 10746 bytes .../HEAD/extensions.v1beta1.DaemonSet.yaml | 12 + .../HEAD/extensions.v1beta1.Deployment.json | 16 + .../HEAD/extensions.v1beta1.Deployment.pb | Bin 10617 -> 10761 bytes .../HEAD/extensions.v1beta1.Deployment.yaml | 12 + .../HEAD/extensions.v1beta1.ReplicaSet.json | 16 + .../HEAD/extensions.v1beta1.ReplicaSet.pb | Bin 10530 -> 10674 bytes .../HEAD/extensions.v1beta1.ReplicaSet.yaml | 12 + .../core/v1/apparmorprofile.go | 52 + .../core/v1/podsecuritycontext.go | 9 + .../core/v1/securitycontext.go | 9 + .../applyconfigurations/internal/internal.go | 21 + .../client-go/applyconfigurations/utils.go | 2 + 74 files changed, 2495 insertions(+), 1198 deletions(-) create mode 100644 staging/src/k8s.io/client-go/applyconfigurations/core/v1/apparmorprofile.go diff --git a/api/openapi-spec/swagger.json b/api/openapi-spec/swagger.json index b0e7236fdc5..3f371469f0c 100644 --- a/api/openapi-spec/swagger.json +++ b/api/openapi-spec/swagger.json @@ -4933,6 +4933,31 @@ }, "type": "object" }, + "io.k8s.api.core.v1.AppArmorProfile": { + "description": "AppArmorProfile defines a pod or container's AppArmor settings.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "description": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "localhostProfile": "LocalhostProfile" + } + } + ] + }, "io.k8s.api.core.v1.AttachedVolume": { "description": "AttachedVolume describes a volume attached to a node", "properties": { @@ -8812,6 +8837,10 @@ "io.k8s.api.core.v1.PodSecurityContext": { "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.", "properties": { + "appArmorProfile": { + "$ref": "#/definitions/io.k8s.api.core.v1.AppArmorProfile", + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows." + }, "fsGroup": { "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", @@ -8994,7 +9023,7 @@ }, "os": { "$ref": "#/definitions/io.k8s.api.core.v1.PodOS", - "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" + "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" }, "overhead": { "additionalProperties": { @@ -10316,6 +10345,10 @@ "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, + "appArmorProfile": { + "$ref": "#/definitions/io.k8s.api.core.v1.AppArmorProfile", + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows." + }, "capabilities": { "$ref": "#/definitions/io.k8s.api.core.v1.Capabilities", "description": "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows." diff --git a/api/openapi-spec/v3/api__v1_openapi.json b/api/openapi-spec/v3/api__v1_openapi.json index 270fee33082..33bdee9a2c7 100644 --- a/api/openapi-spec/v3/api__v1_openapi.json +++ b/api/openapi-spec/v3/api__v1_openapi.json @@ -263,6 +263,32 @@ }, "type": "object" }, + "io.k8s.api.core.v1.AppArmorProfile": { + "description": "AppArmorProfile defines a pod or container's AppArmor settings.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "default": "", + "description": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "localhostProfile": "LocalhostProfile" + } + } + ] + }, "io.k8s.api.core.v1.AttachedVolume": { "description": "AttachedVolume describes a volume attached to a node", "properties": { @@ -5161,6 +5187,14 @@ "io.k8s.api.core.v1.PodSecurityContext": { "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.", "properties": { + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows." + }, "fsGroup": { "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", @@ -5399,7 +5433,7 @@ "$ref": "#/components/schemas/io.k8s.api.core.v1.PodOS" } ], - "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" + "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" }, "overhead": { "additionalProperties": { @@ -6999,6 +7033,14 @@ "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows." + }, "capabilities": { "allOf": [ { diff --git a/api/openapi-spec/v3/apis__apps__v1_openapi.json b/api/openapi-spec/v3/apis__apps__v1_openapi.json index b76607a65b1..0fa2004ef73 100644 --- a/api/openapi-spec/v3/apis__apps__v1_openapi.json +++ b/api/openapi-spec/v3/apis__apps__v1_openapi.json @@ -1391,6 +1391,32 @@ }, "type": "object" }, + "io.k8s.api.core.v1.AppArmorProfile": { + "description": "AppArmorProfile defines a pod or container's AppArmor settings.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "default": "", + "description": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "localhostProfile": "LocalhostProfile" + } + } + ] + }, "io.k8s.api.core.v1.AzureDiskVolumeSource": { "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.", "properties": { @@ -3578,6 +3604,14 @@ "io.k8s.api.core.v1.PodSecurityContext": { "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.", "properties": { + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows." + }, "fsGroup": { "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", @@ -3816,7 +3850,7 @@ "$ref": "#/components/schemas/io.k8s.api.core.v1.PodOS" } ], - "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" + "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" }, "overhead": { "additionalProperties": { @@ -4524,6 +4558,14 @@ "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows." + }, "capabilities": { "allOf": [ { diff --git a/api/openapi-spec/v3/apis__batch__v1_openapi.json b/api/openapi-spec/v3/apis__batch__v1_openapi.json index 56f703633bb..b770664f1aa 100644 --- a/api/openapi-spec/v3/apis__batch__v1_openapi.json +++ b/api/openapi-spec/v3/apis__batch__v1_openapi.json @@ -695,6 +695,32 @@ }, "type": "object" }, + "io.k8s.api.core.v1.AppArmorProfile": { + "description": "AppArmorProfile defines a pod or container's AppArmor settings.", + "properties": { + "localhostProfile": { + "description": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", + "type": "string" + }, + "type": { + "default": "", + "description": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "localhostProfile": "LocalhostProfile" + } + } + ] + }, "io.k8s.api.core.v1.AzureDiskVolumeSource": { "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.", "properties": { @@ -2737,6 +2763,14 @@ "io.k8s.api.core.v1.PodSecurityContext": { "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.", "properties": { + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows." + }, "fsGroup": { "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", @@ -2975,7 +3009,7 @@ "$ref": "#/components/schemas/io.k8s.api.core.v1.PodOS" } ], - "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" + "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup" }, "overhead": { "additionalProperties": { @@ -3683,6 +3717,14 @@ "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, + "appArmorProfile": { + "allOf": [ + { + "$ref": "#/components/schemas/io.k8s.api.core.v1.AppArmorProfile" + } + ], + "description": "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows." + }, "capabilities": { "allOf": [ { diff --git a/pkg/apis/core/v1/zz_generated.conversion.go b/pkg/apis/core/v1/zz_generated.conversion.go index 6040bde9826..653ea5a7720 100644 --- a/pkg/apis/core/v1/zz_generated.conversion.go +++ b/pkg/apis/core/v1/zz_generated.conversion.go @@ -62,6 +62,16 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } + if err := s.AddGeneratedConversionFunc((*v1.AppArmorProfile)(nil), (*core.AppArmorProfile)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AppArmorProfile_To_core_AppArmorProfile(a.(*v1.AppArmorProfile), b.(*core.AppArmorProfile), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*core.AppArmorProfile)(nil), (*v1.AppArmorProfile)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_core_AppArmorProfile_To_v1_AppArmorProfile(a.(*core.AppArmorProfile), b.(*v1.AppArmorProfile), scope) + }); err != nil { + return err + } if err := s.AddGeneratedConversionFunc((*v1.AttachedVolume)(nil), (*core.AttachedVolume)(nil), func(a, b interface{}, scope conversion.Scope) error { return Convert_v1_AttachedVolume_To_core_AttachedVolume(a.(*v1.AttachedVolume), b.(*core.AttachedVolume), scope) }); err != nil { @@ -2375,6 +2385,28 @@ func Convert_core_Affinity_To_v1_Affinity(in *core.Affinity, out *v1.Affinity, s return autoConvert_core_Affinity_To_v1_Affinity(in, out, s) } +func autoConvert_v1_AppArmorProfile_To_core_AppArmorProfile(in *v1.AppArmorProfile, out *core.AppArmorProfile, s conversion.Scope) error { + out.Type = core.AppArmorProfileType(in.Type) + out.LocalhostProfile = (*string)(unsafe.Pointer(in.LocalhostProfile)) + return nil +} + +// Convert_v1_AppArmorProfile_To_core_AppArmorProfile is an autogenerated conversion function. +func Convert_v1_AppArmorProfile_To_core_AppArmorProfile(in *v1.AppArmorProfile, out *core.AppArmorProfile, s conversion.Scope) error { + return autoConvert_v1_AppArmorProfile_To_core_AppArmorProfile(in, out, s) +} + +func autoConvert_core_AppArmorProfile_To_v1_AppArmorProfile(in *core.AppArmorProfile, out *v1.AppArmorProfile, s conversion.Scope) error { + out.Type = v1.AppArmorProfileType(in.Type) + out.LocalhostProfile = (*string)(unsafe.Pointer(in.LocalhostProfile)) + return nil +} + +// Convert_core_AppArmorProfile_To_v1_AppArmorProfile is an autogenerated conversion function. +func Convert_core_AppArmorProfile_To_v1_AppArmorProfile(in *core.AppArmorProfile, out *v1.AppArmorProfile, s conversion.Scope) error { + return autoConvert_core_AppArmorProfile_To_v1_AppArmorProfile(in, out, s) +} + func autoConvert_v1_AttachedVolume_To_core_AttachedVolume(in *v1.AttachedVolume, out *core.AttachedVolume, s conversion.Scope) error { out.Name = core.UniqueVolumeName(in.Name) out.DevicePath = in.DevicePath @@ -6382,6 +6414,7 @@ func autoConvert_v1_PodSecurityContext_To_core_PodSecurityContext(in *v1.PodSecu out.Sysctls = *(*[]core.Sysctl)(unsafe.Pointer(&in.Sysctls)) out.FSGroupChangePolicy = (*core.PodFSGroupChangePolicy)(unsafe.Pointer(in.FSGroupChangePolicy)) out.SeccompProfile = (*core.SeccompProfile)(unsafe.Pointer(in.SeccompProfile)) + out.AppArmorProfile = (*core.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile)) return nil } @@ -6406,6 +6439,7 @@ func autoConvert_core_PodSecurityContext_To_v1_PodSecurityContext(in *core.PodSe out.FSGroupChangePolicy = (*v1.PodFSGroupChangePolicy)(unsafe.Pointer(in.FSGroupChangePolicy)) out.Sysctls = *(*[]v1.Sysctl)(unsafe.Pointer(&in.Sysctls)) out.SeccompProfile = (*v1.SeccompProfile)(unsafe.Pointer(in.SeccompProfile)) + out.AppArmorProfile = (*v1.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile)) return nil } @@ -7759,6 +7793,7 @@ func autoConvert_v1_SecurityContext_To_core_SecurityContext(in *v1.SecurityConte out.AllowPrivilegeEscalation = (*bool)(unsafe.Pointer(in.AllowPrivilegeEscalation)) out.ProcMount = (*core.ProcMountType)(unsafe.Pointer(in.ProcMount)) out.SeccompProfile = (*core.SeccompProfile)(unsafe.Pointer(in.SeccompProfile)) + out.AppArmorProfile = (*core.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile)) return nil } @@ -7779,6 +7814,7 @@ func autoConvert_core_SecurityContext_To_v1_SecurityContext(in *core.SecurityCon out.AllowPrivilegeEscalation = (*bool)(unsafe.Pointer(in.AllowPrivilegeEscalation)) out.ProcMount = (*v1.ProcMountType)(unsafe.Pointer(in.ProcMount)) out.SeccompProfile = (*v1.SeccompProfile)(unsafe.Pointer(in.SeccompProfile)) + out.AppArmorProfile = (*v1.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile)) return nil } diff --git a/pkg/apis/core/zz_generated.deepcopy.go b/pkg/apis/core/zz_generated.deepcopy.go index 11d9d0e2f52..20923d84869 100644 --- a/pkg/apis/core/zz_generated.deepcopy.go +++ b/pkg/apis/core/zz_generated.deepcopy.go @@ -74,6 +74,27 @@ func (in *Affinity) DeepCopy() *Affinity { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppArmorProfile) DeepCopyInto(out *AppArmorProfile) { + *out = *in + if in.LocalhostProfile != nil { + in, out := &in.LocalhostProfile, &out.LocalhostProfile + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppArmorProfile. +func (in *AppArmorProfile) DeepCopy() *AppArmorProfile { + if in == nil { + return nil + } + out := new(AppArmorProfile) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AttachedVolume) DeepCopyInto(out *AttachedVolume) { *out = *in @@ -4010,6 +4031,11 @@ func (in *PodSecurityContext) DeepCopyInto(out *PodSecurityContext) { *out = new(SeccompProfile) (*in).DeepCopyInto(*out) } + if in.AppArmorProfile != nil { + in, out := &in.AppArmorProfile, &out.AppArmorProfile + *out = new(AppArmorProfile) + (*in).DeepCopyInto(*out) + } return } @@ -5378,6 +5404,11 @@ func (in *SecurityContext) DeepCopyInto(out *SecurityContext) { *out = new(SeccompProfile) (*in).DeepCopyInto(*out) } + if in.AppArmorProfile != nil { + in, out := &in.AppArmorProfile, &out.AppArmorProfile + *out = new(AppArmorProfile) + (*in).DeepCopyInto(*out) + } return } diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go index 9fe6fa74891..267acbc9b27 100644 --- a/pkg/generated/openapi/zz_generated.openapi.go +++ b/pkg/generated/openapi/zz_generated.openapi.go @@ -360,6 +360,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA "k8s.io/api/coordination/v1beta1.LeaseSpec": schema_k8sio_api_coordination_v1beta1_LeaseSpec(ref), "k8s.io/api/core/v1.AWSElasticBlockStoreVolumeSource": schema_k8sio_api_core_v1_AWSElasticBlockStoreVolumeSource(ref), "k8s.io/api/core/v1.Affinity": schema_k8sio_api_core_v1_Affinity(ref), + "k8s.io/api/core/v1.AppArmorProfile": schema_k8sio_api_core_v1_AppArmorProfile(ref), "k8s.io/api/core/v1.AttachedVolume": schema_k8sio_api_core_v1_AttachedVolume(ref), "k8s.io/api/core/v1.AvoidPods": schema_k8sio_api_core_v1_AvoidPods(ref), "k8s.io/api/core/v1.AzureDiskVolumeSource": schema_k8sio_api_core_v1_AzureDiskVolumeSource(ref), @@ -17980,6 +17981,48 @@ func schema_k8sio_api_core_v1_Affinity(ref common.ReferenceCallback) common.Open } } +func schema_k8sio_api_core_v1_AppArmorProfile(ref common.ReferenceCallback) common.OpenAPIDefinition { + return common.OpenAPIDefinition{ + Schema: spec.Schema{ + SchemaProps: spec.SchemaProps{ + Description: "AppArmorProfile defines a pod or container's AppArmor settings.", + Type: []string{"object"}, + Properties: map[string]spec.Schema{ + "type": { + SchemaProps: spec.SchemaProps{ + Description: "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.\n\nPossible enum values:\n - `\"Localhost\"` indicates that a profile pre-loaded on the node should be used.\n - `\"RuntimeDefault\"` indicates that the container runtime's default AppArmor profile should be used.\n - `\"Unconfined\"` indicates that no AppArmor profile should be enforced.", + Default: "", + Type: []string{"string"}, + Format: "", + Enum: []interface{}{"Localhost", "RuntimeDefault", "Unconfined"}, + }, + }, + "localhostProfile": { + SchemaProps: spec.SchemaProps{ + Description: "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", + Type: []string{"string"}, + Format: "", + }, + }, + }, + Required: []string{"type"}, + }, + VendorExtensible: spec.VendorExtensible{ + Extensions: spec.Extensions{ + "x-kubernetes-unions": []interface{}{ + map[string]interface{}{ + "discriminator": "type", + "fields-to-discriminateBy": map[string]interface{}{ + "localhostProfile": "LocalhostProfile", + }, + }, + }, + }, + }, + }, + } +} + func schema_k8sio_api_core_v1_AttachedVolume(ref common.ReferenceCallback) common.OpenAPIDefinition { return common.OpenAPIDefinition{ Schema: spec.Schema{ @@ -26001,11 +26044,17 @@ func schema_k8sio_api_core_v1_PodSecurityContext(ref common.ReferenceCallback) c Ref: ref("k8s.io/api/core/v1.SeccompProfile"), }, }, + "appArmorProfile": { + SchemaProps: spec.SchemaProps{ + Description: "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.", + Ref: ref("k8s.io/api/core/v1.AppArmorProfile"), + }, + }, }, }, }, Dependencies: []string{ - "k8s.io/api/core/v1.SELinuxOptions", "k8s.io/api/core/v1.SeccompProfile", "k8s.io/api/core/v1.Sysctl", "k8s.io/api/core/v1.WindowsSecurityContextOptions"}, + "k8s.io/api/core/v1.AppArmorProfile", "k8s.io/api/core/v1.SELinuxOptions", "k8s.io/api/core/v1.SeccompProfile", "k8s.io/api/core/v1.Sysctl", "k8s.io/api/core/v1.WindowsSecurityContextOptions"}, } } @@ -26449,7 +26498,7 @@ func schema_k8sio_api_core_v1_PodSpec(ref common.ReferenceCallback) common.OpenA }, "os": { SchemaProps: spec.SchemaProps{ - Description: "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup", + Description: "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup", Ref: ref("k8s.io/api/core/v1.PodOS"), }, }, @@ -28878,11 +28927,17 @@ func schema_k8sio_api_core_v1_SecurityContext(ref common.ReferenceCallback) comm Ref: ref("k8s.io/api/core/v1.SeccompProfile"), }, }, + "appArmorProfile": { + SchemaProps: spec.SchemaProps{ + Description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.", + Ref: ref("k8s.io/api/core/v1.AppArmorProfile"), + }, + }, }, }, }, Dependencies: []string{ - "k8s.io/api/core/v1.Capabilities", "k8s.io/api/core/v1.SELinuxOptions", "k8s.io/api/core/v1.SeccompProfile", "k8s.io/api/core/v1.WindowsSecurityContextOptions"}, + "k8s.io/api/core/v1.AppArmorProfile", "k8s.io/api/core/v1.Capabilities", "k8s.io/api/core/v1.SELinuxOptions", "k8s.io/api/core/v1.SeccompProfile", "k8s.io/api/core/v1.WindowsSecurityContextOptions"}, } } diff --git a/staging/src/k8s.io/api/core/v1/generated.pb.go b/staging/src/k8s.io/api/core/v1/generated.pb.go index f886c37262a..7d551c651d0 100644 --- a/staging/src/k8s.io/api/core/v1/generated.pb.go +++ b/staging/src/k8s.io/api/core/v1/generated.pb.go @@ -105,10 +105,38 @@ func (m *Affinity) XXX_DiscardUnknown() { var xxx_messageInfo_Affinity proto.InternalMessageInfo +func (m *AppArmorProfile) Reset() { *m = AppArmorProfile{} } +func (*AppArmorProfile) ProtoMessage() {} +func (*AppArmorProfile) Descriptor() ([]byte, []int) { + return fileDescriptor_6c07b07c062484ab, []int{2} +} +func (m *AppArmorProfile) XXX_Unmarshal(b []byte) error { + return m.Unmarshal(b) +} +func (m *AppArmorProfile) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) { + b = b[:cap(b)] + n, err := m.MarshalToSizedBuffer(b) + if err != nil { + return nil, err + } + return b[:n], nil +} +func (m *AppArmorProfile) XXX_Merge(src proto.Message) { + xxx_messageInfo_AppArmorProfile.Merge(m, src) +} +func (m *AppArmorProfile) XXX_Size() int { + return m.Size() +} +func (m *AppArmorProfile) XXX_DiscardUnknown() { + xxx_messageInfo_AppArmorProfile.DiscardUnknown(m) +} + +var xxx_messageInfo_AppArmorProfile proto.InternalMessageInfo + func (m *AttachedVolume) Reset() { *m = AttachedVolume{} } func (*AttachedVolume) ProtoMessage() {} func (*AttachedVolume) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{2} + return fileDescriptor_6c07b07c062484ab, []int{3} } func (m *AttachedVolume) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -136,7 +164,7 @@ var xxx_messageInfo_AttachedVolume proto.InternalMessageInfo func (m *AvoidPods) Reset() { *m = AvoidPods{} } func (*AvoidPods) ProtoMessage() {} func (*AvoidPods) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{3} + return fileDescriptor_6c07b07c062484ab, []int{4} } func (m *AvoidPods) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -164,7 +192,7 @@ var xxx_messageInfo_AvoidPods proto.InternalMessageInfo func (m *AzureDiskVolumeSource) Reset() { *m = AzureDiskVolumeSource{} } func (*AzureDiskVolumeSource) ProtoMessage() {} func (*AzureDiskVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{4} + return fileDescriptor_6c07b07c062484ab, []int{5} } func (m *AzureDiskVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -192,7 +220,7 @@ var xxx_messageInfo_AzureDiskVolumeSource proto.InternalMessageInfo func (m *AzureFilePersistentVolumeSource) Reset() { *m = AzureFilePersistentVolumeSource{} } func (*AzureFilePersistentVolumeSource) ProtoMessage() {} func (*AzureFilePersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{5} + return fileDescriptor_6c07b07c062484ab, []int{6} } func (m *AzureFilePersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -220,7 +248,7 @@ var xxx_messageInfo_AzureFilePersistentVolumeSource proto.InternalMessageInfo func (m *AzureFileVolumeSource) Reset() { *m = AzureFileVolumeSource{} } func (*AzureFileVolumeSource) ProtoMessage() {} func (*AzureFileVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{6} + return fileDescriptor_6c07b07c062484ab, []int{7} } func (m *AzureFileVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -248,7 +276,7 @@ var xxx_messageInfo_AzureFileVolumeSource proto.InternalMessageInfo func (m *Binding) Reset() { *m = Binding{} } func (*Binding) ProtoMessage() {} func (*Binding) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{7} + return fileDescriptor_6c07b07c062484ab, []int{8} } func (m *Binding) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -276,7 +304,7 @@ var xxx_messageInfo_Binding proto.InternalMessageInfo func (m *CSIPersistentVolumeSource) Reset() { *m = CSIPersistentVolumeSource{} } func (*CSIPersistentVolumeSource) ProtoMessage() {} func (*CSIPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{8} + return fileDescriptor_6c07b07c062484ab, []int{9} } func (m *CSIPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -304,7 +332,7 @@ var xxx_messageInfo_CSIPersistentVolumeSource proto.InternalMessageInfo func (m *CSIVolumeSource) Reset() { *m = CSIVolumeSource{} } func (*CSIVolumeSource) ProtoMessage() {} func (*CSIVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{9} + return fileDescriptor_6c07b07c062484ab, []int{10} } func (m *CSIVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -332,7 +360,7 @@ var xxx_messageInfo_CSIVolumeSource proto.InternalMessageInfo func (m *Capabilities) Reset() { *m = Capabilities{} } func (*Capabilities) ProtoMessage() {} func (*Capabilities) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{10} + return fileDescriptor_6c07b07c062484ab, []int{11} } func (m *Capabilities) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -360,7 +388,7 @@ var xxx_messageInfo_Capabilities proto.InternalMessageInfo func (m *CephFSPersistentVolumeSource) Reset() { *m = CephFSPersistentVolumeSource{} } func (*CephFSPersistentVolumeSource) ProtoMessage() {} func (*CephFSPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{11} + return fileDescriptor_6c07b07c062484ab, []int{12} } func (m *CephFSPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -388,7 +416,7 @@ var xxx_messageInfo_CephFSPersistentVolumeSource proto.InternalMessageInfo func (m *CephFSVolumeSource) Reset() { *m = CephFSVolumeSource{} } func (*CephFSVolumeSource) ProtoMessage() {} func (*CephFSVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{12} + return fileDescriptor_6c07b07c062484ab, []int{13} } func (m *CephFSVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -416,7 +444,7 @@ var xxx_messageInfo_CephFSVolumeSource proto.InternalMessageInfo func (m *CinderPersistentVolumeSource) Reset() { *m = CinderPersistentVolumeSource{} } func (*CinderPersistentVolumeSource) ProtoMessage() {} func (*CinderPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{13} + return fileDescriptor_6c07b07c062484ab, []int{14} } func (m *CinderPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -444,7 +472,7 @@ var xxx_messageInfo_CinderPersistentVolumeSource proto.InternalMessageInfo func (m *CinderVolumeSource) Reset() { *m = CinderVolumeSource{} } func (*CinderVolumeSource) ProtoMessage() {} func (*CinderVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{14} + return fileDescriptor_6c07b07c062484ab, []int{15} } func (m *CinderVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -472,7 +500,7 @@ var xxx_messageInfo_CinderVolumeSource proto.InternalMessageInfo func (m *ClaimSource) Reset() { *m = ClaimSource{} } func (*ClaimSource) ProtoMessage() {} func (*ClaimSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{15} + return fileDescriptor_6c07b07c062484ab, []int{16} } func (m *ClaimSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -500,7 +528,7 @@ var xxx_messageInfo_ClaimSource proto.InternalMessageInfo func (m *ClientIPConfig) Reset() { *m = ClientIPConfig{} } func (*ClientIPConfig) ProtoMessage() {} func (*ClientIPConfig) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{16} + return fileDescriptor_6c07b07c062484ab, []int{17} } func (m *ClientIPConfig) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -528,7 +556,7 @@ var xxx_messageInfo_ClientIPConfig proto.InternalMessageInfo func (m *ClusterTrustBundleProjection) Reset() { *m = ClusterTrustBundleProjection{} } func (*ClusterTrustBundleProjection) ProtoMessage() {} func (*ClusterTrustBundleProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{17} + return fileDescriptor_6c07b07c062484ab, []int{18} } func (m *ClusterTrustBundleProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -556,7 +584,7 @@ var xxx_messageInfo_ClusterTrustBundleProjection proto.InternalMessageInfo func (m *ComponentCondition) Reset() { *m = ComponentCondition{} } func (*ComponentCondition) ProtoMessage() {} func (*ComponentCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{18} + return fileDescriptor_6c07b07c062484ab, []int{19} } func (m *ComponentCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -584,7 +612,7 @@ var xxx_messageInfo_ComponentCondition proto.InternalMessageInfo func (m *ComponentStatus) Reset() { *m = ComponentStatus{} } func (*ComponentStatus) ProtoMessage() {} func (*ComponentStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{19} + return fileDescriptor_6c07b07c062484ab, []int{20} } func (m *ComponentStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -612,7 +640,7 @@ var xxx_messageInfo_ComponentStatus proto.InternalMessageInfo func (m *ComponentStatusList) Reset() { *m = ComponentStatusList{} } func (*ComponentStatusList) ProtoMessage() {} func (*ComponentStatusList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{20} + return fileDescriptor_6c07b07c062484ab, []int{21} } func (m *ComponentStatusList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -640,7 +668,7 @@ var xxx_messageInfo_ComponentStatusList proto.InternalMessageInfo func (m *ConfigMap) Reset() { *m = ConfigMap{} } func (*ConfigMap) ProtoMessage() {} func (*ConfigMap) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{21} + return fileDescriptor_6c07b07c062484ab, []int{22} } func (m *ConfigMap) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -668,7 +696,7 @@ var xxx_messageInfo_ConfigMap proto.InternalMessageInfo func (m *ConfigMapEnvSource) Reset() { *m = ConfigMapEnvSource{} } func (*ConfigMapEnvSource) ProtoMessage() {} func (*ConfigMapEnvSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{22} + return fileDescriptor_6c07b07c062484ab, []int{23} } func (m *ConfigMapEnvSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -696,7 +724,7 @@ var xxx_messageInfo_ConfigMapEnvSource proto.InternalMessageInfo func (m *ConfigMapKeySelector) Reset() { *m = ConfigMapKeySelector{} } func (*ConfigMapKeySelector) ProtoMessage() {} func (*ConfigMapKeySelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{23} + return fileDescriptor_6c07b07c062484ab, []int{24} } func (m *ConfigMapKeySelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -724,7 +752,7 @@ var xxx_messageInfo_ConfigMapKeySelector proto.InternalMessageInfo func (m *ConfigMapList) Reset() { *m = ConfigMapList{} } func (*ConfigMapList) ProtoMessage() {} func (*ConfigMapList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{24} + return fileDescriptor_6c07b07c062484ab, []int{25} } func (m *ConfigMapList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -752,7 +780,7 @@ var xxx_messageInfo_ConfigMapList proto.InternalMessageInfo func (m *ConfigMapNodeConfigSource) Reset() { *m = ConfigMapNodeConfigSource{} } func (*ConfigMapNodeConfigSource) ProtoMessage() {} func (*ConfigMapNodeConfigSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{25} + return fileDescriptor_6c07b07c062484ab, []int{26} } func (m *ConfigMapNodeConfigSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -780,7 +808,7 @@ var xxx_messageInfo_ConfigMapNodeConfigSource proto.InternalMessageInfo func (m *ConfigMapProjection) Reset() { *m = ConfigMapProjection{} } func (*ConfigMapProjection) ProtoMessage() {} func (*ConfigMapProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{26} + return fileDescriptor_6c07b07c062484ab, []int{27} } func (m *ConfigMapProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -808,7 +836,7 @@ var xxx_messageInfo_ConfigMapProjection proto.InternalMessageInfo func (m *ConfigMapVolumeSource) Reset() { *m = ConfigMapVolumeSource{} } func (*ConfigMapVolumeSource) ProtoMessage() {} func (*ConfigMapVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{27} + return fileDescriptor_6c07b07c062484ab, []int{28} } func (m *ConfigMapVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -836,7 +864,7 @@ var xxx_messageInfo_ConfigMapVolumeSource proto.InternalMessageInfo func (m *Container) Reset() { *m = Container{} } func (*Container) ProtoMessage() {} func (*Container) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{28} + return fileDescriptor_6c07b07c062484ab, []int{29} } func (m *Container) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -864,7 +892,7 @@ var xxx_messageInfo_Container proto.InternalMessageInfo func (m *ContainerImage) Reset() { *m = ContainerImage{} } func (*ContainerImage) ProtoMessage() {} func (*ContainerImage) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{29} + return fileDescriptor_6c07b07c062484ab, []int{30} } func (m *ContainerImage) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -892,7 +920,7 @@ var xxx_messageInfo_ContainerImage proto.InternalMessageInfo func (m *ContainerPort) Reset() { *m = ContainerPort{} } func (*ContainerPort) ProtoMessage() {} func (*ContainerPort) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{30} + return fileDescriptor_6c07b07c062484ab, []int{31} } func (m *ContainerPort) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -920,7 +948,7 @@ var xxx_messageInfo_ContainerPort proto.InternalMessageInfo func (m *ContainerResizePolicy) Reset() { *m = ContainerResizePolicy{} } func (*ContainerResizePolicy) ProtoMessage() {} func (*ContainerResizePolicy) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{31} + return fileDescriptor_6c07b07c062484ab, []int{32} } func (m *ContainerResizePolicy) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -948,7 +976,7 @@ var xxx_messageInfo_ContainerResizePolicy proto.InternalMessageInfo func (m *ContainerState) Reset() { *m = ContainerState{} } func (*ContainerState) ProtoMessage() {} func (*ContainerState) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{32} + return fileDescriptor_6c07b07c062484ab, []int{33} } func (m *ContainerState) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -976,7 +1004,7 @@ var xxx_messageInfo_ContainerState proto.InternalMessageInfo func (m *ContainerStateRunning) Reset() { *m = ContainerStateRunning{} } func (*ContainerStateRunning) ProtoMessage() {} func (*ContainerStateRunning) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{33} + return fileDescriptor_6c07b07c062484ab, []int{34} } func (m *ContainerStateRunning) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1004,7 +1032,7 @@ var xxx_messageInfo_ContainerStateRunning proto.InternalMessageInfo func (m *ContainerStateTerminated) Reset() { *m = ContainerStateTerminated{} } func (*ContainerStateTerminated) ProtoMessage() {} func (*ContainerStateTerminated) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{34} + return fileDescriptor_6c07b07c062484ab, []int{35} } func (m *ContainerStateTerminated) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1032,7 +1060,7 @@ var xxx_messageInfo_ContainerStateTerminated proto.InternalMessageInfo func (m *ContainerStateWaiting) Reset() { *m = ContainerStateWaiting{} } func (*ContainerStateWaiting) ProtoMessage() {} func (*ContainerStateWaiting) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{35} + return fileDescriptor_6c07b07c062484ab, []int{36} } func (m *ContainerStateWaiting) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1060,7 +1088,7 @@ var xxx_messageInfo_ContainerStateWaiting proto.InternalMessageInfo func (m *ContainerStatus) Reset() { *m = ContainerStatus{} } func (*ContainerStatus) ProtoMessage() {} func (*ContainerStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{36} + return fileDescriptor_6c07b07c062484ab, []int{37} } func (m *ContainerStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1088,7 +1116,7 @@ var xxx_messageInfo_ContainerStatus proto.InternalMessageInfo func (m *DaemonEndpoint) Reset() { *m = DaemonEndpoint{} } func (*DaemonEndpoint) ProtoMessage() {} func (*DaemonEndpoint) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{37} + return fileDescriptor_6c07b07c062484ab, []int{38} } func (m *DaemonEndpoint) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1116,7 +1144,7 @@ var xxx_messageInfo_DaemonEndpoint proto.InternalMessageInfo func (m *DownwardAPIProjection) Reset() { *m = DownwardAPIProjection{} } func (*DownwardAPIProjection) ProtoMessage() {} func (*DownwardAPIProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{38} + return fileDescriptor_6c07b07c062484ab, []int{39} } func (m *DownwardAPIProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1144,7 +1172,7 @@ var xxx_messageInfo_DownwardAPIProjection proto.InternalMessageInfo func (m *DownwardAPIVolumeFile) Reset() { *m = DownwardAPIVolumeFile{} } func (*DownwardAPIVolumeFile) ProtoMessage() {} func (*DownwardAPIVolumeFile) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{39} + return fileDescriptor_6c07b07c062484ab, []int{40} } func (m *DownwardAPIVolumeFile) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1172,7 +1200,7 @@ var xxx_messageInfo_DownwardAPIVolumeFile proto.InternalMessageInfo func (m *DownwardAPIVolumeSource) Reset() { *m = DownwardAPIVolumeSource{} } func (*DownwardAPIVolumeSource) ProtoMessage() {} func (*DownwardAPIVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{40} + return fileDescriptor_6c07b07c062484ab, []int{41} } func (m *DownwardAPIVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1200,7 +1228,7 @@ var xxx_messageInfo_DownwardAPIVolumeSource proto.InternalMessageInfo func (m *EmptyDirVolumeSource) Reset() { *m = EmptyDirVolumeSource{} } func (*EmptyDirVolumeSource) ProtoMessage() {} func (*EmptyDirVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{41} + return fileDescriptor_6c07b07c062484ab, []int{42} } func (m *EmptyDirVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1228,7 +1256,7 @@ var xxx_messageInfo_EmptyDirVolumeSource proto.InternalMessageInfo func (m *EndpointAddress) Reset() { *m = EndpointAddress{} } func (*EndpointAddress) ProtoMessage() {} func (*EndpointAddress) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{42} + return fileDescriptor_6c07b07c062484ab, []int{43} } func (m *EndpointAddress) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1256,7 +1284,7 @@ var xxx_messageInfo_EndpointAddress proto.InternalMessageInfo func (m *EndpointPort) Reset() { *m = EndpointPort{} } func (*EndpointPort) ProtoMessage() {} func (*EndpointPort) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{43} + return fileDescriptor_6c07b07c062484ab, []int{44} } func (m *EndpointPort) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1284,7 +1312,7 @@ var xxx_messageInfo_EndpointPort proto.InternalMessageInfo func (m *EndpointSubset) Reset() { *m = EndpointSubset{} } func (*EndpointSubset) ProtoMessage() {} func (*EndpointSubset) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{44} + return fileDescriptor_6c07b07c062484ab, []int{45} } func (m *EndpointSubset) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1312,7 +1340,7 @@ var xxx_messageInfo_EndpointSubset proto.InternalMessageInfo func (m *Endpoints) Reset() { *m = Endpoints{} } func (*Endpoints) ProtoMessage() {} func (*Endpoints) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{45} + return fileDescriptor_6c07b07c062484ab, []int{46} } func (m *Endpoints) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1340,7 +1368,7 @@ var xxx_messageInfo_Endpoints proto.InternalMessageInfo func (m *EndpointsList) Reset() { *m = EndpointsList{} } func (*EndpointsList) ProtoMessage() {} func (*EndpointsList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{46} + return fileDescriptor_6c07b07c062484ab, []int{47} } func (m *EndpointsList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1368,7 +1396,7 @@ var xxx_messageInfo_EndpointsList proto.InternalMessageInfo func (m *EnvFromSource) Reset() { *m = EnvFromSource{} } func (*EnvFromSource) ProtoMessage() {} func (*EnvFromSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{47} + return fileDescriptor_6c07b07c062484ab, []int{48} } func (m *EnvFromSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1396,7 +1424,7 @@ var xxx_messageInfo_EnvFromSource proto.InternalMessageInfo func (m *EnvVar) Reset() { *m = EnvVar{} } func (*EnvVar) ProtoMessage() {} func (*EnvVar) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{48} + return fileDescriptor_6c07b07c062484ab, []int{49} } func (m *EnvVar) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1424,7 +1452,7 @@ var xxx_messageInfo_EnvVar proto.InternalMessageInfo func (m *EnvVarSource) Reset() { *m = EnvVarSource{} } func (*EnvVarSource) ProtoMessage() {} func (*EnvVarSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{49} + return fileDescriptor_6c07b07c062484ab, []int{50} } func (m *EnvVarSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1452,7 +1480,7 @@ var xxx_messageInfo_EnvVarSource proto.InternalMessageInfo func (m *EphemeralContainer) Reset() { *m = EphemeralContainer{} } func (*EphemeralContainer) ProtoMessage() {} func (*EphemeralContainer) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{50} + return fileDescriptor_6c07b07c062484ab, []int{51} } func (m *EphemeralContainer) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1480,7 +1508,7 @@ var xxx_messageInfo_EphemeralContainer proto.InternalMessageInfo func (m *EphemeralContainerCommon) Reset() { *m = EphemeralContainerCommon{} } func (*EphemeralContainerCommon) ProtoMessage() {} func (*EphemeralContainerCommon) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{51} + return fileDescriptor_6c07b07c062484ab, []int{52} } func (m *EphemeralContainerCommon) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1508,7 +1536,7 @@ var xxx_messageInfo_EphemeralContainerCommon proto.InternalMessageInfo func (m *EphemeralVolumeSource) Reset() { *m = EphemeralVolumeSource{} } func (*EphemeralVolumeSource) ProtoMessage() {} func (*EphemeralVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{52} + return fileDescriptor_6c07b07c062484ab, []int{53} } func (m *EphemeralVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1536,7 +1564,7 @@ var xxx_messageInfo_EphemeralVolumeSource proto.InternalMessageInfo func (m *Event) Reset() { *m = Event{} } func (*Event) ProtoMessage() {} func (*Event) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{53} + return fileDescriptor_6c07b07c062484ab, []int{54} } func (m *Event) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1564,7 +1592,7 @@ var xxx_messageInfo_Event proto.InternalMessageInfo func (m *EventList) Reset() { *m = EventList{} } func (*EventList) ProtoMessage() {} func (*EventList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{54} + return fileDescriptor_6c07b07c062484ab, []int{55} } func (m *EventList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1592,7 +1620,7 @@ var xxx_messageInfo_EventList proto.InternalMessageInfo func (m *EventSeries) Reset() { *m = EventSeries{} } func (*EventSeries) ProtoMessage() {} func (*EventSeries) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{55} + return fileDescriptor_6c07b07c062484ab, []int{56} } func (m *EventSeries) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1620,7 +1648,7 @@ var xxx_messageInfo_EventSeries proto.InternalMessageInfo func (m *EventSource) Reset() { *m = EventSource{} } func (*EventSource) ProtoMessage() {} func (*EventSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{56} + return fileDescriptor_6c07b07c062484ab, []int{57} } func (m *EventSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1648,7 +1676,7 @@ var xxx_messageInfo_EventSource proto.InternalMessageInfo func (m *ExecAction) Reset() { *m = ExecAction{} } func (*ExecAction) ProtoMessage() {} func (*ExecAction) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{57} + return fileDescriptor_6c07b07c062484ab, []int{58} } func (m *ExecAction) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1676,7 +1704,7 @@ var xxx_messageInfo_ExecAction proto.InternalMessageInfo func (m *FCVolumeSource) Reset() { *m = FCVolumeSource{} } func (*FCVolumeSource) ProtoMessage() {} func (*FCVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{58} + return fileDescriptor_6c07b07c062484ab, []int{59} } func (m *FCVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1704,7 +1732,7 @@ var xxx_messageInfo_FCVolumeSource proto.InternalMessageInfo func (m *FlexPersistentVolumeSource) Reset() { *m = FlexPersistentVolumeSource{} } func (*FlexPersistentVolumeSource) ProtoMessage() {} func (*FlexPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{59} + return fileDescriptor_6c07b07c062484ab, []int{60} } func (m *FlexPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1732,7 +1760,7 @@ var xxx_messageInfo_FlexPersistentVolumeSource proto.InternalMessageInfo func (m *FlexVolumeSource) Reset() { *m = FlexVolumeSource{} } func (*FlexVolumeSource) ProtoMessage() {} func (*FlexVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{60} + return fileDescriptor_6c07b07c062484ab, []int{61} } func (m *FlexVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1760,7 +1788,7 @@ var xxx_messageInfo_FlexVolumeSource proto.InternalMessageInfo func (m *FlockerVolumeSource) Reset() { *m = FlockerVolumeSource{} } func (*FlockerVolumeSource) ProtoMessage() {} func (*FlockerVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{61} + return fileDescriptor_6c07b07c062484ab, []int{62} } func (m *FlockerVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1788,7 +1816,7 @@ var xxx_messageInfo_FlockerVolumeSource proto.InternalMessageInfo func (m *GCEPersistentDiskVolumeSource) Reset() { *m = GCEPersistentDiskVolumeSource{} } func (*GCEPersistentDiskVolumeSource) ProtoMessage() {} func (*GCEPersistentDiskVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{62} + return fileDescriptor_6c07b07c062484ab, []int{63} } func (m *GCEPersistentDiskVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1816,7 +1844,7 @@ var xxx_messageInfo_GCEPersistentDiskVolumeSource proto.InternalMessageInfo func (m *GRPCAction) Reset() { *m = GRPCAction{} } func (*GRPCAction) ProtoMessage() {} func (*GRPCAction) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{63} + return fileDescriptor_6c07b07c062484ab, []int{64} } func (m *GRPCAction) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1844,7 +1872,7 @@ var xxx_messageInfo_GRPCAction proto.InternalMessageInfo func (m *GitRepoVolumeSource) Reset() { *m = GitRepoVolumeSource{} } func (*GitRepoVolumeSource) ProtoMessage() {} func (*GitRepoVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{64} + return fileDescriptor_6c07b07c062484ab, []int{65} } func (m *GitRepoVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1872,7 +1900,7 @@ var xxx_messageInfo_GitRepoVolumeSource proto.InternalMessageInfo func (m *GlusterfsPersistentVolumeSource) Reset() { *m = GlusterfsPersistentVolumeSource{} } func (*GlusterfsPersistentVolumeSource) ProtoMessage() {} func (*GlusterfsPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{65} + return fileDescriptor_6c07b07c062484ab, []int{66} } func (m *GlusterfsPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1900,7 +1928,7 @@ var xxx_messageInfo_GlusterfsPersistentVolumeSource proto.InternalMessageInfo func (m *GlusterfsVolumeSource) Reset() { *m = GlusterfsVolumeSource{} } func (*GlusterfsVolumeSource) ProtoMessage() {} func (*GlusterfsVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{66} + return fileDescriptor_6c07b07c062484ab, []int{67} } func (m *GlusterfsVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1928,7 +1956,7 @@ var xxx_messageInfo_GlusterfsVolumeSource proto.InternalMessageInfo func (m *HTTPGetAction) Reset() { *m = HTTPGetAction{} } func (*HTTPGetAction) ProtoMessage() {} func (*HTTPGetAction) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{67} + return fileDescriptor_6c07b07c062484ab, []int{68} } func (m *HTTPGetAction) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1956,7 +1984,7 @@ var xxx_messageInfo_HTTPGetAction proto.InternalMessageInfo func (m *HTTPHeader) Reset() { *m = HTTPHeader{} } func (*HTTPHeader) ProtoMessage() {} func (*HTTPHeader) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{68} + return fileDescriptor_6c07b07c062484ab, []int{69} } func (m *HTTPHeader) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -1984,7 +2012,7 @@ var xxx_messageInfo_HTTPHeader proto.InternalMessageInfo func (m *HostAlias) Reset() { *m = HostAlias{} } func (*HostAlias) ProtoMessage() {} func (*HostAlias) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{69} + return fileDescriptor_6c07b07c062484ab, []int{70} } func (m *HostAlias) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2012,7 +2040,7 @@ var xxx_messageInfo_HostAlias proto.InternalMessageInfo func (m *HostIP) Reset() { *m = HostIP{} } func (*HostIP) ProtoMessage() {} func (*HostIP) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{70} + return fileDescriptor_6c07b07c062484ab, []int{71} } func (m *HostIP) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2040,7 +2068,7 @@ var xxx_messageInfo_HostIP proto.InternalMessageInfo func (m *HostPathVolumeSource) Reset() { *m = HostPathVolumeSource{} } func (*HostPathVolumeSource) ProtoMessage() {} func (*HostPathVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{71} + return fileDescriptor_6c07b07c062484ab, []int{72} } func (m *HostPathVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2068,7 +2096,7 @@ var xxx_messageInfo_HostPathVolumeSource proto.InternalMessageInfo func (m *ISCSIPersistentVolumeSource) Reset() { *m = ISCSIPersistentVolumeSource{} } func (*ISCSIPersistentVolumeSource) ProtoMessage() {} func (*ISCSIPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{72} + return fileDescriptor_6c07b07c062484ab, []int{73} } func (m *ISCSIPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2096,7 +2124,7 @@ var xxx_messageInfo_ISCSIPersistentVolumeSource proto.InternalMessageInfo func (m *ISCSIVolumeSource) Reset() { *m = ISCSIVolumeSource{} } func (*ISCSIVolumeSource) ProtoMessage() {} func (*ISCSIVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{73} + return fileDescriptor_6c07b07c062484ab, []int{74} } func (m *ISCSIVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2124,7 +2152,7 @@ var xxx_messageInfo_ISCSIVolumeSource proto.InternalMessageInfo func (m *KeyToPath) Reset() { *m = KeyToPath{} } func (*KeyToPath) ProtoMessage() {} func (*KeyToPath) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{74} + return fileDescriptor_6c07b07c062484ab, []int{75} } func (m *KeyToPath) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2152,7 +2180,7 @@ var xxx_messageInfo_KeyToPath proto.InternalMessageInfo func (m *Lifecycle) Reset() { *m = Lifecycle{} } func (*Lifecycle) ProtoMessage() {} func (*Lifecycle) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{75} + return fileDescriptor_6c07b07c062484ab, []int{76} } func (m *Lifecycle) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2180,7 +2208,7 @@ var xxx_messageInfo_Lifecycle proto.InternalMessageInfo func (m *LifecycleHandler) Reset() { *m = LifecycleHandler{} } func (*LifecycleHandler) ProtoMessage() {} func (*LifecycleHandler) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{76} + return fileDescriptor_6c07b07c062484ab, []int{77} } func (m *LifecycleHandler) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2208,7 +2236,7 @@ var xxx_messageInfo_LifecycleHandler proto.InternalMessageInfo func (m *LimitRange) Reset() { *m = LimitRange{} } func (*LimitRange) ProtoMessage() {} func (*LimitRange) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{77} + return fileDescriptor_6c07b07c062484ab, []int{78} } func (m *LimitRange) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2236,7 +2264,7 @@ var xxx_messageInfo_LimitRange proto.InternalMessageInfo func (m *LimitRangeItem) Reset() { *m = LimitRangeItem{} } func (*LimitRangeItem) ProtoMessage() {} func (*LimitRangeItem) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{78} + return fileDescriptor_6c07b07c062484ab, []int{79} } func (m *LimitRangeItem) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2264,7 +2292,7 @@ var xxx_messageInfo_LimitRangeItem proto.InternalMessageInfo func (m *LimitRangeList) Reset() { *m = LimitRangeList{} } func (*LimitRangeList) ProtoMessage() {} func (*LimitRangeList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{79} + return fileDescriptor_6c07b07c062484ab, []int{80} } func (m *LimitRangeList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2292,7 +2320,7 @@ var xxx_messageInfo_LimitRangeList proto.InternalMessageInfo func (m *LimitRangeSpec) Reset() { *m = LimitRangeSpec{} } func (*LimitRangeSpec) ProtoMessage() {} func (*LimitRangeSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{80} + return fileDescriptor_6c07b07c062484ab, []int{81} } func (m *LimitRangeSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2320,7 +2348,7 @@ var xxx_messageInfo_LimitRangeSpec proto.InternalMessageInfo func (m *List) Reset() { *m = List{} } func (*List) ProtoMessage() {} func (*List) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{81} + return fileDescriptor_6c07b07c062484ab, []int{82} } func (m *List) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2348,7 +2376,7 @@ var xxx_messageInfo_List proto.InternalMessageInfo func (m *LoadBalancerIngress) Reset() { *m = LoadBalancerIngress{} } func (*LoadBalancerIngress) ProtoMessage() {} func (*LoadBalancerIngress) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{82} + return fileDescriptor_6c07b07c062484ab, []int{83} } func (m *LoadBalancerIngress) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2376,7 +2404,7 @@ var xxx_messageInfo_LoadBalancerIngress proto.InternalMessageInfo func (m *LoadBalancerStatus) Reset() { *m = LoadBalancerStatus{} } func (*LoadBalancerStatus) ProtoMessage() {} func (*LoadBalancerStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{83} + return fileDescriptor_6c07b07c062484ab, []int{84} } func (m *LoadBalancerStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2404,7 +2432,7 @@ var xxx_messageInfo_LoadBalancerStatus proto.InternalMessageInfo func (m *LocalObjectReference) Reset() { *m = LocalObjectReference{} } func (*LocalObjectReference) ProtoMessage() {} func (*LocalObjectReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{84} + return fileDescriptor_6c07b07c062484ab, []int{85} } func (m *LocalObjectReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2432,7 +2460,7 @@ var xxx_messageInfo_LocalObjectReference proto.InternalMessageInfo func (m *LocalVolumeSource) Reset() { *m = LocalVolumeSource{} } func (*LocalVolumeSource) ProtoMessage() {} func (*LocalVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{85} + return fileDescriptor_6c07b07c062484ab, []int{86} } func (m *LocalVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2460,7 +2488,7 @@ var xxx_messageInfo_LocalVolumeSource proto.InternalMessageInfo func (m *ModifyVolumeStatus) Reset() { *m = ModifyVolumeStatus{} } func (*ModifyVolumeStatus) ProtoMessage() {} func (*ModifyVolumeStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{86} + return fileDescriptor_6c07b07c062484ab, []int{87} } func (m *ModifyVolumeStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2488,7 +2516,7 @@ var xxx_messageInfo_ModifyVolumeStatus proto.InternalMessageInfo func (m *NFSVolumeSource) Reset() { *m = NFSVolumeSource{} } func (*NFSVolumeSource) ProtoMessage() {} func (*NFSVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{87} + return fileDescriptor_6c07b07c062484ab, []int{88} } func (m *NFSVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2516,7 +2544,7 @@ var xxx_messageInfo_NFSVolumeSource proto.InternalMessageInfo func (m *Namespace) Reset() { *m = Namespace{} } func (*Namespace) ProtoMessage() {} func (*Namespace) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{88} + return fileDescriptor_6c07b07c062484ab, []int{89} } func (m *Namespace) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2544,7 +2572,7 @@ var xxx_messageInfo_Namespace proto.InternalMessageInfo func (m *NamespaceCondition) Reset() { *m = NamespaceCondition{} } func (*NamespaceCondition) ProtoMessage() {} func (*NamespaceCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{89} + return fileDescriptor_6c07b07c062484ab, []int{90} } func (m *NamespaceCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2572,7 +2600,7 @@ var xxx_messageInfo_NamespaceCondition proto.InternalMessageInfo func (m *NamespaceList) Reset() { *m = NamespaceList{} } func (*NamespaceList) ProtoMessage() {} func (*NamespaceList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{90} + return fileDescriptor_6c07b07c062484ab, []int{91} } func (m *NamespaceList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2600,7 +2628,7 @@ var xxx_messageInfo_NamespaceList proto.InternalMessageInfo func (m *NamespaceSpec) Reset() { *m = NamespaceSpec{} } func (*NamespaceSpec) ProtoMessage() {} func (*NamespaceSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{91} + return fileDescriptor_6c07b07c062484ab, []int{92} } func (m *NamespaceSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2628,7 +2656,7 @@ var xxx_messageInfo_NamespaceSpec proto.InternalMessageInfo func (m *NamespaceStatus) Reset() { *m = NamespaceStatus{} } func (*NamespaceStatus) ProtoMessage() {} func (*NamespaceStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{92} + return fileDescriptor_6c07b07c062484ab, []int{93} } func (m *NamespaceStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2656,7 +2684,7 @@ var xxx_messageInfo_NamespaceStatus proto.InternalMessageInfo func (m *Node) Reset() { *m = Node{} } func (*Node) ProtoMessage() {} func (*Node) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{93} + return fileDescriptor_6c07b07c062484ab, []int{94} } func (m *Node) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2684,7 +2712,7 @@ var xxx_messageInfo_Node proto.InternalMessageInfo func (m *NodeAddress) Reset() { *m = NodeAddress{} } func (*NodeAddress) ProtoMessage() {} func (*NodeAddress) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{94} + return fileDescriptor_6c07b07c062484ab, []int{95} } func (m *NodeAddress) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2712,7 +2740,7 @@ var xxx_messageInfo_NodeAddress proto.InternalMessageInfo func (m *NodeAffinity) Reset() { *m = NodeAffinity{} } func (*NodeAffinity) ProtoMessage() {} func (*NodeAffinity) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{95} + return fileDescriptor_6c07b07c062484ab, []int{96} } func (m *NodeAffinity) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2740,7 +2768,7 @@ var xxx_messageInfo_NodeAffinity proto.InternalMessageInfo func (m *NodeCondition) Reset() { *m = NodeCondition{} } func (*NodeCondition) ProtoMessage() {} func (*NodeCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{96} + return fileDescriptor_6c07b07c062484ab, []int{97} } func (m *NodeCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2768,7 +2796,7 @@ var xxx_messageInfo_NodeCondition proto.InternalMessageInfo func (m *NodeConfigSource) Reset() { *m = NodeConfigSource{} } func (*NodeConfigSource) ProtoMessage() {} func (*NodeConfigSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{97} + return fileDescriptor_6c07b07c062484ab, []int{98} } func (m *NodeConfigSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2796,7 +2824,7 @@ var xxx_messageInfo_NodeConfigSource proto.InternalMessageInfo func (m *NodeConfigStatus) Reset() { *m = NodeConfigStatus{} } func (*NodeConfigStatus) ProtoMessage() {} func (*NodeConfigStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{98} + return fileDescriptor_6c07b07c062484ab, []int{99} } func (m *NodeConfigStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2824,7 +2852,7 @@ var xxx_messageInfo_NodeConfigStatus proto.InternalMessageInfo func (m *NodeDaemonEndpoints) Reset() { *m = NodeDaemonEndpoints{} } func (*NodeDaemonEndpoints) ProtoMessage() {} func (*NodeDaemonEndpoints) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{99} + return fileDescriptor_6c07b07c062484ab, []int{100} } func (m *NodeDaemonEndpoints) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2852,7 +2880,7 @@ var xxx_messageInfo_NodeDaemonEndpoints proto.InternalMessageInfo func (m *NodeList) Reset() { *m = NodeList{} } func (*NodeList) ProtoMessage() {} func (*NodeList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{100} + return fileDescriptor_6c07b07c062484ab, []int{101} } func (m *NodeList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2880,7 +2908,7 @@ var xxx_messageInfo_NodeList proto.InternalMessageInfo func (m *NodeProxyOptions) Reset() { *m = NodeProxyOptions{} } func (*NodeProxyOptions) ProtoMessage() {} func (*NodeProxyOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{101} + return fileDescriptor_6c07b07c062484ab, []int{102} } func (m *NodeProxyOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2908,7 +2936,7 @@ var xxx_messageInfo_NodeProxyOptions proto.InternalMessageInfo func (m *NodeSelector) Reset() { *m = NodeSelector{} } func (*NodeSelector) ProtoMessage() {} func (*NodeSelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{102} + return fileDescriptor_6c07b07c062484ab, []int{103} } func (m *NodeSelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2936,7 +2964,7 @@ var xxx_messageInfo_NodeSelector proto.InternalMessageInfo func (m *NodeSelectorRequirement) Reset() { *m = NodeSelectorRequirement{} } func (*NodeSelectorRequirement) ProtoMessage() {} func (*NodeSelectorRequirement) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{103} + return fileDescriptor_6c07b07c062484ab, []int{104} } func (m *NodeSelectorRequirement) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2964,7 +2992,7 @@ var xxx_messageInfo_NodeSelectorRequirement proto.InternalMessageInfo func (m *NodeSelectorTerm) Reset() { *m = NodeSelectorTerm{} } func (*NodeSelectorTerm) ProtoMessage() {} func (*NodeSelectorTerm) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{104} + return fileDescriptor_6c07b07c062484ab, []int{105} } func (m *NodeSelectorTerm) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -2992,7 +3020,7 @@ var xxx_messageInfo_NodeSelectorTerm proto.InternalMessageInfo func (m *NodeSpec) Reset() { *m = NodeSpec{} } func (*NodeSpec) ProtoMessage() {} func (*NodeSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{105} + return fileDescriptor_6c07b07c062484ab, []int{106} } func (m *NodeSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3020,7 +3048,7 @@ var xxx_messageInfo_NodeSpec proto.InternalMessageInfo func (m *NodeStatus) Reset() { *m = NodeStatus{} } func (*NodeStatus) ProtoMessage() {} func (*NodeStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{106} + return fileDescriptor_6c07b07c062484ab, []int{107} } func (m *NodeStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3048,7 +3076,7 @@ var xxx_messageInfo_NodeStatus proto.InternalMessageInfo func (m *NodeSystemInfo) Reset() { *m = NodeSystemInfo{} } func (*NodeSystemInfo) ProtoMessage() {} func (*NodeSystemInfo) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{107} + return fileDescriptor_6c07b07c062484ab, []int{108} } func (m *NodeSystemInfo) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3076,7 +3104,7 @@ var xxx_messageInfo_NodeSystemInfo proto.InternalMessageInfo func (m *ObjectFieldSelector) Reset() { *m = ObjectFieldSelector{} } func (*ObjectFieldSelector) ProtoMessage() {} func (*ObjectFieldSelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{108} + return fileDescriptor_6c07b07c062484ab, []int{109} } func (m *ObjectFieldSelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3104,7 +3132,7 @@ var xxx_messageInfo_ObjectFieldSelector proto.InternalMessageInfo func (m *ObjectReference) Reset() { *m = ObjectReference{} } func (*ObjectReference) ProtoMessage() {} func (*ObjectReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{109} + return fileDescriptor_6c07b07c062484ab, []int{110} } func (m *ObjectReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3132,7 +3160,7 @@ var xxx_messageInfo_ObjectReference proto.InternalMessageInfo func (m *PersistentVolume) Reset() { *m = PersistentVolume{} } func (*PersistentVolume) ProtoMessage() {} func (*PersistentVolume) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{110} + return fileDescriptor_6c07b07c062484ab, []int{111} } func (m *PersistentVolume) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3160,7 +3188,7 @@ var xxx_messageInfo_PersistentVolume proto.InternalMessageInfo func (m *PersistentVolumeClaim) Reset() { *m = PersistentVolumeClaim{} } func (*PersistentVolumeClaim) ProtoMessage() {} func (*PersistentVolumeClaim) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{111} + return fileDescriptor_6c07b07c062484ab, []int{112} } func (m *PersistentVolumeClaim) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3188,7 +3216,7 @@ var xxx_messageInfo_PersistentVolumeClaim proto.InternalMessageInfo func (m *PersistentVolumeClaimCondition) Reset() { *m = PersistentVolumeClaimCondition{} } func (*PersistentVolumeClaimCondition) ProtoMessage() {} func (*PersistentVolumeClaimCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{112} + return fileDescriptor_6c07b07c062484ab, []int{113} } func (m *PersistentVolumeClaimCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3216,7 +3244,7 @@ var xxx_messageInfo_PersistentVolumeClaimCondition proto.InternalMessageInfo func (m *PersistentVolumeClaimList) Reset() { *m = PersistentVolumeClaimList{} } func (*PersistentVolumeClaimList) ProtoMessage() {} func (*PersistentVolumeClaimList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{113} + return fileDescriptor_6c07b07c062484ab, []int{114} } func (m *PersistentVolumeClaimList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3244,7 +3272,7 @@ var xxx_messageInfo_PersistentVolumeClaimList proto.InternalMessageInfo func (m *PersistentVolumeClaimSpec) Reset() { *m = PersistentVolumeClaimSpec{} } func (*PersistentVolumeClaimSpec) ProtoMessage() {} func (*PersistentVolumeClaimSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{114} + return fileDescriptor_6c07b07c062484ab, []int{115} } func (m *PersistentVolumeClaimSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3272,7 +3300,7 @@ var xxx_messageInfo_PersistentVolumeClaimSpec proto.InternalMessageInfo func (m *PersistentVolumeClaimStatus) Reset() { *m = PersistentVolumeClaimStatus{} } func (*PersistentVolumeClaimStatus) ProtoMessage() {} func (*PersistentVolumeClaimStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{115} + return fileDescriptor_6c07b07c062484ab, []int{116} } func (m *PersistentVolumeClaimStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3300,7 +3328,7 @@ var xxx_messageInfo_PersistentVolumeClaimStatus proto.InternalMessageInfo func (m *PersistentVolumeClaimTemplate) Reset() { *m = PersistentVolumeClaimTemplate{} } func (*PersistentVolumeClaimTemplate) ProtoMessage() {} func (*PersistentVolumeClaimTemplate) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{116} + return fileDescriptor_6c07b07c062484ab, []int{117} } func (m *PersistentVolumeClaimTemplate) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3328,7 +3356,7 @@ var xxx_messageInfo_PersistentVolumeClaimTemplate proto.InternalMessageInfo func (m *PersistentVolumeClaimVolumeSource) Reset() { *m = PersistentVolumeClaimVolumeSource{} } func (*PersistentVolumeClaimVolumeSource) ProtoMessage() {} func (*PersistentVolumeClaimVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{117} + return fileDescriptor_6c07b07c062484ab, []int{118} } func (m *PersistentVolumeClaimVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3356,7 +3384,7 @@ var xxx_messageInfo_PersistentVolumeClaimVolumeSource proto.InternalMessageInfo func (m *PersistentVolumeList) Reset() { *m = PersistentVolumeList{} } func (*PersistentVolumeList) ProtoMessage() {} func (*PersistentVolumeList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{118} + return fileDescriptor_6c07b07c062484ab, []int{119} } func (m *PersistentVolumeList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3384,7 +3412,7 @@ var xxx_messageInfo_PersistentVolumeList proto.InternalMessageInfo func (m *PersistentVolumeSource) Reset() { *m = PersistentVolumeSource{} } func (*PersistentVolumeSource) ProtoMessage() {} func (*PersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{119} + return fileDescriptor_6c07b07c062484ab, []int{120} } func (m *PersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3412,7 +3440,7 @@ var xxx_messageInfo_PersistentVolumeSource proto.InternalMessageInfo func (m *PersistentVolumeSpec) Reset() { *m = PersistentVolumeSpec{} } func (*PersistentVolumeSpec) ProtoMessage() {} func (*PersistentVolumeSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{120} + return fileDescriptor_6c07b07c062484ab, []int{121} } func (m *PersistentVolumeSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3440,7 +3468,7 @@ var xxx_messageInfo_PersistentVolumeSpec proto.InternalMessageInfo func (m *PersistentVolumeStatus) Reset() { *m = PersistentVolumeStatus{} } func (*PersistentVolumeStatus) ProtoMessage() {} func (*PersistentVolumeStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{121} + return fileDescriptor_6c07b07c062484ab, []int{122} } func (m *PersistentVolumeStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3468,7 +3496,7 @@ var xxx_messageInfo_PersistentVolumeStatus proto.InternalMessageInfo func (m *PhotonPersistentDiskVolumeSource) Reset() { *m = PhotonPersistentDiskVolumeSource{} } func (*PhotonPersistentDiskVolumeSource) ProtoMessage() {} func (*PhotonPersistentDiskVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{122} + return fileDescriptor_6c07b07c062484ab, []int{123} } func (m *PhotonPersistentDiskVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3496,7 +3524,7 @@ var xxx_messageInfo_PhotonPersistentDiskVolumeSource proto.InternalMessageInfo func (m *Pod) Reset() { *m = Pod{} } func (*Pod) ProtoMessage() {} func (*Pod) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{123} + return fileDescriptor_6c07b07c062484ab, []int{124} } func (m *Pod) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3524,7 +3552,7 @@ var xxx_messageInfo_Pod proto.InternalMessageInfo func (m *PodAffinity) Reset() { *m = PodAffinity{} } func (*PodAffinity) ProtoMessage() {} func (*PodAffinity) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{124} + return fileDescriptor_6c07b07c062484ab, []int{125} } func (m *PodAffinity) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3552,7 +3580,7 @@ var xxx_messageInfo_PodAffinity proto.InternalMessageInfo func (m *PodAffinityTerm) Reset() { *m = PodAffinityTerm{} } func (*PodAffinityTerm) ProtoMessage() {} func (*PodAffinityTerm) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{125} + return fileDescriptor_6c07b07c062484ab, []int{126} } func (m *PodAffinityTerm) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3580,7 +3608,7 @@ var xxx_messageInfo_PodAffinityTerm proto.InternalMessageInfo func (m *PodAntiAffinity) Reset() { *m = PodAntiAffinity{} } func (*PodAntiAffinity) ProtoMessage() {} func (*PodAntiAffinity) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{126} + return fileDescriptor_6c07b07c062484ab, []int{127} } func (m *PodAntiAffinity) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3608,7 +3636,7 @@ var xxx_messageInfo_PodAntiAffinity proto.InternalMessageInfo func (m *PodAttachOptions) Reset() { *m = PodAttachOptions{} } func (*PodAttachOptions) ProtoMessage() {} func (*PodAttachOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{127} + return fileDescriptor_6c07b07c062484ab, []int{128} } func (m *PodAttachOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3636,7 +3664,7 @@ var xxx_messageInfo_PodAttachOptions proto.InternalMessageInfo func (m *PodCondition) Reset() { *m = PodCondition{} } func (*PodCondition) ProtoMessage() {} func (*PodCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{128} + return fileDescriptor_6c07b07c062484ab, []int{129} } func (m *PodCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3664,7 +3692,7 @@ var xxx_messageInfo_PodCondition proto.InternalMessageInfo func (m *PodDNSConfig) Reset() { *m = PodDNSConfig{} } func (*PodDNSConfig) ProtoMessage() {} func (*PodDNSConfig) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{129} + return fileDescriptor_6c07b07c062484ab, []int{130} } func (m *PodDNSConfig) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3692,7 +3720,7 @@ var xxx_messageInfo_PodDNSConfig proto.InternalMessageInfo func (m *PodDNSConfigOption) Reset() { *m = PodDNSConfigOption{} } func (*PodDNSConfigOption) ProtoMessage() {} func (*PodDNSConfigOption) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{130} + return fileDescriptor_6c07b07c062484ab, []int{131} } func (m *PodDNSConfigOption) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3720,7 +3748,7 @@ var xxx_messageInfo_PodDNSConfigOption proto.InternalMessageInfo func (m *PodExecOptions) Reset() { *m = PodExecOptions{} } func (*PodExecOptions) ProtoMessage() {} func (*PodExecOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{131} + return fileDescriptor_6c07b07c062484ab, []int{132} } func (m *PodExecOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3748,7 +3776,7 @@ var xxx_messageInfo_PodExecOptions proto.InternalMessageInfo func (m *PodIP) Reset() { *m = PodIP{} } func (*PodIP) ProtoMessage() {} func (*PodIP) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{132} + return fileDescriptor_6c07b07c062484ab, []int{133} } func (m *PodIP) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3776,7 +3804,7 @@ var xxx_messageInfo_PodIP proto.InternalMessageInfo func (m *PodList) Reset() { *m = PodList{} } func (*PodList) ProtoMessage() {} func (*PodList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{133} + return fileDescriptor_6c07b07c062484ab, []int{134} } func (m *PodList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3804,7 +3832,7 @@ var xxx_messageInfo_PodList proto.InternalMessageInfo func (m *PodLogOptions) Reset() { *m = PodLogOptions{} } func (*PodLogOptions) ProtoMessage() {} func (*PodLogOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{134} + return fileDescriptor_6c07b07c062484ab, []int{135} } func (m *PodLogOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3832,7 +3860,7 @@ var xxx_messageInfo_PodLogOptions proto.InternalMessageInfo func (m *PodOS) Reset() { *m = PodOS{} } func (*PodOS) ProtoMessage() {} func (*PodOS) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{135} + return fileDescriptor_6c07b07c062484ab, []int{136} } func (m *PodOS) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3860,7 +3888,7 @@ var xxx_messageInfo_PodOS proto.InternalMessageInfo func (m *PodPortForwardOptions) Reset() { *m = PodPortForwardOptions{} } func (*PodPortForwardOptions) ProtoMessage() {} func (*PodPortForwardOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{136} + return fileDescriptor_6c07b07c062484ab, []int{137} } func (m *PodPortForwardOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3888,7 +3916,7 @@ var xxx_messageInfo_PodPortForwardOptions proto.InternalMessageInfo func (m *PodProxyOptions) Reset() { *m = PodProxyOptions{} } func (*PodProxyOptions) ProtoMessage() {} func (*PodProxyOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{137} + return fileDescriptor_6c07b07c062484ab, []int{138} } func (m *PodProxyOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3916,7 +3944,7 @@ var xxx_messageInfo_PodProxyOptions proto.InternalMessageInfo func (m *PodReadinessGate) Reset() { *m = PodReadinessGate{} } func (*PodReadinessGate) ProtoMessage() {} func (*PodReadinessGate) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{138} + return fileDescriptor_6c07b07c062484ab, []int{139} } func (m *PodReadinessGate) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3944,7 +3972,7 @@ var xxx_messageInfo_PodReadinessGate proto.InternalMessageInfo func (m *PodResourceClaim) Reset() { *m = PodResourceClaim{} } func (*PodResourceClaim) ProtoMessage() {} func (*PodResourceClaim) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{139} + return fileDescriptor_6c07b07c062484ab, []int{140} } func (m *PodResourceClaim) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -3972,7 +4000,7 @@ var xxx_messageInfo_PodResourceClaim proto.InternalMessageInfo func (m *PodResourceClaimStatus) Reset() { *m = PodResourceClaimStatus{} } func (*PodResourceClaimStatus) ProtoMessage() {} func (*PodResourceClaimStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{140} + return fileDescriptor_6c07b07c062484ab, []int{141} } func (m *PodResourceClaimStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4000,7 +4028,7 @@ var xxx_messageInfo_PodResourceClaimStatus proto.InternalMessageInfo func (m *PodSchedulingGate) Reset() { *m = PodSchedulingGate{} } func (*PodSchedulingGate) ProtoMessage() {} func (*PodSchedulingGate) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{141} + return fileDescriptor_6c07b07c062484ab, []int{142} } func (m *PodSchedulingGate) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4028,7 +4056,7 @@ var xxx_messageInfo_PodSchedulingGate proto.InternalMessageInfo func (m *PodSecurityContext) Reset() { *m = PodSecurityContext{} } func (*PodSecurityContext) ProtoMessage() {} func (*PodSecurityContext) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{142} + return fileDescriptor_6c07b07c062484ab, []int{143} } func (m *PodSecurityContext) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4056,7 +4084,7 @@ var xxx_messageInfo_PodSecurityContext proto.InternalMessageInfo func (m *PodSignature) Reset() { *m = PodSignature{} } func (*PodSignature) ProtoMessage() {} func (*PodSignature) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{143} + return fileDescriptor_6c07b07c062484ab, []int{144} } func (m *PodSignature) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4084,7 +4112,7 @@ var xxx_messageInfo_PodSignature proto.InternalMessageInfo func (m *PodSpec) Reset() { *m = PodSpec{} } func (*PodSpec) ProtoMessage() {} func (*PodSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{144} + return fileDescriptor_6c07b07c062484ab, []int{145} } func (m *PodSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4112,7 +4140,7 @@ var xxx_messageInfo_PodSpec proto.InternalMessageInfo func (m *PodStatus) Reset() { *m = PodStatus{} } func (*PodStatus) ProtoMessage() {} func (*PodStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{145} + return fileDescriptor_6c07b07c062484ab, []int{146} } func (m *PodStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4140,7 +4168,7 @@ var xxx_messageInfo_PodStatus proto.InternalMessageInfo func (m *PodStatusResult) Reset() { *m = PodStatusResult{} } func (*PodStatusResult) ProtoMessage() {} func (*PodStatusResult) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{146} + return fileDescriptor_6c07b07c062484ab, []int{147} } func (m *PodStatusResult) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4168,7 +4196,7 @@ var xxx_messageInfo_PodStatusResult proto.InternalMessageInfo func (m *PodTemplate) Reset() { *m = PodTemplate{} } func (*PodTemplate) ProtoMessage() {} func (*PodTemplate) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{147} + return fileDescriptor_6c07b07c062484ab, []int{148} } func (m *PodTemplate) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4196,7 +4224,7 @@ var xxx_messageInfo_PodTemplate proto.InternalMessageInfo func (m *PodTemplateList) Reset() { *m = PodTemplateList{} } func (*PodTemplateList) ProtoMessage() {} func (*PodTemplateList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{148} + return fileDescriptor_6c07b07c062484ab, []int{149} } func (m *PodTemplateList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4224,7 +4252,7 @@ var xxx_messageInfo_PodTemplateList proto.InternalMessageInfo func (m *PodTemplateSpec) Reset() { *m = PodTemplateSpec{} } func (*PodTemplateSpec) ProtoMessage() {} func (*PodTemplateSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{149} + return fileDescriptor_6c07b07c062484ab, []int{150} } func (m *PodTemplateSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4252,7 +4280,7 @@ var xxx_messageInfo_PodTemplateSpec proto.InternalMessageInfo func (m *PortStatus) Reset() { *m = PortStatus{} } func (*PortStatus) ProtoMessage() {} func (*PortStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{150} + return fileDescriptor_6c07b07c062484ab, []int{151} } func (m *PortStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4280,7 +4308,7 @@ var xxx_messageInfo_PortStatus proto.InternalMessageInfo func (m *PortworxVolumeSource) Reset() { *m = PortworxVolumeSource{} } func (*PortworxVolumeSource) ProtoMessage() {} func (*PortworxVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{151} + return fileDescriptor_6c07b07c062484ab, []int{152} } func (m *PortworxVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4308,7 +4336,7 @@ var xxx_messageInfo_PortworxVolumeSource proto.InternalMessageInfo func (m *Preconditions) Reset() { *m = Preconditions{} } func (*Preconditions) ProtoMessage() {} func (*Preconditions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{152} + return fileDescriptor_6c07b07c062484ab, []int{153} } func (m *Preconditions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4336,7 +4364,7 @@ var xxx_messageInfo_Preconditions proto.InternalMessageInfo func (m *PreferAvoidPodsEntry) Reset() { *m = PreferAvoidPodsEntry{} } func (*PreferAvoidPodsEntry) ProtoMessage() {} func (*PreferAvoidPodsEntry) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{153} + return fileDescriptor_6c07b07c062484ab, []int{154} } func (m *PreferAvoidPodsEntry) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4364,7 +4392,7 @@ var xxx_messageInfo_PreferAvoidPodsEntry proto.InternalMessageInfo func (m *PreferredSchedulingTerm) Reset() { *m = PreferredSchedulingTerm{} } func (*PreferredSchedulingTerm) ProtoMessage() {} func (*PreferredSchedulingTerm) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{154} + return fileDescriptor_6c07b07c062484ab, []int{155} } func (m *PreferredSchedulingTerm) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4392,7 +4420,7 @@ var xxx_messageInfo_PreferredSchedulingTerm proto.InternalMessageInfo func (m *Probe) Reset() { *m = Probe{} } func (*Probe) ProtoMessage() {} func (*Probe) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{155} + return fileDescriptor_6c07b07c062484ab, []int{156} } func (m *Probe) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4420,7 +4448,7 @@ var xxx_messageInfo_Probe proto.InternalMessageInfo func (m *ProbeHandler) Reset() { *m = ProbeHandler{} } func (*ProbeHandler) ProtoMessage() {} func (*ProbeHandler) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{156} + return fileDescriptor_6c07b07c062484ab, []int{157} } func (m *ProbeHandler) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4448,7 +4476,7 @@ var xxx_messageInfo_ProbeHandler proto.InternalMessageInfo func (m *ProjectedVolumeSource) Reset() { *m = ProjectedVolumeSource{} } func (*ProjectedVolumeSource) ProtoMessage() {} func (*ProjectedVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{157} + return fileDescriptor_6c07b07c062484ab, []int{158} } func (m *ProjectedVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4476,7 +4504,7 @@ var xxx_messageInfo_ProjectedVolumeSource proto.InternalMessageInfo func (m *QuobyteVolumeSource) Reset() { *m = QuobyteVolumeSource{} } func (*QuobyteVolumeSource) ProtoMessage() {} func (*QuobyteVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{158} + return fileDescriptor_6c07b07c062484ab, []int{159} } func (m *QuobyteVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4504,7 +4532,7 @@ var xxx_messageInfo_QuobyteVolumeSource proto.InternalMessageInfo func (m *RBDPersistentVolumeSource) Reset() { *m = RBDPersistentVolumeSource{} } func (*RBDPersistentVolumeSource) ProtoMessage() {} func (*RBDPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{159} + return fileDescriptor_6c07b07c062484ab, []int{160} } func (m *RBDPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4532,7 +4560,7 @@ var xxx_messageInfo_RBDPersistentVolumeSource proto.InternalMessageInfo func (m *RBDVolumeSource) Reset() { *m = RBDVolumeSource{} } func (*RBDVolumeSource) ProtoMessage() {} func (*RBDVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{160} + return fileDescriptor_6c07b07c062484ab, []int{161} } func (m *RBDVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4560,7 +4588,7 @@ var xxx_messageInfo_RBDVolumeSource proto.InternalMessageInfo func (m *RangeAllocation) Reset() { *m = RangeAllocation{} } func (*RangeAllocation) ProtoMessage() {} func (*RangeAllocation) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{161} + return fileDescriptor_6c07b07c062484ab, []int{162} } func (m *RangeAllocation) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4588,7 +4616,7 @@ var xxx_messageInfo_RangeAllocation proto.InternalMessageInfo func (m *ReplicationController) Reset() { *m = ReplicationController{} } func (*ReplicationController) ProtoMessage() {} func (*ReplicationController) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{162} + return fileDescriptor_6c07b07c062484ab, []int{163} } func (m *ReplicationController) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4616,7 +4644,7 @@ var xxx_messageInfo_ReplicationController proto.InternalMessageInfo func (m *ReplicationControllerCondition) Reset() { *m = ReplicationControllerCondition{} } func (*ReplicationControllerCondition) ProtoMessage() {} func (*ReplicationControllerCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{163} + return fileDescriptor_6c07b07c062484ab, []int{164} } func (m *ReplicationControllerCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4644,7 +4672,7 @@ var xxx_messageInfo_ReplicationControllerCondition proto.InternalMessageInfo func (m *ReplicationControllerList) Reset() { *m = ReplicationControllerList{} } func (*ReplicationControllerList) ProtoMessage() {} func (*ReplicationControllerList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{164} + return fileDescriptor_6c07b07c062484ab, []int{165} } func (m *ReplicationControllerList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4672,7 +4700,7 @@ var xxx_messageInfo_ReplicationControllerList proto.InternalMessageInfo func (m *ReplicationControllerSpec) Reset() { *m = ReplicationControllerSpec{} } func (*ReplicationControllerSpec) ProtoMessage() {} func (*ReplicationControllerSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{165} + return fileDescriptor_6c07b07c062484ab, []int{166} } func (m *ReplicationControllerSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4700,7 +4728,7 @@ var xxx_messageInfo_ReplicationControllerSpec proto.InternalMessageInfo func (m *ReplicationControllerStatus) Reset() { *m = ReplicationControllerStatus{} } func (*ReplicationControllerStatus) ProtoMessage() {} func (*ReplicationControllerStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{166} + return fileDescriptor_6c07b07c062484ab, []int{167} } func (m *ReplicationControllerStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4728,7 +4756,7 @@ var xxx_messageInfo_ReplicationControllerStatus proto.InternalMessageInfo func (m *ResourceClaim) Reset() { *m = ResourceClaim{} } func (*ResourceClaim) ProtoMessage() {} func (*ResourceClaim) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{167} + return fileDescriptor_6c07b07c062484ab, []int{168} } func (m *ResourceClaim) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4756,7 +4784,7 @@ var xxx_messageInfo_ResourceClaim proto.InternalMessageInfo func (m *ResourceFieldSelector) Reset() { *m = ResourceFieldSelector{} } func (*ResourceFieldSelector) ProtoMessage() {} func (*ResourceFieldSelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{168} + return fileDescriptor_6c07b07c062484ab, []int{169} } func (m *ResourceFieldSelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4784,7 +4812,7 @@ var xxx_messageInfo_ResourceFieldSelector proto.InternalMessageInfo func (m *ResourceQuota) Reset() { *m = ResourceQuota{} } func (*ResourceQuota) ProtoMessage() {} func (*ResourceQuota) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{169} + return fileDescriptor_6c07b07c062484ab, []int{170} } func (m *ResourceQuota) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4812,7 +4840,7 @@ var xxx_messageInfo_ResourceQuota proto.InternalMessageInfo func (m *ResourceQuotaList) Reset() { *m = ResourceQuotaList{} } func (*ResourceQuotaList) ProtoMessage() {} func (*ResourceQuotaList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{170} + return fileDescriptor_6c07b07c062484ab, []int{171} } func (m *ResourceQuotaList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4840,7 +4868,7 @@ var xxx_messageInfo_ResourceQuotaList proto.InternalMessageInfo func (m *ResourceQuotaSpec) Reset() { *m = ResourceQuotaSpec{} } func (*ResourceQuotaSpec) ProtoMessage() {} func (*ResourceQuotaSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{171} + return fileDescriptor_6c07b07c062484ab, []int{172} } func (m *ResourceQuotaSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4868,7 +4896,7 @@ var xxx_messageInfo_ResourceQuotaSpec proto.InternalMessageInfo func (m *ResourceQuotaStatus) Reset() { *m = ResourceQuotaStatus{} } func (*ResourceQuotaStatus) ProtoMessage() {} func (*ResourceQuotaStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{172} + return fileDescriptor_6c07b07c062484ab, []int{173} } func (m *ResourceQuotaStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4896,7 +4924,7 @@ var xxx_messageInfo_ResourceQuotaStatus proto.InternalMessageInfo func (m *ResourceRequirements) Reset() { *m = ResourceRequirements{} } func (*ResourceRequirements) ProtoMessage() {} func (*ResourceRequirements) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{173} + return fileDescriptor_6c07b07c062484ab, []int{174} } func (m *ResourceRequirements) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4924,7 +4952,7 @@ var xxx_messageInfo_ResourceRequirements proto.InternalMessageInfo func (m *SELinuxOptions) Reset() { *m = SELinuxOptions{} } func (*SELinuxOptions) ProtoMessage() {} func (*SELinuxOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{174} + return fileDescriptor_6c07b07c062484ab, []int{175} } func (m *SELinuxOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4952,7 +4980,7 @@ var xxx_messageInfo_SELinuxOptions proto.InternalMessageInfo func (m *ScaleIOPersistentVolumeSource) Reset() { *m = ScaleIOPersistentVolumeSource{} } func (*ScaleIOPersistentVolumeSource) ProtoMessage() {} func (*ScaleIOPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{175} + return fileDescriptor_6c07b07c062484ab, []int{176} } func (m *ScaleIOPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -4980,7 +5008,7 @@ var xxx_messageInfo_ScaleIOPersistentVolumeSource proto.InternalMessageInfo func (m *ScaleIOVolumeSource) Reset() { *m = ScaleIOVolumeSource{} } func (*ScaleIOVolumeSource) ProtoMessage() {} func (*ScaleIOVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{176} + return fileDescriptor_6c07b07c062484ab, []int{177} } func (m *ScaleIOVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5008,7 +5036,7 @@ var xxx_messageInfo_ScaleIOVolumeSource proto.InternalMessageInfo func (m *ScopeSelector) Reset() { *m = ScopeSelector{} } func (*ScopeSelector) ProtoMessage() {} func (*ScopeSelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{177} + return fileDescriptor_6c07b07c062484ab, []int{178} } func (m *ScopeSelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5036,7 +5064,7 @@ var xxx_messageInfo_ScopeSelector proto.InternalMessageInfo func (m *ScopedResourceSelectorRequirement) Reset() { *m = ScopedResourceSelectorRequirement{} } func (*ScopedResourceSelectorRequirement) ProtoMessage() {} func (*ScopedResourceSelectorRequirement) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{178} + return fileDescriptor_6c07b07c062484ab, []int{179} } func (m *ScopedResourceSelectorRequirement) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5064,7 +5092,7 @@ var xxx_messageInfo_ScopedResourceSelectorRequirement proto.InternalMessageInfo func (m *SeccompProfile) Reset() { *m = SeccompProfile{} } func (*SeccompProfile) ProtoMessage() {} func (*SeccompProfile) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{179} + return fileDescriptor_6c07b07c062484ab, []int{180} } func (m *SeccompProfile) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5092,7 +5120,7 @@ var xxx_messageInfo_SeccompProfile proto.InternalMessageInfo func (m *Secret) Reset() { *m = Secret{} } func (*Secret) ProtoMessage() {} func (*Secret) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{180} + return fileDescriptor_6c07b07c062484ab, []int{181} } func (m *Secret) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5120,7 +5148,7 @@ var xxx_messageInfo_Secret proto.InternalMessageInfo func (m *SecretEnvSource) Reset() { *m = SecretEnvSource{} } func (*SecretEnvSource) ProtoMessage() {} func (*SecretEnvSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{181} + return fileDescriptor_6c07b07c062484ab, []int{182} } func (m *SecretEnvSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5148,7 +5176,7 @@ var xxx_messageInfo_SecretEnvSource proto.InternalMessageInfo func (m *SecretKeySelector) Reset() { *m = SecretKeySelector{} } func (*SecretKeySelector) ProtoMessage() {} func (*SecretKeySelector) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{182} + return fileDescriptor_6c07b07c062484ab, []int{183} } func (m *SecretKeySelector) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5176,7 +5204,7 @@ var xxx_messageInfo_SecretKeySelector proto.InternalMessageInfo func (m *SecretList) Reset() { *m = SecretList{} } func (*SecretList) ProtoMessage() {} func (*SecretList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{183} + return fileDescriptor_6c07b07c062484ab, []int{184} } func (m *SecretList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5204,7 +5232,7 @@ var xxx_messageInfo_SecretList proto.InternalMessageInfo func (m *SecretProjection) Reset() { *m = SecretProjection{} } func (*SecretProjection) ProtoMessage() {} func (*SecretProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{184} + return fileDescriptor_6c07b07c062484ab, []int{185} } func (m *SecretProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5232,7 +5260,7 @@ var xxx_messageInfo_SecretProjection proto.InternalMessageInfo func (m *SecretReference) Reset() { *m = SecretReference{} } func (*SecretReference) ProtoMessage() {} func (*SecretReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{185} + return fileDescriptor_6c07b07c062484ab, []int{186} } func (m *SecretReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5260,7 +5288,7 @@ var xxx_messageInfo_SecretReference proto.InternalMessageInfo func (m *SecretVolumeSource) Reset() { *m = SecretVolumeSource{} } func (*SecretVolumeSource) ProtoMessage() {} func (*SecretVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{186} + return fileDescriptor_6c07b07c062484ab, []int{187} } func (m *SecretVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5288,7 +5316,7 @@ var xxx_messageInfo_SecretVolumeSource proto.InternalMessageInfo func (m *SecurityContext) Reset() { *m = SecurityContext{} } func (*SecurityContext) ProtoMessage() {} func (*SecurityContext) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{187} + return fileDescriptor_6c07b07c062484ab, []int{188} } func (m *SecurityContext) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5316,7 +5344,7 @@ var xxx_messageInfo_SecurityContext proto.InternalMessageInfo func (m *SerializedReference) Reset() { *m = SerializedReference{} } func (*SerializedReference) ProtoMessage() {} func (*SerializedReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{188} + return fileDescriptor_6c07b07c062484ab, []int{189} } func (m *SerializedReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5344,7 +5372,7 @@ var xxx_messageInfo_SerializedReference proto.InternalMessageInfo func (m *Service) Reset() { *m = Service{} } func (*Service) ProtoMessage() {} func (*Service) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{189} + return fileDescriptor_6c07b07c062484ab, []int{190} } func (m *Service) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5372,7 +5400,7 @@ var xxx_messageInfo_Service proto.InternalMessageInfo func (m *ServiceAccount) Reset() { *m = ServiceAccount{} } func (*ServiceAccount) ProtoMessage() {} func (*ServiceAccount) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{190} + return fileDescriptor_6c07b07c062484ab, []int{191} } func (m *ServiceAccount) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5400,7 +5428,7 @@ var xxx_messageInfo_ServiceAccount proto.InternalMessageInfo func (m *ServiceAccountList) Reset() { *m = ServiceAccountList{} } func (*ServiceAccountList) ProtoMessage() {} func (*ServiceAccountList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{191} + return fileDescriptor_6c07b07c062484ab, []int{192} } func (m *ServiceAccountList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5428,7 +5456,7 @@ var xxx_messageInfo_ServiceAccountList proto.InternalMessageInfo func (m *ServiceAccountTokenProjection) Reset() { *m = ServiceAccountTokenProjection{} } func (*ServiceAccountTokenProjection) ProtoMessage() {} func (*ServiceAccountTokenProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{192} + return fileDescriptor_6c07b07c062484ab, []int{193} } func (m *ServiceAccountTokenProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5456,7 +5484,7 @@ var xxx_messageInfo_ServiceAccountTokenProjection proto.InternalMessageInfo func (m *ServiceList) Reset() { *m = ServiceList{} } func (*ServiceList) ProtoMessage() {} func (*ServiceList) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{193} + return fileDescriptor_6c07b07c062484ab, []int{194} } func (m *ServiceList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5484,7 +5512,7 @@ var xxx_messageInfo_ServiceList proto.InternalMessageInfo func (m *ServicePort) Reset() { *m = ServicePort{} } func (*ServicePort) ProtoMessage() {} func (*ServicePort) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{194} + return fileDescriptor_6c07b07c062484ab, []int{195} } func (m *ServicePort) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5512,7 +5540,7 @@ var xxx_messageInfo_ServicePort proto.InternalMessageInfo func (m *ServiceProxyOptions) Reset() { *m = ServiceProxyOptions{} } func (*ServiceProxyOptions) ProtoMessage() {} func (*ServiceProxyOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{195} + return fileDescriptor_6c07b07c062484ab, []int{196} } func (m *ServiceProxyOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5540,7 +5568,7 @@ var xxx_messageInfo_ServiceProxyOptions proto.InternalMessageInfo func (m *ServiceSpec) Reset() { *m = ServiceSpec{} } func (*ServiceSpec) ProtoMessage() {} func (*ServiceSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{196} + return fileDescriptor_6c07b07c062484ab, []int{197} } func (m *ServiceSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5568,7 +5596,7 @@ var xxx_messageInfo_ServiceSpec proto.InternalMessageInfo func (m *ServiceStatus) Reset() { *m = ServiceStatus{} } func (*ServiceStatus) ProtoMessage() {} func (*ServiceStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{197} + return fileDescriptor_6c07b07c062484ab, []int{198} } func (m *ServiceStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5596,7 +5624,7 @@ var xxx_messageInfo_ServiceStatus proto.InternalMessageInfo func (m *SessionAffinityConfig) Reset() { *m = SessionAffinityConfig{} } func (*SessionAffinityConfig) ProtoMessage() {} func (*SessionAffinityConfig) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{198} + return fileDescriptor_6c07b07c062484ab, []int{199} } func (m *SessionAffinityConfig) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5624,7 +5652,7 @@ var xxx_messageInfo_SessionAffinityConfig proto.InternalMessageInfo func (m *SleepAction) Reset() { *m = SleepAction{} } func (*SleepAction) ProtoMessage() {} func (*SleepAction) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{199} + return fileDescriptor_6c07b07c062484ab, []int{200} } func (m *SleepAction) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5652,7 +5680,7 @@ var xxx_messageInfo_SleepAction proto.InternalMessageInfo func (m *StorageOSPersistentVolumeSource) Reset() { *m = StorageOSPersistentVolumeSource{} } func (*StorageOSPersistentVolumeSource) ProtoMessage() {} func (*StorageOSPersistentVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{200} + return fileDescriptor_6c07b07c062484ab, []int{201} } func (m *StorageOSPersistentVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5680,7 +5708,7 @@ var xxx_messageInfo_StorageOSPersistentVolumeSource proto.InternalMessageInfo func (m *StorageOSVolumeSource) Reset() { *m = StorageOSVolumeSource{} } func (*StorageOSVolumeSource) ProtoMessage() {} func (*StorageOSVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{201} + return fileDescriptor_6c07b07c062484ab, []int{202} } func (m *StorageOSVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5708,7 +5736,7 @@ var xxx_messageInfo_StorageOSVolumeSource proto.InternalMessageInfo func (m *Sysctl) Reset() { *m = Sysctl{} } func (*Sysctl) ProtoMessage() {} func (*Sysctl) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{202} + return fileDescriptor_6c07b07c062484ab, []int{203} } func (m *Sysctl) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5736,7 +5764,7 @@ var xxx_messageInfo_Sysctl proto.InternalMessageInfo func (m *TCPSocketAction) Reset() { *m = TCPSocketAction{} } func (*TCPSocketAction) ProtoMessage() {} func (*TCPSocketAction) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{203} + return fileDescriptor_6c07b07c062484ab, []int{204} } func (m *TCPSocketAction) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5764,7 +5792,7 @@ var xxx_messageInfo_TCPSocketAction proto.InternalMessageInfo func (m *Taint) Reset() { *m = Taint{} } func (*Taint) ProtoMessage() {} func (*Taint) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{204} + return fileDescriptor_6c07b07c062484ab, []int{205} } func (m *Taint) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5792,7 +5820,7 @@ var xxx_messageInfo_Taint proto.InternalMessageInfo func (m *Toleration) Reset() { *m = Toleration{} } func (*Toleration) ProtoMessage() {} func (*Toleration) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{205} + return fileDescriptor_6c07b07c062484ab, []int{206} } func (m *Toleration) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5820,7 +5848,7 @@ var xxx_messageInfo_Toleration proto.InternalMessageInfo func (m *TopologySelectorLabelRequirement) Reset() { *m = TopologySelectorLabelRequirement{} } func (*TopologySelectorLabelRequirement) ProtoMessage() {} func (*TopologySelectorLabelRequirement) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{206} + return fileDescriptor_6c07b07c062484ab, []int{207} } func (m *TopologySelectorLabelRequirement) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5848,7 +5876,7 @@ var xxx_messageInfo_TopologySelectorLabelRequirement proto.InternalMessageInfo func (m *TopologySelectorTerm) Reset() { *m = TopologySelectorTerm{} } func (*TopologySelectorTerm) ProtoMessage() {} func (*TopologySelectorTerm) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{207} + return fileDescriptor_6c07b07c062484ab, []int{208} } func (m *TopologySelectorTerm) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5876,7 +5904,7 @@ var xxx_messageInfo_TopologySelectorTerm proto.InternalMessageInfo func (m *TopologySpreadConstraint) Reset() { *m = TopologySpreadConstraint{} } func (*TopologySpreadConstraint) ProtoMessage() {} func (*TopologySpreadConstraint) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{208} + return fileDescriptor_6c07b07c062484ab, []int{209} } func (m *TopologySpreadConstraint) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5904,7 +5932,7 @@ var xxx_messageInfo_TopologySpreadConstraint proto.InternalMessageInfo func (m *TypedLocalObjectReference) Reset() { *m = TypedLocalObjectReference{} } func (*TypedLocalObjectReference) ProtoMessage() {} func (*TypedLocalObjectReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{209} + return fileDescriptor_6c07b07c062484ab, []int{210} } func (m *TypedLocalObjectReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5932,7 +5960,7 @@ var xxx_messageInfo_TypedLocalObjectReference proto.InternalMessageInfo func (m *TypedObjectReference) Reset() { *m = TypedObjectReference{} } func (*TypedObjectReference) ProtoMessage() {} func (*TypedObjectReference) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{210} + return fileDescriptor_6c07b07c062484ab, []int{211} } func (m *TypedObjectReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5960,7 +5988,7 @@ var xxx_messageInfo_TypedObjectReference proto.InternalMessageInfo func (m *Volume) Reset() { *m = Volume{} } func (*Volume) ProtoMessage() {} func (*Volume) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{211} + return fileDescriptor_6c07b07c062484ab, []int{212} } func (m *Volume) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -5988,7 +6016,7 @@ var xxx_messageInfo_Volume proto.InternalMessageInfo func (m *VolumeDevice) Reset() { *m = VolumeDevice{} } func (*VolumeDevice) ProtoMessage() {} func (*VolumeDevice) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{212} + return fileDescriptor_6c07b07c062484ab, []int{213} } func (m *VolumeDevice) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6016,7 +6044,7 @@ var xxx_messageInfo_VolumeDevice proto.InternalMessageInfo func (m *VolumeMount) Reset() { *m = VolumeMount{} } func (*VolumeMount) ProtoMessage() {} func (*VolumeMount) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{213} + return fileDescriptor_6c07b07c062484ab, []int{214} } func (m *VolumeMount) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6044,7 +6072,7 @@ var xxx_messageInfo_VolumeMount proto.InternalMessageInfo func (m *VolumeNodeAffinity) Reset() { *m = VolumeNodeAffinity{} } func (*VolumeNodeAffinity) ProtoMessage() {} func (*VolumeNodeAffinity) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{214} + return fileDescriptor_6c07b07c062484ab, []int{215} } func (m *VolumeNodeAffinity) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6072,7 +6100,7 @@ var xxx_messageInfo_VolumeNodeAffinity proto.InternalMessageInfo func (m *VolumeProjection) Reset() { *m = VolumeProjection{} } func (*VolumeProjection) ProtoMessage() {} func (*VolumeProjection) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{215} + return fileDescriptor_6c07b07c062484ab, []int{216} } func (m *VolumeProjection) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6100,7 +6128,7 @@ var xxx_messageInfo_VolumeProjection proto.InternalMessageInfo func (m *VolumeResourceRequirements) Reset() { *m = VolumeResourceRequirements{} } func (*VolumeResourceRequirements) ProtoMessage() {} func (*VolumeResourceRequirements) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{216} + return fileDescriptor_6c07b07c062484ab, []int{217} } func (m *VolumeResourceRequirements) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6128,7 +6156,7 @@ var xxx_messageInfo_VolumeResourceRequirements proto.InternalMessageInfo func (m *VolumeSource) Reset() { *m = VolumeSource{} } func (*VolumeSource) ProtoMessage() {} func (*VolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{217} + return fileDescriptor_6c07b07c062484ab, []int{218} } func (m *VolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6156,7 +6184,7 @@ var xxx_messageInfo_VolumeSource proto.InternalMessageInfo func (m *VsphereVirtualDiskVolumeSource) Reset() { *m = VsphereVirtualDiskVolumeSource{} } func (*VsphereVirtualDiskVolumeSource) ProtoMessage() {} func (*VsphereVirtualDiskVolumeSource) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{218} + return fileDescriptor_6c07b07c062484ab, []int{219} } func (m *VsphereVirtualDiskVolumeSource) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6184,7 +6212,7 @@ var xxx_messageInfo_VsphereVirtualDiskVolumeSource proto.InternalMessageInfo func (m *WeightedPodAffinityTerm) Reset() { *m = WeightedPodAffinityTerm{} } func (*WeightedPodAffinityTerm) ProtoMessage() {} func (*WeightedPodAffinityTerm) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{219} + return fileDescriptor_6c07b07c062484ab, []int{220} } func (m *WeightedPodAffinityTerm) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6212,7 +6240,7 @@ var xxx_messageInfo_WeightedPodAffinityTerm proto.InternalMessageInfo func (m *WindowsSecurityContextOptions) Reset() { *m = WindowsSecurityContextOptions{} } func (*WindowsSecurityContextOptions) ProtoMessage() {} func (*WindowsSecurityContextOptions) Descriptor() ([]byte, []int) { - return fileDescriptor_6c07b07c062484ab, []int{220} + return fileDescriptor_6c07b07c062484ab, []int{221} } func (m *WindowsSecurityContextOptions) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -6240,6 +6268,7 @@ var xxx_messageInfo_WindowsSecurityContextOptions proto.InternalMessageInfo func init() { proto.RegisterType((*AWSElasticBlockStoreVolumeSource)(nil), "k8s.io.api.core.v1.AWSElasticBlockStoreVolumeSource") proto.RegisterType((*Affinity)(nil), "k8s.io.api.core.v1.Affinity") + proto.RegisterType((*AppArmorProfile)(nil), "k8s.io.api.core.v1.AppArmorProfile") proto.RegisterType((*AttachedVolume)(nil), "k8s.io.api.core.v1.AttachedVolume") proto.RegisterType((*AvoidPods)(nil), "k8s.io.api.core.v1.AvoidPods") proto.RegisterType((*AzureDiskVolumeSource)(nil), "k8s.io.api.core.v1.AzureDiskVolumeSource") @@ -6497,973 +6526,978 @@ func init() { } var fileDescriptor_6c07b07c062484ab = []byte{ - // 15453 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xbd, 0x69, 0x90, 0x1c, 0xc9, - 0x75, 0x18, 0xcc, 0xea, 0x9e, 0xab, 0xdf, 0xdc, 0x39, 0x00, 0x76, 0x30, 0x0b, 0xa0, 0xb1, 0xb5, - 0xbb, 0x58, 0xec, 0x35, 0x20, 0xf6, 0x20, 0x97, 0xbb, 0xcb, 0x15, 0xe7, 0x04, 0x7a, 0x31, 0x33, - 0xe8, 0xcd, 0x1e, 0x00, 0xe4, 0x72, 0xc9, 0x8f, 0x85, 0xee, 0x9c, 0x99, 0xe2, 0xf4, 0x54, 0xf5, - 0x56, 0x55, 0x0f, 0x30, 0xf8, 0xa8, 0x90, 0x44, 0x59, 0x94, 0x48, 0xc9, 0x11, 0x0c, 0x87, 0x7c, - 0x04, 0xa5, 0x50, 0x38, 0x64, 0x59, 0x87, 0x69, 0xc9, 0xa6, 0x29, 0x4b, 0xb2, 0xa8, 0xcb, 0x57, - 0x58, 0x52, 0x38, 0x64, 0x59, 0x11, 0x16, 0x15, 0x56, 0x78, 0x64, 0x42, 0x8e, 0x50, 0xe8, 0x87, - 0x25, 0xf9, 0xf8, 0x61, 0x4f, 0xc8, 0x96, 0x23, 0xcf, 0xca, 0xac, 0xa3, 0xbb, 0x07, 0x0b, 0x0c, - 0x97, 0x8c, 0xfd, 0xd7, 0xfd, 0xde, 0xcb, 0x97, 0x59, 0x79, 0xbe, 0x7c, 0xef, 0xe5, 0x7b, 0x60, - 0x6f, 0xbf, 0x14, 0xce, 0xba, 0xfe, 0x05, 0xa7, 0xe5, 0x5e, 0xa8, 0xfb, 0x01, 0xb9, 0xb0, 0x7b, - 0xf1, 0xc2, 0x26, 0xf1, 0x48, 0xe0, 0x44, 0xa4, 0x31, 0xdb, 0x0a, 0xfc, 0xc8, 0x47, 0x88, 0xd3, - 0xcc, 0x3a, 0x2d, 0x77, 0x96, 0xd2, 0xcc, 0xee, 0x5e, 0x9c, 0x79, 0x76, 0xd3, 0x8d, 0xb6, 0xda, - 0x37, 0x67, 0xeb, 0xfe, 0xce, 0x85, 0x4d, 0x7f, 0xd3, 0xbf, 0xc0, 0x48, 0x6f, 0xb6, 0x37, 0xd8, - 0x3f, 0xf6, 0x87, 0xfd, 0xe2, 0x2c, 0x66, 0x5e, 0x88, 0xab, 0xd9, 0x71, 0xea, 0x5b, 0xae, 0x47, - 0x82, 0xbd, 0x0b, 0xad, 0xed, 0x4d, 0x56, 0x6f, 0x40, 0x42, 0xbf, 0x1d, 0xd4, 0x49, 0xb2, 0xe2, - 0x8e, 0xa5, 0xc2, 0x0b, 0x3b, 0x24, 0x72, 0x32, 0x9a, 0x3b, 0x73, 0x21, 0xaf, 0x54, 0xd0, 0xf6, - 0x22, 0x77, 0x27, 0x5d, 0xcd, 0x07, 0xba, 0x15, 0x08, 0xeb, 0x5b, 0x64, 0xc7, 0x49, 0x95, 0x7b, - 0x3e, 0xaf, 0x5c, 0x3b, 0x72, 0x9b, 0x17, 0x5c, 0x2f, 0x0a, 0xa3, 0x20, 0x59, 0xc8, 0xfe, 0xba, - 0x05, 0x67, 0xe7, 0x6e, 0xd4, 0x96, 0x9a, 0x4e, 0x18, 0xb9, 0xf5, 0xf9, 0xa6, 0x5f, 0xdf, 0xae, - 0x45, 0x7e, 0x40, 0xae, 0xfb, 0xcd, 0xf6, 0x0e, 0xa9, 0xb1, 0x8e, 0x40, 0xcf, 0xc0, 0xd0, 0x2e, - 0xfb, 0x5f, 0x59, 0x9c, 0xb6, 0xce, 0x5a, 0xe7, 0x4b, 0xf3, 0x13, 0xbf, 0xb9, 0x5f, 0x7e, 0xdf, - 0xdd, 0xfd, 0xf2, 0xd0, 0x75, 0x01, 0xc7, 0x8a, 0x02, 0x9d, 0x83, 0x81, 0x8d, 0x70, 0x7d, 0xaf, - 0x45, 0xa6, 0x0b, 0x8c, 0x76, 0x4c, 0xd0, 0x0e, 0x2c, 0xd7, 0x28, 0x14, 0x0b, 0x2c, 0xba, 0x00, - 0xa5, 0x96, 0x13, 0x44, 0x6e, 0xe4, 0xfa, 0xde, 0x74, 0xf1, 0xac, 0x75, 0xbe, 0x7f, 0x7e, 0x52, - 0x90, 0x96, 0xaa, 0x12, 0x81, 0x63, 0x1a, 0xda, 0x8c, 0x80, 0x38, 0x8d, 0xab, 0x5e, 0x73, 0x6f, - 0xba, 0xef, 0xac, 0x75, 0x7e, 0x28, 0x6e, 0x06, 0x16, 0x70, 0xac, 0x28, 0xec, 0x2f, 0x15, 0x60, - 0x68, 0x6e, 0x63, 0xc3, 0xf5, 0xdc, 0x68, 0x0f, 0x5d, 0x87, 0x11, 0xcf, 0x6f, 0x10, 0xf9, 0x9f, - 0x7d, 0xc5, 0xf0, 0x73, 0x67, 0x67, 0xd3, 0x53, 0x69, 0x76, 0x4d, 0xa3, 0x9b, 0x9f, 0xb8, 0xbb, - 0x5f, 0x1e, 0xd1, 0x21, 0xd8, 0xe0, 0x83, 0x30, 0x0c, 0xb7, 0xfc, 0x86, 0x62, 0x5b, 0x60, 0x6c, - 0xcb, 0x59, 0x6c, 0xab, 0x31, 0xd9, 0xfc, 0xf8, 0xdd, 0xfd, 0xf2, 0xb0, 0x06, 0xc0, 0x3a, 0x13, - 0x74, 0x13, 0xc6, 0xe9, 0x5f, 0x2f, 0x72, 0x15, 0xdf, 0x22, 0xe3, 0xfb, 0x68, 0x1e, 0x5f, 0x8d, - 0x74, 0x7e, 0xea, 0xee, 0x7e, 0x79, 0x3c, 0x01, 0xc4, 0x49, 0x86, 0xf6, 0x1d, 0x18, 0x9b, 0x8b, - 0x22, 0xa7, 0xbe, 0x45, 0x1a, 0x7c, 0x04, 0xd1, 0x0b, 0xd0, 0xe7, 0x39, 0x3b, 0x44, 0x8c, 0xef, - 0x59, 0xd1, 0xb1, 0x7d, 0x6b, 0xce, 0x0e, 0x39, 0xd8, 0x2f, 0x4f, 0x5c, 0xf3, 0xdc, 0xb7, 0xdb, - 0x62, 0x56, 0x50, 0x18, 0x66, 0xd4, 0xe8, 0x39, 0x80, 0x06, 0xd9, 0x75, 0xeb, 0xa4, 0xea, 0x44, - 0x5b, 0x62, 0xbc, 0x91, 0x28, 0x0b, 0x8b, 0x0a, 0x83, 0x35, 0x2a, 0xfb, 0x36, 0x94, 0xe6, 0x76, - 0x7d, 0xb7, 0x51, 0xf5, 0x1b, 0x21, 0xda, 0x86, 0xf1, 0x56, 0x40, 0x36, 0x48, 0xa0, 0x40, 0xd3, - 0xd6, 0xd9, 0xe2, 0xf9, 0xe1, 0xe7, 0xce, 0x67, 0x7e, 0xac, 0x49, 0xba, 0xe4, 0x45, 0xc1, 0xde, - 0xfc, 0x43, 0xa2, 0xbe, 0xf1, 0x04, 0x16, 0x27, 0x39, 0xdb, 0xff, 0xaa, 0x00, 0xc7, 0xe7, 0xee, - 0xb4, 0x03, 0xb2, 0xe8, 0x86, 0xdb, 0xc9, 0x19, 0xde, 0x70, 0xc3, 0xed, 0xb5, 0xb8, 0x07, 0xd4, - 0xd4, 0x5a, 0x14, 0x70, 0xac, 0x28, 0xd0, 0xb3, 0x30, 0x48, 0x7f, 0x5f, 0xc3, 0x15, 0xf1, 0xc9, - 0x53, 0x82, 0x78, 0x78, 0xd1, 0x89, 0x9c, 0x45, 0x8e, 0xc2, 0x92, 0x06, 0xad, 0xc2, 0x70, 0x9d, - 0x2d, 0xc8, 0xcd, 0x55, 0xbf, 0x41, 0xd8, 0x60, 0x96, 0xe6, 0x9f, 0xa6, 0xe4, 0x0b, 0x31, 0xf8, - 0x60, 0xbf, 0x3c, 0xcd, 0xdb, 0x26, 0x58, 0x68, 0x38, 0xac, 0x97, 0x47, 0xb6, 0x5a, 0x5f, 0x7d, - 0x8c, 0x13, 0x64, 0xac, 0xad, 0xf3, 0xda, 0x52, 0xe9, 0x67, 0x4b, 0x65, 0x24, 0x7b, 0x99, 0xa0, - 0x8b, 0xd0, 0xb7, 0xed, 0x7a, 0x8d, 0xe9, 0x01, 0xc6, 0xeb, 0x34, 0x1d, 0xf3, 0x2b, 0xae, 0xd7, - 0x38, 0xd8, 0x2f, 0x4f, 0x1a, 0xcd, 0xa1, 0x40, 0xcc, 0x48, 0xed, 0xff, 0x61, 0x41, 0x99, 0xe1, - 0x96, 0xdd, 0x26, 0xa9, 0x92, 0x20, 0x74, 0xc3, 0x88, 0x78, 0x91, 0xd1, 0xa1, 0xcf, 0x01, 0x84, - 0xa4, 0x1e, 0x90, 0x48, 0xeb, 0x52, 0x35, 0x31, 0x6a, 0x0a, 0x83, 0x35, 0x2a, 0xba, 0x21, 0x84, - 0x5b, 0x4e, 0xc0, 0xe6, 0x97, 0xe8, 0x58, 0xb5, 0x21, 0xd4, 0x24, 0x02, 0xc7, 0x34, 0xc6, 0x86, - 0x50, 0xec, 0xb6, 0x21, 0xa0, 0x0f, 0xc3, 0x78, 0x5c, 0x59, 0xd8, 0x72, 0xea, 0xb2, 0x03, 0xd9, - 0x92, 0xa9, 0x99, 0x28, 0x9c, 0xa4, 0xb5, 0xff, 0x81, 0x25, 0x26, 0x0f, 0xfd, 0xea, 0x77, 0xf9, - 0xb7, 0xda, 0xbf, 0x64, 0xc1, 0xe0, 0xbc, 0xeb, 0x35, 0x5c, 0x6f, 0x13, 0x7d, 0x0a, 0x86, 0xe8, - 0xd9, 0xd4, 0x70, 0x22, 0x47, 0xec, 0x7b, 0xef, 0xd7, 0xd6, 0x96, 0x3a, 0x2a, 0x66, 0x5b, 0xdb, - 0x9b, 0x14, 0x10, 0xce, 0x52, 0x6a, 0xba, 0xda, 0xae, 0xde, 0xfc, 0x34, 0xa9, 0x47, 0xab, 0x24, - 0x72, 0xe2, 0xcf, 0x89, 0x61, 0x58, 0x71, 0x45, 0x57, 0x60, 0x20, 0x72, 0x82, 0x4d, 0x12, 0x89, - 0x0d, 0x30, 0x73, 0xa3, 0xe2, 0x25, 0x31, 0x5d, 0x91, 0xc4, 0xab, 0x93, 0xf8, 0x58, 0x58, 0x67, - 0x45, 0xb1, 0x60, 0x61, 0xff, 0x9f, 0x41, 0x38, 0xb9, 0x50, 0xab, 0xe4, 0xcc, 0xab, 0x73, 0x30, - 0xd0, 0x08, 0xdc, 0x5d, 0x12, 0x88, 0x7e, 0x56, 0x5c, 0x16, 0x19, 0x14, 0x0b, 0x2c, 0x7a, 0x09, - 0x46, 0xf8, 0x81, 0x74, 0xd9, 0xf1, 0x1a, 0x4d, 0xd9, 0xc5, 0xc7, 0x04, 0xf5, 0xc8, 0x75, 0x0d, - 0x87, 0x0d, 0xca, 0x43, 0x4e, 0xaa, 0x73, 0x89, 0xc5, 0x98, 0x77, 0xd8, 0x7d, 0xde, 0x82, 0x09, - 0x5e, 0xcd, 0x5c, 0x14, 0x05, 0xee, 0xcd, 0x76, 0x44, 0xc2, 0xe9, 0x7e, 0xb6, 0xd3, 0x2d, 0x64, - 0xf5, 0x56, 0x6e, 0x0f, 0xcc, 0x5e, 0x4f, 0x70, 0xe1, 0x9b, 0xe0, 0xb4, 0xa8, 0x77, 0x22, 0x89, - 0xc6, 0xa9, 0x6a, 0xd1, 0xf7, 0x5a, 0x30, 0x53, 0xf7, 0xbd, 0x28, 0xf0, 0x9b, 0x4d, 0x12, 0x54, - 0xdb, 0x37, 0x9b, 0x6e, 0xb8, 0xc5, 0xe7, 0x29, 0x26, 0x1b, 0x6c, 0x27, 0xc8, 0x19, 0x43, 0x45, - 0x24, 0xc6, 0xf0, 0xcc, 0xdd, 0xfd, 0xf2, 0xcc, 0x42, 0x2e, 0x2b, 0xdc, 0xa1, 0x1a, 0xb4, 0x0d, - 0x88, 0x1e, 0xa5, 0xb5, 0xc8, 0xd9, 0x24, 0x71, 0xe5, 0x83, 0xbd, 0x57, 0x7e, 0xe2, 0xee, 0x7e, - 0x19, 0xad, 0xa5, 0x58, 0xe0, 0x0c, 0xb6, 0xe8, 0x6d, 0x38, 0x46, 0xa1, 0xa9, 0x6f, 0x1d, 0xea, - 0xbd, 0xba, 0xe9, 0xbb, 0xfb, 0xe5, 0x63, 0x6b, 0x19, 0x4c, 0x70, 0x26, 0x6b, 0xf4, 0xdd, 0x16, - 0x9c, 0x8c, 0x3f, 0x7f, 0xe9, 0x76, 0xcb, 0xf1, 0x1a, 0x71, 0xc5, 0xa5, 0xde, 0x2b, 0xa6, 0x7b, - 0xf2, 0xc9, 0x85, 0x3c, 0x4e, 0x38, 0xbf, 0x12, 0xe4, 0xc1, 0x14, 0x6d, 0x5a, 0xb2, 0x6e, 0xe8, - 0xbd, 0xee, 0x87, 0xee, 0xee, 0x97, 0xa7, 0xd6, 0xd2, 0x3c, 0x70, 0x16, 0xe3, 0x99, 0x05, 0x38, - 0x9e, 0x39, 0x3b, 0xd1, 0x04, 0x14, 0xb7, 0x09, 0x97, 0xba, 0x4a, 0x98, 0xfe, 0x44, 0xc7, 0xa0, - 0x7f, 0xd7, 0x69, 0xb6, 0xc5, 0xc2, 0xc4, 0xfc, 0xcf, 0xcb, 0x85, 0x97, 0x2c, 0xfb, 0x5f, 0x17, - 0x61, 0x7c, 0xa1, 0x56, 0xb9, 0xa7, 0x55, 0xaf, 0x1f, 0x7b, 0x85, 0x8e, 0xc7, 0x5e, 0x7c, 0x88, - 0x16, 0x73, 0x0f, 0xd1, 0xef, 0xca, 0x58, 0xb2, 0x7d, 0x6c, 0xc9, 0x7e, 0x28, 0x67, 0xc9, 0xde, - 0xe7, 0x85, 0xba, 0x9b, 0x33, 0x6b, 0xfb, 0xd9, 0x00, 0x66, 0x4a, 0x48, 0x2b, 0x7e, 0xdd, 0x69, - 0x26, 0xb7, 0xda, 0x43, 0x4e, 0xdd, 0xfb, 0x33, 0x8e, 0x75, 0x18, 0x59, 0x70, 0x5a, 0xce, 0x4d, - 0xb7, 0xe9, 0x46, 0x2e, 0x09, 0xd1, 0x13, 0x50, 0x74, 0x1a, 0x0d, 0x26, 0xdd, 0x95, 0xe6, 0x8f, - 0xdf, 0xdd, 0x2f, 0x17, 0xe7, 0x1a, 0x54, 0xcc, 0x00, 0x45, 0xb5, 0x87, 0x29, 0x05, 0x7a, 0x0a, - 0xfa, 0x1a, 0x81, 0xdf, 0x9a, 0x2e, 0x30, 0x4a, 0xba, 0xca, 0xfb, 0x16, 0x03, 0xbf, 0x95, 0x20, - 0x65, 0x34, 0xf6, 0x6f, 0x14, 0xe0, 0xd4, 0x02, 0x69, 0x6d, 0x2d, 0xd7, 0x72, 0xce, 0x8b, 0xf3, - 0x30, 0xb4, 0xe3, 0x7b, 0x6e, 0xe4, 0x07, 0xa1, 0xa8, 0x9a, 0xcd, 0x88, 0x55, 0x01, 0xc3, 0x0a, - 0x8b, 0xce, 0x42, 0x5f, 0x2b, 0x16, 0x62, 0x47, 0xa4, 0x00, 0xcc, 0xc4, 0x57, 0x86, 0xa1, 0x14, - 0xed, 0x90, 0x04, 0x62, 0xc6, 0x28, 0x8a, 0x6b, 0x21, 0x09, 0x30, 0xc3, 0xc4, 0x92, 0x00, 0x95, - 0x11, 0xc4, 0x89, 0x90, 0x90, 0x04, 0x28, 0x06, 0x6b, 0x54, 0xa8, 0x0a, 0xa5, 0x30, 0x31, 0xb2, - 0x3d, 0x2d, 0xcd, 0x51, 0x26, 0x2a, 0xa8, 0x91, 0x8c, 0x99, 0x18, 0x27, 0xd8, 0x40, 0x57, 0x51, - 0xe1, 0x6b, 0x05, 0x40, 0xbc, 0x0b, 0xbf, 0xc5, 0x3a, 0xee, 0x5a, 0xba, 0xe3, 0x7a, 0x5f, 0x12, - 0xf7, 0xab, 0xf7, 0xfe, 0xa7, 0x05, 0xa7, 0x16, 0x5c, 0xaf, 0x41, 0x82, 0x9c, 0x09, 0xf8, 0x60, - 0xee, 0xce, 0x87, 0x13, 0x52, 0x8c, 0x29, 0xd6, 0x77, 0x1f, 0xa6, 0x98, 0xfd, 0xe7, 0x16, 0x20, - 0xfe, 0xd9, 0xef, 0xba, 0x8f, 0xbd, 0x96, 0xfe, 0xd8, 0xfb, 0x30, 0x2d, 0xec, 0x7f, 0x64, 0xc1, - 0xf0, 0x42, 0xd3, 0x71, 0x77, 0xc4, 0xa7, 0x2e, 0xc0, 0xa4, 0x54, 0x14, 0x31, 0xb0, 0x26, 0xfb, - 0xd3, 0xcd, 0x6d, 0x12, 0x27, 0x91, 0x38, 0x4d, 0x8f, 0x3e, 0x0e, 0x27, 0x0d, 0xe0, 0x3a, 0xd9, - 0x69, 0x35, 0x9d, 0x48, 0xbf, 0x15, 0xb0, 0xd3, 0x1f, 0xe7, 0x11, 0xe1, 0xfc, 0xf2, 0xf6, 0x0a, - 0x8c, 0x2d, 0x34, 0x5d, 0xe2, 0x45, 0x95, 0xea, 0x82, 0xef, 0x6d, 0xb8, 0x9b, 0xe8, 0x65, 0x18, - 0x8b, 0xdc, 0x1d, 0xe2, 0xb7, 0xa3, 0x1a, 0xa9, 0xfb, 0x1e, 0xbb, 0x6b, 0x5b, 0xe7, 0xfb, 0xe7, - 0xd1, 0xdd, 0xfd, 0xf2, 0xd8, 0xba, 0x81, 0xc1, 0x09, 0x4a, 0xfb, 0x27, 0xe9, 0x4e, 0xdb, 0x6c, - 0x87, 0x11, 0x09, 0xd6, 0x83, 0x76, 0x18, 0xcd, 0xb7, 0xa9, 0xb4, 0x5c, 0x0d, 0x7c, 0xda, 0x81, - 0xae, 0xef, 0xa1, 0x53, 0x86, 0x02, 0x61, 0x48, 0x2a, 0x0f, 0x84, 0xa2, 0x60, 0x16, 0x20, 0x74, - 0x37, 0x3d, 0x12, 0x68, 0x9f, 0x36, 0xc6, 0x16, 0xb7, 0x82, 0x62, 0x8d, 0x02, 0x35, 0x61, 0xb4, - 0xe9, 0xdc, 0x24, 0xcd, 0x1a, 0x69, 0x92, 0x7a, 0xe4, 0x07, 0x42, 0x05, 0xf2, 0x7c, 0x6f, 0x37, - 0x97, 0x15, 0xbd, 0xe8, 0xfc, 0xe4, 0xdd, 0xfd, 0xf2, 0xa8, 0x01, 0xc2, 0x26, 0x73, 0xba, 0xd9, - 0xf9, 0x2d, 0xfa, 0x15, 0x4e, 0x53, 0xbf, 0x2e, 0x5f, 0x15, 0x30, 0xac, 0xb0, 0x6a, 0xb3, 0xeb, - 0xcb, 0xdb, 0xec, 0xec, 0x3f, 0xa4, 0x4b, 0xc3, 0xdf, 0x69, 0xf9, 0x1e, 0xf1, 0xa2, 0x05, 0xdf, - 0x6b, 0x70, 0xe5, 0xd5, 0xcb, 0xd0, 0x17, 0xd1, 0xa9, 0xce, 0xbb, 0xe7, 0x9c, 0x2c, 0x48, 0x27, - 0xf8, 0xc1, 0x7e, 0xf9, 0x44, 0xba, 0x04, 0x5b, 0x02, 0xac, 0x0c, 0xfa, 0x10, 0x0c, 0x84, 0x91, - 0x13, 0xb5, 0x43, 0xd1, 0x71, 0x8f, 0xc8, 0x85, 0x52, 0x63, 0xd0, 0x83, 0xfd, 0xf2, 0xb8, 0x2a, - 0xc6, 0x41, 0x58, 0x14, 0x40, 0x4f, 0xc2, 0xe0, 0x0e, 0x09, 0x43, 0x67, 0x53, 0x0a, 0x3a, 0xe3, - 0xa2, 0xec, 0xe0, 0x2a, 0x07, 0x63, 0x89, 0x47, 0x8f, 0x42, 0x3f, 0x09, 0x02, 0x3f, 0x10, 0xdf, - 0x36, 0x2a, 0x08, 0xfb, 0x97, 0x28, 0x10, 0x73, 0x9c, 0xfd, 0xef, 0x2c, 0x18, 0x57, 0x6d, 0xe5, - 0x75, 0x1d, 0xc1, 0x05, 0xf3, 0x4d, 0x80, 0xba, 0xfc, 0xc0, 0x90, 0x09, 0x06, 0xc3, 0xcf, 0x9d, - 0xcb, 0x94, 0xc1, 0x52, 0xdd, 0x18, 0x73, 0x56, 0xa0, 0x10, 0x6b, 0xdc, 0xec, 0x5f, 0xb5, 0x60, - 0x2a, 0xf1, 0x45, 0x2b, 0x6e, 0x18, 0xa1, 0xb7, 0x52, 0x5f, 0x35, 0xdb, 0xe3, 0xe4, 0x73, 0x43, - 0xfe, 0x4d, 0x6a, 0x97, 0x92, 0x10, 0xed, 0x8b, 0x2e, 0x43, 0xbf, 0x1b, 0x91, 0x1d, 0xf9, 0x31, - 0x8f, 0x76, 0xfc, 0x18, 0xde, 0xaa, 0x78, 0x44, 0x2a, 0xb4, 0x24, 0xe6, 0x0c, 0xec, 0xdf, 0x28, - 0x42, 0x89, 0xaf, 0xef, 0x55, 0xa7, 0x75, 0x04, 0x63, 0xf1, 0x34, 0x94, 0xdc, 0x9d, 0x9d, 0x76, - 0xe4, 0xdc, 0x14, 0x27, 0xf5, 0x10, 0xdf, 0x35, 0x2b, 0x12, 0x88, 0x63, 0x3c, 0xaa, 0x40, 0x1f, - 0x6b, 0x0a, 0xff, 0xca, 0x27, 0xb2, 0xbf, 0x52, 0xb4, 0x7d, 0x76, 0xd1, 0x89, 0x1c, 0x2e, 0x24, - 0xab, 0x75, 0x45, 0x41, 0x98, 0xb1, 0x40, 0x0e, 0xc0, 0x4d, 0xd7, 0x73, 0x82, 0x3d, 0x0a, 0x9b, - 0x2e, 0x32, 0x86, 0xcf, 0x76, 0x66, 0x38, 0xaf, 0xe8, 0x39, 0x5b, 0xf5, 0x61, 0x31, 0x02, 0x6b, - 0x4c, 0x67, 0x3e, 0x08, 0x25, 0x45, 0x7c, 0x18, 0x59, 0x77, 0xe6, 0xc3, 0x30, 0x9e, 0xa8, 0xab, - 0x5b, 0xf1, 0x11, 0x5d, 0x54, 0xfe, 0x65, 0xb6, 0x65, 0x88, 0x56, 0x2f, 0x79, 0xbb, 0xe2, 0x88, - 0xb9, 0x03, 0xc7, 0x9a, 0x19, 0x87, 0x94, 0x18, 0xd7, 0xde, 0x0f, 0xb5, 0x53, 0xe2, 0xb3, 0x8f, - 0x65, 0x61, 0x71, 0x66, 0x1d, 0xc6, 0x8e, 0x58, 0xe8, 0xb4, 0x23, 0xd2, 0xfd, 0xee, 0x98, 0x6a, - 0xfc, 0x15, 0xb2, 0xa7, 0x36, 0xd5, 0x6f, 0x66, 0xf3, 0x4f, 0xf3, 0xde, 0xe7, 0xdb, 0xe5, 0xb0, - 0x60, 0x50, 0xbc, 0x42, 0xf6, 0xf8, 0x50, 0xe8, 0x5f, 0x57, 0xec, 0xf8, 0x75, 0x5f, 0xb1, 0x60, - 0x54, 0x7d, 0xdd, 0x11, 0xec, 0x0b, 0xf3, 0xe6, 0xbe, 0x70, 0xba, 0xe3, 0x04, 0xcf, 0xd9, 0x11, - 0xbe, 0x56, 0x80, 0x93, 0x8a, 0x86, 0x5e, 0xfb, 0xf8, 0x1f, 0x31, 0xab, 0x2e, 0x40, 0xc9, 0x53, - 0x0a, 0x50, 0xcb, 0xd4, 0x3c, 0xc6, 0xea, 0xcf, 0x98, 0x86, 0x1e, 0x79, 0x5e, 0x7c, 0x68, 0x8f, - 0xe8, 0x96, 0x01, 0x71, 0xb8, 0xcf, 0x43, 0xb1, 0xed, 0x36, 0xc4, 0x01, 0xf3, 0x7e, 0xd9, 0xdb, - 0xd7, 0x2a, 0x8b, 0x07, 0xfb, 0xe5, 0x47, 0xf2, 0xac, 0x52, 0xf4, 0x64, 0x0b, 0x67, 0xaf, 0x55, - 0x16, 0x31, 0x2d, 0x8c, 0xe6, 0x60, 0x5c, 0x8a, 0x32, 0xd7, 0xa9, 0x24, 0xed, 0x7b, 0xe2, 0x1c, - 0x52, 0xea, 0x7d, 0x6c, 0xa2, 0x71, 0x92, 0x1e, 0x2d, 0xc2, 0xc4, 0x76, 0xfb, 0x26, 0x69, 0x92, - 0x88, 0x7f, 0xf0, 0x15, 0xc2, 0x95, 0xdf, 0xa5, 0xf8, 0xd2, 0x7d, 0x25, 0x81, 0xc7, 0xa9, 0x12, - 0xf6, 0x5f, 0xb1, 0xf3, 0x40, 0xf4, 0x9e, 0x26, 0xdf, 0x7c, 0x33, 0xa7, 0x73, 0x2f, 0xb3, 0xe2, - 0x0a, 0xd9, 0x5b, 0xf7, 0xa9, 0x1c, 0x92, 0x3d, 0x2b, 0x8c, 0x39, 0xdf, 0xd7, 0x71, 0xce, 0xff, - 0x7c, 0x01, 0x8e, 0xab, 0x1e, 0x30, 0xe4, 0xfb, 0x6f, 0xf5, 0x3e, 0xb8, 0x08, 0xc3, 0x0d, 0xb2, - 0xe1, 0xb4, 0x9b, 0x91, 0xb2, 0xc4, 0xf4, 0x73, 0x6b, 0xdc, 0x62, 0x0c, 0xc6, 0x3a, 0xcd, 0x21, - 0xba, 0xed, 0x67, 0x47, 0xd9, 0x41, 0x1c, 0x39, 0x74, 0x8e, 0xab, 0x55, 0x63, 0xe5, 0xae, 0x9a, - 0x47, 0xa1, 0xdf, 0xdd, 0xa1, 0x82, 0x59, 0xc1, 0x94, 0xb7, 0x2a, 0x14, 0x88, 0x39, 0x0e, 0x3d, - 0x0e, 0x83, 0x75, 0x7f, 0x67, 0xc7, 0xf1, 0x1a, 0xec, 0xc8, 0x2b, 0xcd, 0x0f, 0x53, 0xd9, 0x6d, - 0x81, 0x83, 0xb0, 0xc4, 0x51, 0xe1, 0xdb, 0x09, 0x36, 0xb9, 0x7a, 0x4a, 0x08, 0xdf, 0x73, 0xc1, - 0x66, 0x88, 0x19, 0x94, 0xde, 0xae, 0x6f, 0xf9, 0xc1, 0xb6, 0xeb, 0x6d, 0x2e, 0xba, 0x81, 0x58, - 0x12, 0xea, 0x2c, 0xbc, 0xa1, 0x30, 0x58, 0xa3, 0x42, 0xcb, 0xd0, 0xdf, 0xf2, 0x83, 0x28, 0x9c, - 0x1e, 0x60, 0xdd, 0xfd, 0x48, 0xce, 0x46, 0xc4, 0xbf, 0xb6, 0xea, 0x07, 0x51, 0xfc, 0x01, 0xf4, - 0x5f, 0x88, 0x79, 0x71, 0xb4, 0x02, 0x83, 0xc4, 0xdb, 0x5d, 0x0e, 0xfc, 0x9d, 0xe9, 0xa9, 0x7c, - 0x4e, 0x4b, 0x9c, 0x84, 0x4f, 0xb3, 0x58, 0x46, 0x15, 0x60, 0x2c, 0x59, 0xa0, 0x0f, 0x41, 0x91, - 0x78, 0xbb, 0xd3, 0x83, 0x8c, 0xd3, 0x4c, 0x0e, 0xa7, 0xeb, 0x4e, 0x10, 0xef, 0xf9, 0x4b, 0xde, - 0x2e, 0xa6, 0x65, 0xd0, 0xc7, 0xa0, 0x24, 0x37, 0x8c, 0x50, 0xe8, 0x7d, 0x33, 0x27, 0xac, 0xdc, - 0x66, 0x30, 0x79, 0xbb, 0xed, 0x06, 0x64, 0x87, 0x78, 0x51, 0x18, 0xef, 0x90, 0x12, 0x1b, 0xe2, - 0x98, 0x1b, 0xaa, 0xc3, 0x48, 0x40, 0x42, 0xf7, 0x0e, 0xa9, 0xfa, 0x4d, 0xb7, 0xbe, 0x37, 0xfd, - 0x10, 0x6b, 0xde, 0x93, 0x1d, 0xbb, 0x0c, 0x6b, 0x05, 0x62, 0xbb, 0x84, 0x0e, 0xc5, 0x06, 0x53, - 0xf4, 0x06, 0x8c, 0x06, 0x24, 0x8c, 0x9c, 0x20, 0x12, 0xb5, 0x4c, 0x2b, 0x3b, 0xe2, 0x28, 0xd6, - 0x11, 0xfc, 0x3a, 0x11, 0x57, 0x13, 0x63, 0xb0, 0xc9, 0x01, 0x7d, 0x4c, 0x1a, 0x49, 0x56, 0xfd, - 0xb6, 0x17, 0x85, 0xd3, 0x25, 0xd6, 0xee, 0x4c, 0xf3, 0xf5, 0xf5, 0x98, 0x2e, 0x69, 0x45, 0xe1, - 0x85, 0xb1, 0xc1, 0x0a, 0x7d, 0x02, 0x46, 0xf9, 0x7f, 0x6e, 0x04, 0x0e, 0xa7, 0x8f, 0x33, 0xde, - 0x67, 0xf3, 0x79, 0x73, 0xc2, 0xf9, 0xe3, 0x82, 0xf9, 0xa8, 0x0e, 0x0d, 0xb1, 0xc9, 0x0d, 0x61, - 0x18, 0x6d, 0xba, 0xbb, 0xc4, 0x23, 0x61, 0x58, 0x0d, 0xfc, 0x9b, 0x44, 0xe8, 0xb4, 0x4f, 0x66, - 0x1b, 0x8d, 0xfd, 0x9b, 0x44, 0x5c, 0x02, 0xf5, 0x32, 0xd8, 0x64, 0x81, 0xae, 0xc1, 0x58, 0x40, - 0x9c, 0x86, 0x1b, 0x33, 0x1d, 0xee, 0xc6, 0x94, 0x5d, 0x9c, 0xb1, 0x51, 0x08, 0x27, 0x98, 0xa0, - 0xab, 0x30, 0xc2, 0xfa, 0xbc, 0xdd, 0xe2, 0x4c, 0x4f, 0x74, 0x63, 0xca, 0x7c, 0x0e, 0x6a, 0x5a, - 0x11, 0x6c, 0x30, 0x40, 0xaf, 0x43, 0xa9, 0xe9, 0x6e, 0x90, 0xfa, 0x5e, 0xbd, 0x49, 0xa6, 0x47, - 0x18, 0xb7, 0xcc, 0xcd, 0x70, 0x45, 0x12, 0x71, 0xf9, 0x5c, 0xfd, 0xc5, 0x71, 0x71, 0x74, 0x1d, - 0x4e, 0x44, 0x24, 0xd8, 0x71, 0x3d, 0x87, 0x6e, 0x62, 0xe2, 0x4a, 0xc8, 0x6c, 0xf9, 0xa3, 0x6c, - 0x76, 0x9d, 0x11, 0xa3, 0x71, 0x62, 0x3d, 0x93, 0x0a, 0xe7, 0x94, 0x46, 0xb7, 0x61, 0x3a, 0x03, - 0xc3, 0xe7, 0xed, 0x31, 0xc6, 0xf9, 0x55, 0xc1, 0x79, 0x7a, 0x3d, 0x87, 0xee, 0xa0, 0x03, 0x0e, - 0xe7, 0x72, 0x47, 0x57, 0x61, 0x9c, 0xed, 0x9c, 0xd5, 0x76, 0xb3, 0x29, 0x2a, 0x1c, 0x63, 0x15, - 0x3e, 0x2e, 0xe5, 0x88, 0x8a, 0x89, 0x3e, 0xd8, 0x2f, 0x43, 0xfc, 0x0f, 0x27, 0x4b, 0xa3, 0x9b, - 0xcc, 0x6c, 0xdc, 0x0e, 0xdc, 0x68, 0x8f, 0xae, 0x2a, 0x72, 0x3b, 0x9a, 0x1e, 0xef, 0xa8, 0x42, - 0xd3, 0x49, 0x95, 0x6d, 0x59, 0x07, 0xe2, 0x24, 0x43, 0x7a, 0x14, 0x84, 0x51, 0xc3, 0xf5, 0xa6, - 0x27, 0xf8, 0x7d, 0x4a, 0xee, 0xa4, 0x35, 0x0a, 0xc4, 0x1c, 0xc7, 0x4c, 0xc6, 0xf4, 0xc7, 0x55, - 0x7a, 0xe2, 0x4e, 0x32, 0xc2, 0xd8, 0x64, 0x2c, 0x11, 0x38, 0xa6, 0xa1, 0x42, 0x70, 0x14, 0xed, - 0x4d, 0x23, 0x46, 0xaa, 0x36, 0xc4, 0xf5, 0xf5, 0x8f, 0x61, 0x0a, 0xb7, 0x6f, 0xc2, 0x98, 0xda, - 0x26, 0x58, 0x9f, 0xa0, 0x32, 0xf4, 0x33, 0xb1, 0x4f, 0x28, 0x7c, 0x4b, 0xb4, 0x09, 0x4c, 0x24, - 0xc4, 0x1c, 0xce, 0x9a, 0xe0, 0xde, 0x21, 0xf3, 0x7b, 0x11, 0xe1, 0xba, 0x88, 0xa2, 0xd6, 0x04, - 0x89, 0xc0, 0x31, 0x8d, 0xfd, 0x7f, 0xb9, 0xf8, 0x1c, 0x9f, 0x12, 0x3d, 0x9c, 0x8b, 0xcf, 0xc0, - 0xd0, 0x96, 0x1f, 0x46, 0x94, 0x9a, 0xd5, 0xd1, 0x1f, 0x0b, 0xcc, 0x97, 0x05, 0x1c, 0x2b, 0x0a, - 0xf4, 0x0a, 0x8c, 0xd6, 0xf5, 0x0a, 0xc4, 0xa1, 0xae, 0xb6, 0x11, 0xa3, 0x76, 0x6c, 0xd2, 0xa2, - 0x97, 0x60, 0x88, 0xb9, 0x41, 0xd5, 0xfd, 0xa6, 0x90, 0x36, 0xa5, 0x64, 0x32, 0x54, 0x15, 0xf0, - 0x03, 0xed, 0x37, 0x56, 0xd4, 0xe8, 0x1c, 0x0c, 0xd0, 0x26, 0x54, 0xaa, 0xe2, 0x38, 0x55, 0xba, - 0xcb, 0xcb, 0x0c, 0x8a, 0x05, 0xd6, 0xfe, 0x55, 0x8b, 0xc9, 0x52, 0xe9, 0x3d, 0x1f, 0x5d, 0x66, - 0x87, 0x06, 0x3b, 0x41, 0x34, 0xdd, 0xe1, 0x63, 0xda, 0x49, 0xa0, 0x70, 0x07, 0x89, 0xff, 0xd8, - 0x28, 0x89, 0xde, 0x4c, 0x9e, 0x0c, 0x5c, 0xa0, 0x78, 0x41, 0x76, 0x41, 0xf2, 0x74, 0x78, 0x38, - 0x3e, 0xe2, 0x68, 0x7b, 0x3a, 0x1d, 0x11, 0xf6, 0xdf, 0x28, 0x68, 0xb3, 0xa4, 0x16, 0x39, 0x11, - 0x41, 0x55, 0x18, 0xbc, 0xe5, 0xb8, 0x91, 0xeb, 0x6d, 0x0a, 0xb9, 0xaf, 0xf3, 0x41, 0xc7, 0x0a, - 0xdd, 0xe0, 0x05, 0xb8, 0xf4, 0x22, 0xfe, 0x60, 0xc9, 0x86, 0x72, 0x0c, 0xda, 0x9e, 0x47, 0x39, - 0x16, 0x7a, 0xe5, 0x88, 0x79, 0x01, 0xce, 0x51, 0xfc, 0xc1, 0x92, 0x0d, 0x7a, 0x0b, 0x40, 0xee, - 0x10, 0xa4, 0x21, 0x74, 0x87, 0xcf, 0x74, 0x67, 0xba, 0xae, 0xca, 0x70, 0xe5, 0x64, 0xfc, 0x1f, - 0x6b, 0xfc, 0xec, 0x48, 0x1b, 0x53, 0xbd, 0x31, 0xe8, 0xe3, 0x74, 0x89, 0x3a, 0x41, 0x44, 0x1a, - 0x73, 0x91, 0xe8, 0x9c, 0xa7, 0x7a, 0xbb, 0x1c, 0xae, 0xbb, 0x3b, 0x44, 0x5f, 0xce, 0x82, 0x09, - 0x8e, 0xf9, 0xd9, 0xbf, 0x58, 0x84, 0xe9, 0xbc, 0xe6, 0xd2, 0x45, 0x43, 0x6e, 0xbb, 0xd1, 0x02, - 0x15, 0x6b, 0x2d, 0x73, 0xd1, 0x2c, 0x09, 0x38, 0x56, 0x14, 0x74, 0xf6, 0x86, 0xee, 0xa6, 0xbc, - 0xdb, 0xf7, 0xc7, 0xb3, 0xb7, 0xc6, 0xa0, 0x58, 0x60, 0x29, 0x5d, 0x40, 0x9c, 0x50, 0xf8, 0xe7, - 0x69, 0xb3, 0x1c, 0x33, 0x28, 0x16, 0x58, 0x5d, 0xcb, 0xd8, 0xd7, 0x45, 0xcb, 0x68, 0x74, 0x51, - 0xff, 0xfd, 0xed, 0x22, 0xf4, 0x49, 0x80, 0x0d, 0xd7, 0x73, 0xc3, 0x2d, 0xc6, 0x7d, 0xe0, 0xd0, - 0xdc, 0x95, 0x50, 0xbc, 0xac, 0xb8, 0x60, 0x8d, 0x23, 0x7a, 0x11, 0x86, 0xd5, 0x06, 0x52, 0x59, - 0x64, 0xce, 0x0a, 0x9a, 0xf3, 0x57, 0xbc, 0x9b, 0x2e, 0x62, 0x9d, 0xce, 0xfe, 0x74, 0x72, 0xbe, - 0x88, 0x15, 0xa0, 0xf5, 0xaf, 0xd5, 0x6b, 0xff, 0x16, 0x3a, 0xf7, 0xaf, 0xfd, 0x8d, 0x01, 0x18, - 0x37, 0x2a, 0x6b, 0x87, 0x3d, 0xec, 0xb9, 0x97, 0xe8, 0x01, 0xe4, 0x44, 0x44, 0xac, 0x3f, 0xbb, - 0xfb, 0x52, 0xd1, 0x0f, 0x29, 0xba, 0x02, 0x78, 0x79, 0xf4, 0x49, 0x28, 0x35, 0x9d, 0x90, 0x69, - 0x2c, 0x89, 0x58, 0x77, 0xbd, 0x30, 0x8b, 0x2f, 0x84, 0x4e, 0x18, 0x69, 0xa7, 0x3e, 0xe7, 0x1d, - 0xb3, 0xa4, 0x27, 0x25, 0x95, 0xaf, 0xa4, 0x03, 0xa8, 0x6a, 0x04, 0x15, 0xc2, 0xf6, 0x30, 0xc7, - 0xa1, 0x97, 0xd8, 0xd6, 0x4a, 0x67, 0xc5, 0x02, 0x95, 0x46, 0xd9, 0x34, 0xeb, 0x37, 0x84, 0x6c, - 0x85, 0xc3, 0x06, 0x65, 0x7c, 0x27, 0x1b, 0xe8, 0x70, 0x27, 0x7b, 0x12, 0x06, 0xd9, 0x0f, 0x35, - 0x03, 0xd4, 0x68, 0x54, 0x38, 0x18, 0x4b, 0x7c, 0x72, 0xc2, 0x0c, 0xf5, 0x36, 0x61, 0xe8, 0xad, - 0x4f, 0x4c, 0x6a, 0xe6, 0x28, 0x32, 0xc4, 0x77, 0x39, 0x31, 0xe5, 0xb1, 0xc4, 0xa1, 0x9f, 0xb2, - 0x00, 0x39, 0x4d, 0x7a, 0x5b, 0xa6, 0x60, 0x75, 0xb9, 0x01, 0x26, 0x6a, 0xbf, 0xd2, 0xb5, 0xdb, - 0xdb, 0xe1, 0xec, 0x5c, 0xaa, 0x34, 0xd7, 0x94, 0xbe, 0x2c, 0x9a, 0x88, 0xd2, 0x04, 0xfa, 0x61, - 0xb4, 0xe2, 0x86, 0xd1, 0x67, 0xff, 0x28, 0x71, 0x38, 0x65, 0x34, 0x09, 0x5d, 0xd3, 0x2f, 0x5f, - 0xc3, 0x87, 0xbc, 0x7c, 0x8d, 0xe6, 0x5d, 0xbc, 0x66, 0xda, 0xf0, 0x50, 0xce, 0x17, 0x64, 0xe8, - 0x5f, 0x17, 0x75, 0xfd, 0x6b, 0x17, 0xad, 0xdd, 0xac, 0xac, 0x63, 0xf6, 0x8d, 0xb6, 0xe3, 0x45, - 0x6e, 0xb4, 0xa7, 0xeb, 0x6b, 0x9f, 0x82, 0xb1, 0x45, 0x87, 0xec, 0xf8, 0xde, 0x92, 0xd7, 0x68, - 0xf9, 0xae, 0x17, 0xa1, 0x69, 0xe8, 0x63, 0xc2, 0x07, 0xdf, 0x7a, 0xfb, 0x68, 0xef, 0x61, 0x06, - 0xb1, 0x37, 0xe1, 0xf8, 0xa2, 0x7f, 0xcb, 0xbb, 0xe5, 0x04, 0x8d, 0xb9, 0x6a, 0x45, 0xd3, 0x27, - 0xad, 0x49, 0x7d, 0x86, 0x95, 0x7f, 0x5b, 0xd4, 0x4a, 0xf2, 0xeb, 0xd0, 0xb2, 0xdb, 0x24, 0x39, - 0x5a, 0xbf, 0xbf, 0x5d, 0x30, 0x6a, 0x8a, 0xe9, 0x95, 0xcd, 0xca, 0xca, 0x35, 0xd0, 0xbf, 0x01, - 0x43, 0x1b, 0x2e, 0x69, 0x36, 0x30, 0xd9, 0x10, 0xbd, 0xf3, 0x44, 0xbe, 0x0b, 0xdf, 0x32, 0xa5, - 0x54, 0xc6, 0x35, 0xa6, 0x0d, 0x59, 0x16, 0x85, 0xb1, 0x62, 0x83, 0xb6, 0x61, 0x42, 0xf6, 0xa1, - 0xc4, 0x8a, 0xfd, 0xe0, 0xc9, 0x4e, 0x03, 0x6f, 0x32, 0x3f, 0x76, 0x77, 0xbf, 0x3c, 0x81, 0x13, - 0x6c, 0x70, 0x8a, 0x31, 0x3a, 0x05, 0x7d, 0x3b, 0xf4, 0xe4, 0xeb, 0x63, 0xdd, 0xcf, 0xd4, 0x1f, - 0x4c, 0x93, 0xc3, 0xa0, 0xf6, 0x8f, 0x5a, 0xf0, 0x50, 0xaa, 0x67, 0x84, 0x46, 0xeb, 0x3e, 0x8f, - 0x42, 0x52, 0xc3, 0x54, 0xe8, 0xae, 0x61, 0xb2, 0xff, 0xa1, 0x05, 0xc7, 0x96, 0x76, 0x5a, 0xd1, - 0xde, 0xa2, 0x6b, 0x5a, 0xd3, 0x3f, 0x08, 0x03, 0x3b, 0xa4, 0xe1, 0xb6, 0x77, 0xc4, 0xc8, 0x95, - 0xe5, 0xe9, 0xb0, 0xca, 0xa0, 0x07, 0xfb, 0xe5, 0xd1, 0x5a, 0xe4, 0x07, 0xce, 0x26, 0xe1, 0x00, - 0x2c, 0xc8, 0xd9, 0x19, 0xeb, 0xde, 0x21, 0x2b, 0xee, 0x8e, 0x1b, 0xdd, 0xdb, 0x6c, 0x17, 0x86, - 0x70, 0xc9, 0x04, 0xc7, 0xfc, 0xec, 0xaf, 0x5b, 0x30, 0x2e, 0xe7, 0xfd, 0x5c, 0xa3, 0x11, 0x90, - 0x30, 0x44, 0x33, 0x50, 0x70, 0x5b, 0xa2, 0x95, 0x20, 0x5a, 0x59, 0xa8, 0x54, 0x71, 0xc1, 0x6d, - 0x49, 0x71, 0x9e, 0x1d, 0x40, 0x45, 0xd3, 0x27, 0xe0, 0xb2, 0x80, 0x63, 0x45, 0x81, 0xce, 0xc3, - 0x90, 0xe7, 0x37, 0xb8, 0x44, 0x2c, 0x6c, 0xac, 0x94, 0x72, 0x4d, 0xc0, 0xb0, 0xc2, 0xa2, 0x2a, - 0x94, 0xb8, 0xc7, 0x68, 0x3c, 0x69, 0x7b, 0xf2, 0x3b, 0x65, 0x5f, 0xb6, 0x2e, 0x4b, 0xe2, 0x98, - 0x89, 0xfd, 0xeb, 0x16, 0x8c, 0xc8, 0x2f, 0xeb, 0xf1, 0xae, 0x42, 0x97, 0x56, 0x7c, 0x4f, 0x89, - 0x97, 0x16, 0xbd, 0x6b, 0x30, 0x8c, 0x71, 0xc5, 0x28, 0x1e, 0xea, 0x8a, 0x71, 0x11, 0x86, 0x9d, - 0x56, 0xab, 0x6a, 0xde, 0x4f, 0xd8, 0x54, 0x9a, 0x8b, 0xc1, 0x58, 0xa7, 0xb1, 0x7f, 0xa4, 0x00, - 0x63, 0xf2, 0x0b, 0x6a, 0xed, 0x9b, 0x21, 0x89, 0xd0, 0x3a, 0x94, 0x1c, 0x3e, 0x4a, 0x44, 0x4e, - 0xf2, 0x47, 0xb3, 0xf5, 0x66, 0xc6, 0x90, 0xc6, 0x82, 0xd6, 0x9c, 0x2c, 0x8d, 0x63, 0x46, 0xa8, - 0x09, 0x93, 0x9e, 0x1f, 0xb1, 0x43, 0x57, 0xe1, 0x3b, 0x99, 0x32, 0x93, 0xdc, 0x4f, 0x0a, 0xee, - 0x93, 0x6b, 0x49, 0x2e, 0x38, 0xcd, 0x18, 0x2d, 0x49, 0x5d, 0x64, 0x31, 0x5f, 0x89, 0xa4, 0x0f, - 0x5c, 0xb6, 0x2a, 0xd2, 0xfe, 0x15, 0x0b, 0x4a, 0x92, 0xec, 0x28, 0xac, 0xd6, 0xab, 0x30, 0x18, - 0xb2, 0x41, 0x90, 0x5d, 0x63, 0x77, 0x6a, 0x38, 0x1f, 0xaf, 0x58, 0x96, 0xe0, 0xff, 0x43, 0x2c, - 0x79, 0x30, 0x53, 0x94, 0x6a, 0xfe, 0xbb, 0xc4, 0x14, 0xa5, 0xda, 0x93, 0x73, 0x28, 0xfd, 0x09, - 0x6b, 0xb3, 0xa6, 0xdb, 0xa5, 0x22, 0x6f, 0x2b, 0x20, 0x1b, 0xee, 0xed, 0xa4, 0xc8, 0x5b, 0x65, - 0x50, 0x2c, 0xb0, 0xe8, 0x2d, 0x18, 0xa9, 0x4b, 0x1b, 0x44, 0xbc, 0xc2, 0xcf, 0x75, 0xb4, 0x87, - 0x29, 0xd3, 0x29, 0xd7, 0xa1, 0x2d, 0x68, 0xe5, 0xb1, 0xc1, 0xcd, 0xf4, 0x88, 0x2a, 0x76, 0xf3, - 0x88, 0x8a, 0xf9, 0xe6, 0xfb, 0x07, 0xfd, 0x98, 0x05, 0x03, 0x5c, 0xf7, 0xdc, 0x9b, 0xea, 0x5f, - 0xb3, 0x24, 0xc7, 0x7d, 0x77, 0x9d, 0x02, 0x85, 0xa4, 0x81, 0x56, 0xa1, 0xc4, 0x7e, 0x30, 0xdd, - 0x79, 0x31, 0xff, 0xc1, 0x12, 0xaf, 0x55, 0x6f, 0xe0, 0x75, 0x59, 0x0c, 0xc7, 0x1c, 0xec, 0x1f, - 0x2e, 0xd2, 0xdd, 0x2d, 0x26, 0x35, 0x0e, 0x7d, 0xeb, 0xc1, 0x1d, 0xfa, 0x85, 0x07, 0x75, 0xe8, - 0x6f, 0xc2, 0x78, 0x5d, 0xb3, 0x3b, 0xc7, 0x23, 0x79, 0xbe, 0xe3, 0x24, 0xd1, 0x4c, 0xd4, 0x5c, - 0x3b, 0xb7, 0x60, 0x32, 0xc1, 0x49, 0xae, 0xe8, 0xe3, 0x30, 0xc2, 0xc7, 0x59, 0xd4, 0xc2, 0x9d, - 0xca, 0x1e, 0xcf, 0x9f, 0x2f, 0x7a, 0x15, 0x5c, 0x9b, 0xab, 0x15, 0xc7, 0x06, 0x33, 0xfb, 0x2f, - 0x2c, 0x40, 0x4b, 0xad, 0x2d, 0xb2, 0x43, 0x02, 0xa7, 0x19, 0x9b, 0x8f, 0xbe, 0x60, 0xc1, 0x34, - 0x49, 0x81, 0x17, 0xfc, 0x9d, 0x1d, 0x71, 0x59, 0xcc, 0xd1, 0x67, 0x2c, 0xe5, 0x94, 0x51, 0x2f, - 0xba, 0xa6, 0xf3, 0x28, 0x70, 0x6e, 0x7d, 0x68, 0x15, 0xa6, 0xf8, 0x29, 0xa9, 0x10, 0x9a, 0x17, - 0xd7, 0xc3, 0x82, 0xf1, 0xd4, 0x7a, 0x9a, 0x04, 0x67, 0x95, 0xb3, 0x7f, 0x65, 0x14, 0x72, 0x5b, - 0xf1, 0x9e, 0xdd, 0xec, 0x3d, 0xbb, 0xd9, 0x7b, 0x76, 0xb3, 0xf7, 0xec, 0x66, 0xef, 0xd9, 0xcd, - 0xde, 0xb3, 0x9b, 0xbd, 0x4b, 0xed, 0x66, 0x7f, 0xd3, 0x82, 0xe3, 0xea, 0xf8, 0x32, 0x2e, 0xec, - 0x9f, 0x81, 0x29, 0xbe, 0xdc, 0x0c, 0x67, 0x6c, 0x71, 0x5c, 0x5f, 0xcc, 0x9c, 0xb9, 0x89, 0x47, - 0x03, 0x46, 0x41, 0xfe, 0xfa, 0x2a, 0x03, 0x81, 0xb3, 0xaa, 0xb1, 0x7f, 0x71, 0x08, 0xfa, 0x97, - 0x76, 0x89, 0x17, 0x1d, 0xc1, 0xd5, 0xa6, 0x0e, 0x63, 0xae, 0xb7, 0xeb, 0x37, 0x77, 0x49, 0x83, - 0xe3, 0x0f, 0x73, 0x03, 0x3f, 0x21, 0x58, 0x8f, 0x55, 0x0c, 0x16, 0x38, 0xc1, 0xf2, 0x41, 0x58, - 0x1f, 0x2e, 0xc1, 0x00, 0x3f, 0x7c, 0x84, 0xe9, 0x21, 0x73, 0xcf, 0x66, 0x9d, 0x28, 0x8e, 0xd4, - 0xd8, 0x32, 0xc2, 0x0f, 0x37, 0x51, 0x1c, 0x7d, 0x1a, 0xc6, 0x36, 0xdc, 0x20, 0x8c, 0xd6, 0xdd, - 0x1d, 0x7a, 0x34, 0xec, 0xb4, 0xee, 0xc1, 0xda, 0xa0, 0xfa, 0x61, 0xd9, 0xe0, 0x84, 0x13, 0x9c, - 0xd1, 0x26, 0x8c, 0x36, 0x1d, 0xbd, 0xaa, 0xc1, 0x43, 0x57, 0xa5, 0x4e, 0x87, 0x15, 0x9d, 0x11, - 0x36, 0xf9, 0xd2, 0xe5, 0x54, 0x67, 0x0a, 0xf3, 0x21, 0xa6, 0xce, 0x50, 0xcb, 0x89, 0x6b, 0xca, - 0x39, 0x8e, 0x0a, 0x68, 0xcc, 0x91, 0xbd, 0x64, 0x0a, 0x68, 0x9a, 0xbb, 0xfa, 0xa7, 0xa0, 0x44, - 0x68, 0x17, 0x52, 0xc6, 0xe2, 0x80, 0xb9, 0xd0, 0x5b, 0x5b, 0x57, 0xdd, 0x7a, 0xe0, 0x9b, 0x76, - 0x9e, 0x25, 0xc9, 0x09, 0xc7, 0x4c, 0xd1, 0x02, 0x0c, 0x84, 0x24, 0x70, 0x95, 0x2e, 0xb9, 0xc3, - 0x30, 0x32, 0x32, 0xfe, 0xbc, 0x8f, 0xff, 0xc6, 0xa2, 0x28, 0x9d, 0x5e, 0x0e, 0x53, 0xc5, 0xb2, - 0xc3, 0x40, 0x9b, 0x5e, 0x73, 0x0c, 0x8a, 0x05, 0x16, 0xbd, 0x0e, 0x83, 0x01, 0x69, 0x32, 0x43, - 0xe2, 0x68, 0xef, 0x93, 0x9c, 0xdb, 0x25, 0x79, 0x39, 0x2c, 0x19, 0xa0, 0x2b, 0x80, 0x02, 0x42, - 0x05, 0x3c, 0xd7, 0xdb, 0x54, 0xee, 0xdd, 0x62, 0xa3, 0x55, 0x82, 0x34, 0x8e, 0x29, 0xe4, 0xcb, - 0x4e, 0x9c, 0x51, 0x0c, 0x5d, 0x82, 0x49, 0x05, 0xad, 0x78, 0x61, 0xe4, 0xd0, 0x0d, 0x6e, 0x9c, - 0xf1, 0x52, 0xfa, 0x15, 0x9c, 0x24, 0xc0, 0xe9, 0x32, 0xf6, 0xcf, 0x58, 0xc0, 0xfb, 0xf9, 0x08, - 0xb4, 0x0a, 0xaf, 0x99, 0x5a, 0x85, 0x93, 0xb9, 0x23, 0x97, 0xa3, 0x51, 0xf8, 0x19, 0x0b, 0x86, - 0xb5, 0x91, 0x8d, 0xe7, 0xac, 0xd5, 0x61, 0xce, 0xb6, 0x61, 0x82, 0xce, 0xf4, 0xab, 0x37, 0x43, - 0x12, 0xec, 0x92, 0x06, 0x9b, 0x98, 0x85, 0x7b, 0x9b, 0x98, 0xca, 0x95, 0x74, 0x25, 0xc1, 0x10, - 0xa7, 0xaa, 0xb0, 0x3f, 0x25, 0x9b, 0xaa, 0x3c, 0x6f, 0xeb, 0x6a, 0xcc, 0x13, 0x9e, 0xb7, 0x6a, - 0x54, 0x71, 0x4c, 0x43, 0x97, 0xda, 0x96, 0x1f, 0x46, 0x49, 0xcf, 0xdb, 0xcb, 0x7e, 0x18, 0x61, - 0x86, 0xb1, 0x9f, 0x07, 0x58, 0xba, 0x4d, 0xea, 0x7c, 0xc6, 0xea, 0x97, 0x1e, 0x2b, 0xff, 0xd2, - 0x63, 0xff, 0x9e, 0x05, 0x63, 0xcb, 0x0b, 0xc6, 0xc9, 0x35, 0x0b, 0xc0, 0x6f, 0x6a, 0x37, 0x6e, - 0xac, 0x49, 0xf7, 0x0f, 0x6e, 0x01, 0x57, 0x50, 0xac, 0x51, 0xa0, 0x93, 0x50, 0x6c, 0xb6, 0x3d, - 0xa1, 0xf6, 0x1c, 0xa4, 0xc7, 0xe3, 0x4a, 0xdb, 0xc3, 0x14, 0xa6, 0xbd, 0xea, 0x2a, 0xf6, 0xfc, - 0xaa, 0xab, 0x6b, 0x34, 0x17, 0x54, 0x86, 0xfe, 0x5b, 0xb7, 0xdc, 0x06, 0x7f, 0x33, 0x2f, 0x5c, - 0x53, 0x6e, 0xdc, 0xa8, 0x2c, 0x86, 0x98, 0xc3, 0xed, 0x2f, 0x16, 0x61, 0x66, 0xb9, 0x49, 0x6e, - 0xbf, 0xc3, 0xb8, 0x01, 0xbd, 0xbe, 0x49, 0x3b, 0x9c, 0x02, 0xe9, 0xb0, 0xef, 0x0e, 0xbb, 0xf7, - 0xc7, 0x06, 0x0c, 0x72, 0xc7, 0x53, 0x19, 0x45, 0x20, 0xd3, 0xdc, 0x97, 0xdf, 0x21, 0xb3, 0xdc, - 0x81, 0x55, 0x98, 0xfb, 0xd4, 0x81, 0x29, 0xa0, 0x58, 0x32, 0x9f, 0x79, 0x19, 0x46, 0x74, 0xca, - 0x43, 0xbd, 0x00, 0xfe, 0x9e, 0x22, 0x4c, 0xd0, 0x16, 0x3c, 0xd0, 0x81, 0xb8, 0x96, 0x1e, 0x88, - 0xfb, 0xfd, 0x0a, 0xb4, 0xfb, 0x68, 0xbc, 0x95, 0x1c, 0x8d, 0x8b, 0x79, 0xa3, 0x71, 0xd4, 0x63, - 0xf0, 0xbd, 0x16, 0x4c, 0x2d, 0x37, 0xfd, 0xfa, 0x76, 0xe2, 0xa5, 0xe6, 0x8b, 0x30, 0x4c, 0xb7, - 0xe3, 0xd0, 0x08, 0x5a, 0x62, 0x84, 0xb1, 0x11, 0x28, 0xac, 0xd3, 0x69, 0xc5, 0xae, 0x5d, 0xab, - 0x2c, 0x66, 0x45, 0xbf, 0x11, 0x28, 0xac, 0xd3, 0xd9, 0xbf, 0x63, 0xc1, 0xe9, 0x4b, 0x0b, 0x4b, - 0xf1, 0x54, 0x4c, 0x05, 0xe0, 0x39, 0x07, 0x03, 0xad, 0x86, 0xd6, 0x94, 0x58, 0x2d, 0xbc, 0xc8, - 0x5a, 0x21, 0xb0, 0xef, 0x96, 0xe0, 0x52, 0xd7, 0x00, 0x2e, 0xe1, 0xea, 0x82, 0xd8, 0x77, 0xa5, - 0x15, 0xc8, 0xca, 0xb5, 0x02, 0x3d, 0x0e, 0x83, 0xf4, 0x5c, 0x70, 0xeb, 0xb2, 0xdd, 0xdc, 0xa0, - 0xcf, 0x41, 0x58, 0xe2, 0xec, 0x9f, 0xb6, 0x60, 0xea, 0x92, 0x1b, 0xd1, 0x43, 0x3b, 0x19, 0x61, - 0x86, 0x9e, 0xda, 0xa1, 0x1b, 0xf9, 0xc1, 0x5e, 0x32, 0xc2, 0x0c, 0x56, 0x18, 0xac, 0x51, 0xf1, - 0x0f, 0xda, 0x75, 0xd9, 0x4b, 0x8a, 0x82, 0x69, 0x77, 0xc3, 0x02, 0x8e, 0x15, 0x05, 0xed, 0xaf, - 0x86, 0x1b, 0x30, 0x95, 0xe5, 0x9e, 0xd8, 0xb8, 0x55, 0x7f, 0x2d, 0x4a, 0x04, 0x8e, 0x69, 0xec, - 0x3f, 0xb3, 0xa0, 0x7c, 0x89, 0xbf, 0x07, 0xdd, 0x08, 0x73, 0x36, 0xdd, 0xe7, 0xa1, 0x44, 0xa4, - 0x81, 0x40, 0xbe, 0x8d, 0x95, 0x82, 0xa8, 0xb2, 0x1c, 0xf0, 0x40, 0x37, 0x8a, 0xae, 0x87, 0xe7, - 0xe4, 0x87, 0x7b, 0x0f, 0xbc, 0x0c, 0x88, 0xe8, 0x75, 0xe9, 0x91, 0x7f, 0x58, 0x08, 0x91, 0xa5, - 0x14, 0x16, 0x67, 0x94, 0xb0, 0x7f, 0xd4, 0x82, 0xe3, 0xea, 0x83, 0xdf, 0x75, 0x9f, 0x69, 0x7f, - 0xb5, 0x00, 0xa3, 0x97, 0xd7, 0xd7, 0xab, 0x97, 0x48, 0xa4, 0xcd, 0xca, 0xce, 0x66, 0x7f, 0xac, - 0x59, 0x2f, 0x3b, 0xdd, 0x11, 0xdb, 0x91, 0xdb, 0x9c, 0xe5, 0x01, 0xe4, 0x66, 0x2b, 0x5e, 0x74, - 0x35, 0xa8, 0x45, 0x81, 0xeb, 0x6d, 0x66, 0xce, 0x74, 0x29, 0xb3, 0x14, 0xf3, 0x64, 0x16, 0xf4, - 0x3c, 0x0c, 0xb0, 0x08, 0x76, 0x72, 0x10, 0x1e, 0x56, 0x57, 0x2c, 0x06, 0x3d, 0xd8, 0x2f, 0x97, - 0xae, 0xe1, 0x0a, 0xff, 0x83, 0x05, 0x29, 0xba, 0x06, 0xc3, 0x5b, 0x51, 0xd4, 0xba, 0x4c, 0x9c, - 0x06, 0x09, 0xe4, 0x2e, 0x7b, 0x26, 0x6b, 0x97, 0xa5, 0x9d, 0xc0, 0xc9, 0xe2, 0x8d, 0x29, 0x86, - 0x85, 0x58, 0xe7, 0x63, 0xd7, 0x00, 0x62, 0xdc, 0x7d, 0x32, 0xdc, 0xd8, 0xeb, 0x50, 0xa2, 0x9f, - 0x3b, 0xd7, 0x74, 0x9d, 0xce, 0xa6, 0xf1, 0xa7, 0xa1, 0x24, 0x0d, 0xdf, 0xa1, 0x08, 0x77, 0xc1, - 0x4e, 0x24, 0x69, 0x17, 0x0f, 0x71, 0x8c, 0xb7, 0x1f, 0x03, 0xe1, 0x5b, 0xda, 0x89, 0xa5, 0xbd, - 0x01, 0xc7, 0x98, 0x93, 0xac, 0x13, 0x6d, 0x19, 0x73, 0xb4, 0xfb, 0x64, 0x78, 0x46, 0xdc, 0xeb, - 0xf8, 0x97, 0x4d, 0x6b, 0x8f, 0x93, 0x47, 0x24, 0xc7, 0xf8, 0x8e, 0x67, 0xff, 0x69, 0x1f, 0x3c, - 0x5c, 0xa9, 0xe5, 0xc7, 0x69, 0x7a, 0x09, 0x46, 0xb8, 0xb8, 0x48, 0xa7, 0x86, 0xd3, 0x14, 0xf5, - 0x2a, 0x0d, 0xe8, 0xba, 0x86, 0xc3, 0x06, 0x25, 0x3a, 0x0d, 0x45, 0xf7, 0x6d, 0x2f, 0xf9, 0x74, - 0xaf, 0xf2, 0xc6, 0x1a, 0xa6, 0x70, 0x8a, 0xa6, 0x92, 0x27, 0xdf, 0xd2, 0x15, 0x5a, 0x49, 0x9f, - 0xaf, 0xc1, 0x98, 0x1b, 0xd6, 0x43, 0xb7, 0xe2, 0xd1, 0x75, 0xaa, 0xad, 0x74, 0xa5, 0x73, 0xa0, - 0x8d, 0x56, 0x58, 0x9c, 0xa0, 0xd6, 0xce, 0x97, 0xfe, 0x9e, 0xa5, 0xd7, 0xae, 0x51, 0x22, 0xe8, - 0xf6, 0xdf, 0x62, 0x5f, 0x17, 0x32, 0x15, 0xbc, 0xd8, 0xfe, 0xf9, 0x07, 0x87, 0x58, 0xe2, 0xe8, - 0x85, 0xae, 0xbe, 0xe5, 0xb4, 0xe6, 0xda, 0xd1, 0xd6, 0xa2, 0x1b, 0xd6, 0xfd, 0x5d, 0x12, 0xec, - 0xb1, 0xbb, 0xf8, 0x50, 0x7c, 0xa1, 0x53, 0x88, 0x85, 0xcb, 0x73, 0x55, 0x4a, 0x89, 0xd3, 0x65, - 0xd0, 0x1c, 0x8c, 0x4b, 0x60, 0x8d, 0x84, 0xec, 0x08, 0x18, 0x66, 0x6c, 0xd4, 0x63, 0x3a, 0x01, - 0x56, 0x4c, 0x92, 0xf4, 0xa6, 0x80, 0x0b, 0xf7, 0x43, 0xc0, 0xfd, 0x20, 0x8c, 0xba, 0x9e, 0x1b, - 0xb9, 0x4e, 0xe4, 0x73, 0xfb, 0x11, 0xbf, 0x76, 0x33, 0x05, 0x73, 0x45, 0x47, 0x60, 0x93, 0xce, - 0xfe, 0x2f, 0x7d, 0x30, 0xc9, 0x86, 0xed, 0xbd, 0x19, 0xf6, 0xed, 0x34, 0xc3, 0xae, 0xa5, 0x67, - 0xd8, 0xfd, 0x90, 0xdc, 0xef, 0x79, 0x9a, 0x7d, 0x1a, 0x4a, 0xea, 0xfd, 0xa0, 0x7c, 0x40, 0x6c, - 0xe5, 0x3c, 0x20, 0xee, 0x7e, 0x7a, 0x4b, 0x97, 0xb4, 0x62, 0xa6, 0x4b, 0xda, 0x97, 0x2d, 0x88, - 0x0d, 0x0b, 0xe8, 0x0d, 0x28, 0xb5, 0x7c, 0xe6, 0xe1, 0x1a, 0x48, 0xb7, 0xf1, 0xc7, 0x3a, 0x5a, - 0x26, 0x78, 0xa8, 0xba, 0x80, 0xf7, 0x42, 0x55, 0x16, 0xc5, 0x31, 0x17, 0x74, 0x05, 0x06, 0x5b, - 0x01, 0xa9, 0x45, 0x2c, 0x8e, 0x52, 0xef, 0x0c, 0xf9, 0xac, 0xe1, 0x05, 0xb1, 0xe4, 0x60, 0xff, - 0x5c, 0x01, 0x26, 0x92, 0xa4, 0xe8, 0x55, 0xe8, 0x23, 0xb7, 0x49, 0x5d, 0xb4, 0x37, 0xf3, 0x28, - 0x8e, 0x55, 0x13, 0xbc, 0x03, 0xe8, 0x7f, 0xcc, 0x4a, 0xa1, 0xcb, 0x30, 0x48, 0xcf, 0xe1, 0x4b, - 0x2a, 0x66, 0xe0, 0x23, 0x79, 0x67, 0xb9, 0x12, 0x68, 0x78, 0xe3, 0x04, 0x08, 0xcb, 0xe2, 0xcc, - 0x0f, 0xac, 0xde, 0xaa, 0xd1, 0x2b, 0x4e, 0xd4, 0xe9, 0x26, 0xbe, 0xbe, 0x50, 0xe5, 0x44, 0x82, - 0x1b, 0xf7, 0x03, 0x93, 0x40, 0x1c, 0x33, 0x41, 0x1f, 0x81, 0xfe, 0xb0, 0x49, 0x48, 0x4b, 0x18, - 0xfa, 0x33, 0x95, 0x8b, 0x35, 0x4a, 0x20, 0x38, 0x31, 0x65, 0x04, 0x03, 0x60, 0x5e, 0xd0, 0xfe, - 0x79, 0x0b, 0x80, 0x3b, 0xce, 0x39, 0xde, 0x26, 0x39, 0x02, 0x7d, 0xfc, 0x22, 0xf4, 0x85, 0x2d, - 0x52, 0xef, 0xe4, 0xbe, 0x1d, 0xb7, 0xa7, 0xd6, 0x22, 0xf5, 0x78, 0xce, 0xd2, 0x7f, 0x98, 0x95, - 0xb6, 0xbf, 0x0f, 0x60, 0x2c, 0x26, 0xab, 0x44, 0x64, 0x07, 0x3d, 0x6b, 0x84, 0x2d, 0x39, 0x99, - 0x08, 0x5b, 0x52, 0x62, 0xd4, 0x9a, 0xea, 0xf7, 0xd3, 0x50, 0xdc, 0x71, 0x6e, 0x0b, 0xdd, 0xde, - 0xd3, 0x9d, 0x9b, 0x41, 0xf9, 0xcf, 0xae, 0x3a, 0xb7, 0xf9, 0xf5, 0xf7, 0x69, 0xb9, 0xc6, 0x56, - 0x9d, 0xdb, 0x5d, 0x5d, 0x8c, 0x69, 0x25, 0xac, 0x2e, 0xd7, 0x13, 0x3e, 0x61, 0x3d, 0xd5, 0xe5, - 0x7a, 0xc9, 0xba, 0x5c, 0xaf, 0x87, 0xba, 0x5c, 0x0f, 0xdd, 0x81, 0x41, 0xe1, 0xb2, 0x29, 0x22, - 0xc0, 0x5d, 0xe8, 0xa1, 0x3e, 0xe1, 0xf1, 0xc9, 0xeb, 0xbc, 0x20, 0xaf, 0xf7, 0x02, 0xda, 0xb5, - 0x5e, 0x59, 0x21, 0xfa, 0x5b, 0x16, 0x8c, 0x89, 0xdf, 0x98, 0xbc, 0xdd, 0x26, 0x61, 0x24, 0xc4, - 0xdf, 0x0f, 0xf4, 0xde, 0x06, 0x51, 0x90, 0x37, 0xe5, 0x03, 0xf2, 0xa4, 0x32, 0x91, 0x5d, 0x5b, - 0x94, 0x68, 0x05, 0xfa, 0x39, 0x0b, 0x8e, 0xed, 0x38, 0xb7, 0x79, 0x8d, 0x1c, 0x86, 0x9d, 0xc8, - 0xf5, 0x85, 0xeb, 0xc3, 0xab, 0xbd, 0x0d, 0x7f, 0xaa, 0x38, 0x6f, 0xa4, 0xb4, 0x73, 0x1e, 0xcb, - 0x22, 0xe9, 0xda, 0xd4, 0xcc, 0x76, 0xcd, 0x6c, 0xc0, 0x90, 0x9c, 0x6f, 0x0f, 0xd2, 0x3f, 0x9c, - 0xd5, 0x23, 0xe6, 0xda, 0x03, 0xad, 0xe7, 0xd3, 0x30, 0xa2, 0xcf, 0xb1, 0x07, 0x5a, 0xd7, 0xdb, - 0x30, 0x95, 0x31, 0x97, 0x1e, 0x68, 0x95, 0xb7, 0xe0, 0x64, 0xee, 0xfc, 0x78, 0xa0, 0xfe, 0xfd, - 0x5f, 0xb5, 0xf4, 0x7d, 0xf0, 0x08, 0x8c, 0x22, 0x0b, 0xa6, 0x51, 0xe4, 0x4c, 0xe7, 0x95, 0x93, - 0x63, 0x19, 0x79, 0x4b, 0x6f, 0x34, 0xdd, 0xd5, 0xd1, 0xeb, 0x30, 0xd0, 0xa4, 0x10, 0xe9, 0xf8, - 0x6b, 0x77, 0x5f, 0x91, 0xb1, 0x38, 0xca, 0xe0, 0x21, 0x16, 0x1c, 0xec, 0x5f, 0xb2, 0xa0, 0xef, - 0x08, 0x7a, 0x02, 0x9b, 0x3d, 0xf1, 0x6c, 0x2e, 0x6b, 0x11, 0x0c, 0x7f, 0x16, 0x3b, 0xb7, 0x96, - 0x6e, 0x47, 0xc4, 0x0b, 0xd9, 0x99, 0x9e, 0xd9, 0x31, 0xfb, 0x16, 0x4c, 0xad, 0xf8, 0x4e, 0x63, - 0xde, 0x69, 0x3a, 0x5e, 0x9d, 0x04, 0x15, 0x6f, 0xf3, 0x50, 0x5e, 0xeb, 0x85, 0xae, 0x5e, 0xeb, - 0x2f, 0xc1, 0x80, 0xdb, 0xd2, 0x82, 0x7b, 0x9f, 0xa5, 0x1d, 0x58, 0xa9, 0x8a, 0xb8, 0xde, 0xc8, - 0xa8, 0x9c, 0x41, 0xb1, 0xa0, 0xa7, 0x23, 0xcf, 0xdd, 0xc5, 0xfa, 0xf2, 0x47, 0x9e, 0x4a, 0xf1, - 0xc9, 0x10, 0x50, 0x86, 0x63, 0xf3, 0x16, 0x18, 0x55, 0x88, 0x57, 0x5f, 0x18, 0x06, 0x5d, 0xfe, - 0xa5, 0x62, 0xf8, 0x9f, 0xc8, 0x96, 0xae, 0x53, 0x1d, 0xa3, 0xbd, 0x67, 0xe2, 0x00, 0x2c, 0x19, - 0xd9, 0x2f, 0x41, 0x66, 0xc8, 0x8e, 0xee, 0x9a, 0x13, 0xfb, 0x63, 0x30, 0xc9, 0x4a, 0x1e, 0x52, - 0x2b, 0x61, 0x27, 0xf4, 0xbd, 0x19, 0x71, 0x5a, 0xed, 0xff, 0x68, 0x01, 0x5a, 0xf5, 0x1b, 0xee, - 0xc6, 0x9e, 0x60, 0xce, 0xbf, 0xff, 0x6d, 0x28, 0xf3, 0x6b, 0x5f, 0x32, 0x96, 0xe9, 0x42, 0xd3, - 0x09, 0x43, 0x4d, 0xd7, 0xfc, 0x84, 0xa8, 0xb7, 0xbc, 0xde, 0x99, 0x1c, 0x77, 0xe3, 0x87, 0xde, - 0x48, 0x04, 0x6a, 0xfb, 0x50, 0x2a, 0x50, 0xdb, 0x13, 0x99, 0x1e, 0x1f, 0xe9, 0xd6, 0xcb, 0x00, - 0x6e, 0xf6, 0xe7, 0x2d, 0x18, 0x5f, 0x4b, 0xc4, 0xe6, 0x3c, 0xc7, 0xcc, 0xdf, 0x19, 0x36, 0x94, - 0x1a, 0x83, 0x62, 0x81, 0xbd, 0xef, 0x3a, 0xc6, 0xbf, 0xb2, 0x20, 0x0e, 0x11, 0x74, 0x04, 0x52, - 0xed, 0x82, 0x21, 0xd5, 0x66, 0xde, 0x10, 0x54, 0x73, 0xf2, 0x84, 0x5a, 0x74, 0x45, 0x8d, 0x49, - 0x87, 0xcb, 0x41, 0xcc, 0x86, 0xaf, 0xb3, 0x31, 0x73, 0xe0, 0xd4, 0x68, 0xfc, 0x7e, 0x01, 0x90, - 0xa2, 0xed, 0x39, 0xb8, 0x5f, 0xba, 0xc4, 0xfd, 0x09, 0xee, 0xb7, 0x0b, 0x88, 0x39, 0x70, 0x04, - 0x8e, 0x17, 0x72, 0xb6, 0xae, 0xd0, 0xaa, 0x1e, 0xce, 0x3b, 0x64, 0x46, 0xbe, 0xf6, 0x5b, 0x49, - 0x71, 0xc3, 0x19, 0x35, 0x68, 0x8e, 0x39, 0xfd, 0xbd, 0x3a, 0xe6, 0x0c, 0x74, 0x79, 0xb6, 0xfa, - 0x15, 0x0b, 0x46, 0x55, 0x37, 0xbd, 0x4b, 0x1e, 0x37, 0xa8, 0xf6, 0xe4, 0x9c, 0x2b, 0x55, 0xad, - 0xc9, 0xec, 0xbc, 0xfd, 0x0e, 0xf6, 0xfc, 0xd8, 0x69, 0xba, 0x77, 0x88, 0x8a, 0x9a, 0x5b, 0x16, - 0xcf, 0x89, 0x05, 0xf4, 0x60, 0xbf, 0x3c, 0xaa, 0xfe, 0xf1, 0xa8, 0x97, 0x71, 0x11, 0xfb, 0x27, - 0xe8, 0x62, 0x37, 0xa7, 0x22, 0x7a, 0x11, 0xfa, 0x5b, 0x5b, 0x4e, 0x48, 0x12, 0x8f, 0xc0, 0xfa, - 0xab, 0x14, 0x78, 0xb0, 0x5f, 0x1e, 0x53, 0x05, 0x18, 0x04, 0x73, 0xea, 0xde, 0x43, 0x26, 0xa6, - 0x27, 0x67, 0xd7, 0x90, 0x89, 0x7f, 0x61, 0x41, 0xdf, 0x1a, 0x3d, 0xbd, 0x1e, 0xfc, 0x16, 0xf0, - 0x9a, 0xb1, 0x05, 0x9c, 0xca, 0x4b, 0xd8, 0x92, 0xbb, 0xfa, 0x97, 0x13, 0xab, 0xff, 0x4c, 0x2e, - 0x87, 0xce, 0x0b, 0x7f, 0x07, 0x86, 0x59, 0x1a, 0x18, 0xf1, 0xe0, 0xed, 0x79, 0x63, 0xc1, 0x97, - 0x13, 0x0b, 0x7e, 0x5c, 0x23, 0xd5, 0x56, 0xfa, 0x93, 0x30, 0x28, 0x5e, 0x50, 0x25, 0x5f, 0x71, - 0x0b, 0x5a, 0x2c, 0xf1, 0xf6, 0x8f, 0x15, 0xc1, 0x48, 0x3b, 0x83, 0x7e, 0xc5, 0x82, 0xd9, 0x80, - 0x7b, 0x56, 0x37, 0x16, 0xdb, 0x81, 0xeb, 0x6d, 0xd6, 0xea, 0x5b, 0xa4, 0xd1, 0x6e, 0xba, 0xde, - 0x66, 0x65, 0xd3, 0xf3, 0x15, 0x78, 0xe9, 0x36, 0xa9, 0xb7, 0x99, 0xd5, 0xb3, 0x4b, 0x8e, 0x1b, - 0xf5, 0x42, 0xe1, 0xb9, 0xbb, 0xfb, 0xe5, 0x59, 0x7c, 0x28, 0xde, 0xf8, 0x90, 0x6d, 0x41, 0xbf, - 0x63, 0xc1, 0x05, 0x9e, 0x8d, 0xa5, 0xf7, 0xf6, 0x77, 0x50, 0x22, 0x54, 0x25, 0xab, 0x98, 0xc9, - 0x3a, 0x09, 0x76, 0xe6, 0x3f, 0x28, 0x3a, 0xf4, 0x42, 0xf5, 0x70, 0x75, 0xe1, 0xc3, 0x36, 0xce, - 0xfe, 0xe7, 0x45, 0x18, 0x15, 0xa1, 0xf5, 0xc4, 0x19, 0xf0, 0xa2, 0x31, 0x25, 0x1e, 0x49, 0x4c, - 0x89, 0x49, 0x83, 0xf8, 0xfe, 0x6c, 0xff, 0x21, 0x4c, 0xd2, 0xcd, 0xf9, 0x32, 0x71, 0x82, 0xe8, - 0x26, 0x71, 0xb8, 0xbf, 0x5d, 0xf1, 0xd0, 0xbb, 0xbf, 0x52, 0xfc, 0xae, 0x24, 0x99, 0xe1, 0x34, - 0xff, 0x6f, 0xa7, 0x33, 0xc7, 0x83, 0x89, 0x54, 0x74, 0xc4, 0x37, 0xa1, 0xa4, 0x9e, 0xff, 0x88, - 0x4d, 0xa7, 0x73, 0x90, 0xd1, 0x24, 0x07, 0xae, 0x57, 0x8c, 0x9f, 0x9e, 0xc5, 0xec, 0xec, 0x7f, - 0x5c, 0x30, 0x2a, 0xe4, 0x83, 0xb8, 0x06, 0x43, 0x4e, 0xc8, 0x02, 0x1f, 0x37, 0x3a, 0xa9, 0x7e, - 0x53, 0xd5, 0xb0, 0x27, 0x58, 0x73, 0xa2, 0x24, 0x56, 0x3c, 0xd0, 0x65, 0xee, 0xd5, 0xb8, 0x4b, - 0x3a, 0xe9, 0x7d, 0x53, 0xdc, 0x40, 0xfa, 0x3d, 0xee, 0x12, 0x2c, 0xca, 0xa3, 0x4f, 0x70, 0xb7, - 0xd3, 0x2b, 0x9e, 0x7f, 0xcb, 0xbb, 0xe4, 0xfb, 0x32, 0x8c, 0x4a, 0x6f, 0x0c, 0x27, 0xa5, 0xb3, - 0xa9, 0x2a, 0x8e, 0x4d, 0x6e, 0xbd, 0x85, 0x1b, 0xfe, 0x0c, 0xb0, 0xec, 0x13, 0xe6, 0x6b, 0xfb, - 0x10, 0x11, 0x18, 0x17, 0x71, 0x1b, 0x25, 0x4c, 0xf4, 0x5d, 0xe6, 0x0d, 0xd7, 0x2c, 0x1d, 0x5b, - 0x28, 0xae, 0x98, 0x2c, 0x70, 0x92, 0xa7, 0xfd, 0x53, 0x16, 0xb0, 0x97, 0xc7, 0x47, 0x20, 0x8f, - 0x7c, 0xd8, 0x94, 0x47, 0xa6, 0xf3, 0x3a, 0x39, 0x47, 0x14, 0x79, 0x81, 0xcf, 0xac, 0x6a, 0xe0, - 0xdf, 0xde, 0x13, 0xbe, 0x42, 0xdd, 0x2f, 0x57, 0xf6, 0x77, 0xf2, 0x43, 0x46, 0x45, 0x6c, 0xdd, - 0x81, 0x49, 0x4f, 0xfb, 0x4f, 0xb7, 0x54, 0x79, 0x77, 0x7c, 0xac, 0xdb, 0x31, 0xc2, 0xf6, 0x5f, - 0xed, 0x59, 0x6f, 0x82, 0x0d, 0x4e, 0x73, 0xb6, 0x7f, 0xdc, 0x82, 0x87, 0x74, 0x42, 0xed, 0xe5, - 0x50, 0x37, 0xfb, 0xcb, 0x22, 0x0c, 0xf9, 0x2d, 0x12, 0x38, 0x91, 0x1f, 0x88, 0x7d, 0xf3, 0xbc, - 0xec, 0xdc, 0xab, 0x02, 0x7e, 0x20, 0x72, 0x5e, 0x48, 0xee, 0x12, 0x8e, 0x55, 0x49, 0x7a, 0xb9, - 0x64, 0x4a, 0x9f, 0x50, 0xbc, 0x11, 0x63, 0xab, 0x80, 0x99, 0xf2, 0x43, 0x2c, 0x30, 0xf6, 0x9f, - 0x5a, 0xbc, 0x6b, 0xf5, 0xa6, 0xa3, 0xb7, 0x61, 0x62, 0xc7, 0x89, 0xea, 0x5b, 0x4b, 0xb7, 0x5b, - 0x01, 0xb7, 0x66, 0xc9, 0x7e, 0x7a, 0xba, 0x5b, 0x3f, 0x69, 0x1f, 0x19, 0xfb, 0x92, 0xae, 0x26, - 0x98, 0xe1, 0x14, 0x7b, 0x74, 0x13, 0x86, 0x19, 0x8c, 0x3d, 0x7f, 0x0c, 0x3b, 0x1d, 0x8e, 0x79, - 0xb5, 0x29, 0x6f, 0x88, 0xd5, 0x98, 0x0f, 0xd6, 0x99, 0xda, 0x5f, 0x2e, 0xf2, 0xf9, 0xce, 0x84, - 0xd9, 0x27, 0x61, 0xb0, 0xe5, 0x37, 0x16, 0x2a, 0x8b, 0x58, 0x8c, 0x82, 0xda, 0x48, 0xab, 0x1c, - 0x8c, 0x25, 0x1e, 0x9d, 0x87, 0x21, 0xf1, 0x53, 0x5a, 0x1f, 0xd9, 0xee, 0x24, 0xe8, 0x42, 0xac, - 0xb0, 0xe8, 0x39, 0x80, 0x56, 0xe0, 0xef, 0xba, 0x0d, 0x16, 0x0e, 0xa5, 0x68, 0x3a, 0x32, 0x55, - 0x15, 0x06, 0x6b, 0x54, 0xe8, 0x15, 0x18, 0x6d, 0x7b, 0x21, 0x3f, 0x90, 0xb5, 0xa0, 0xd3, 0xca, - 0xc5, 0xe6, 0x9a, 0x8e, 0xc4, 0x26, 0x2d, 0x9a, 0x83, 0x81, 0xc8, 0x61, 0x8e, 0x39, 0xfd, 0xf9, - 0xfe, 0xc6, 0xeb, 0x94, 0x42, 0x4f, 0x48, 0x45, 0x0b, 0x60, 0x51, 0x10, 0xbd, 0x29, 0x5f, 0x22, - 0xf3, 0xad, 0x4d, 0x38, 0xfa, 0xf7, 0xb6, 0x0d, 0x6a, 0xef, 0x90, 0xc5, 0x03, 0x02, 0x83, 0x17, - 0x7a, 0x19, 0x80, 0xdc, 0x8e, 0x48, 0xe0, 0x39, 0x4d, 0xe5, 0x4e, 0xa7, 0x4e, 0xc6, 0x45, 0x7f, - 0xcd, 0x8f, 0xae, 0x85, 0x64, 0x49, 0x51, 0x60, 0x8d, 0xda, 0xfe, 0x9d, 0x12, 0x40, 0x2c, 0xb9, - 0xa2, 0x3b, 0x30, 0x54, 0x77, 0x5a, 0x4e, 0x9d, 0xa7, 0x37, 0x2c, 0xe6, 0x3d, 0x10, 0x8d, 0x4b, - 0xcc, 0x2e, 0x08, 0x72, 0xae, 0x70, 0x97, 0x71, 0x7b, 0x87, 0x24, 0xb8, 0xab, 0x92, 0x5d, 0xd5, - 0x87, 0x3e, 0x67, 0xc1, 0xb0, 0x88, 0xfa, 0xc2, 0x46, 0xa8, 0x90, 0x6f, 0x23, 0xd1, 0xea, 0x9f, - 0x8b, 0x4b, 0xf0, 0x26, 0x3c, 0x2f, 0x67, 0xa8, 0x86, 0xe9, 0xda, 0x0a, 0xbd, 0x62, 0xf4, 0x7e, - 0x79, 0x59, 0x2a, 0x1a, 0x5d, 0xa9, 0x2e, 0x4b, 0x25, 0xb6, 0x4b, 0xea, 0xf7, 0xa4, 0x6b, 0xc6, - 0x3d, 0xa9, 0x2f, 0xff, 0xa9, 0xa5, 0x21, 0xc0, 0x75, 0xbb, 0x22, 0xa1, 0xaa, 0x1e, 0x76, 0xa1, - 0x3f, 0xff, 0x7d, 0xa0, 0x76, 0x53, 0xe8, 0x12, 0x72, 0xe1, 0xd3, 0x30, 0xde, 0x30, 0x8f, 0x41, - 0x31, 0x13, 0x9f, 0xc8, 0xe3, 0x9b, 0x38, 0x35, 0xe3, 0x83, 0x2f, 0x81, 0xc0, 0x49, 0xc6, 0xa8, - 0xca, 0xa3, 0x70, 0x54, 0xbc, 0x0d, 0x5f, 0x3c, 0x36, 0xb1, 0x73, 0xc7, 0x72, 0x2f, 0x8c, 0xc8, - 0x0e, 0xa5, 0x8c, 0xcf, 0xb7, 0x35, 0x51, 0x16, 0x2b, 0x2e, 0xe8, 0x75, 0x18, 0x60, 0x0f, 0xc4, - 0xc2, 0xe9, 0xa1, 0x7c, 0x55, 0xb4, 0x19, 0x8e, 0x30, 0x5e, 0x90, 0xec, 0x6f, 0x88, 0x05, 0x07, - 0x74, 0x59, 0x3e, 0xbf, 0x0c, 0x2b, 0xde, 0xb5, 0x90, 0xb0, 0xe7, 0x97, 0xa5, 0xf9, 0xc7, 0xe2, - 0x97, 0x95, 0x1c, 0x9e, 0x99, 0xb6, 0xd2, 0x28, 0x49, 0xe5, 0x08, 0xf1, 0x5f, 0x66, 0xc3, 0x14, - 0xc1, 0x93, 0x32, 0x9b, 0x67, 0x66, 0xcc, 0x8c, 0xbb, 0xf3, 0xba, 0xc9, 0x02, 0x27, 0x79, 0x52, - 0x99, 0x8c, 0xaf, 0x7a, 0xf1, 0x5c, 0xa5, 0xdb, 0xde, 0xc1, 0xaf, 0xa2, 0xec, 0x34, 0xe2, 0x10, - 0x2c, 0xca, 0xcf, 0x6c, 0xc3, 0xa8, 0xb1, 0x6a, 0x1f, 0xa8, 0xfd, 0xc5, 0x83, 0x89, 0xe4, 0x12, - 0x7d, 0xa0, 0x66, 0x97, 0x3f, 0xee, 0x83, 0x31, 0x73, 0x4a, 0xa1, 0x0b, 0x50, 0x12, 0x4c, 0x54, - 0x46, 0x19, 0xb5, 0x4a, 0x56, 0x25, 0x02, 0xc7, 0x34, 0x2c, 0x91, 0x10, 0x2b, 0xae, 0xf9, 0x27, - 0xc7, 0x89, 0x84, 0x14, 0x06, 0x6b, 0x54, 0xf4, 0x6a, 0x71, 0xd3, 0xf7, 0x23, 0x75, 0x20, 0xa9, - 0x79, 0x37, 0xcf, 0xa0, 0x58, 0x60, 0xe9, 0x41, 0xb4, 0x4d, 0x02, 0x8f, 0x34, 0xcd, 0x00, 0xe5, - 0xea, 0x20, 0xba, 0xa2, 0x23, 0xb1, 0x49, 0x4b, 0x8f, 0x53, 0x3f, 0x64, 0x13, 0x59, 0x5c, 0x60, - 0x62, 0x7f, 0xef, 0x1a, 0x7f, 0xb9, 0x2e, 0xf1, 0xe8, 0x63, 0xf0, 0x90, 0x0a, 0x06, 0x86, 0xb9, - 0x99, 0x43, 0xd6, 0x38, 0x60, 0xe8, 0x1b, 0x1e, 0x5a, 0xc8, 0x26, 0xc3, 0x79, 0xe5, 0xd1, 0x6b, - 0x30, 0x26, 0x84, 0x5c, 0xc9, 0x71, 0xd0, 0x74, 0x5e, 0xba, 0x62, 0x60, 0x71, 0x82, 0x5a, 0x86, - 0x58, 0x67, 0x72, 0xa6, 0xe4, 0x30, 0x94, 0x0e, 0xb1, 0xae, 0xe3, 0x71, 0xaa, 0x04, 0x9a, 0x83, - 0x71, 0x2e, 0x83, 0xd1, 0x9b, 0x36, 0x1b, 0x07, 0xf1, 0x9a, 0x4c, 0x2d, 0xa9, 0xab, 0x26, 0x1a, - 0x27, 0xe9, 0xd1, 0x4b, 0x30, 0xe2, 0x04, 0xf5, 0x2d, 0x37, 0x22, 0xf5, 0xa8, 0x1d, 0xf0, 0x67, - 0x66, 0x9a, 0xf7, 0xd7, 0x9c, 0x86, 0xc3, 0x06, 0xa5, 0x7d, 0x07, 0xa6, 0x32, 0x42, 0x5a, 0xd0, - 0x89, 0xe3, 0xb4, 0x5c, 0xf9, 0x4d, 0x09, 0x17, 0xeb, 0xb9, 0x6a, 0x45, 0x7e, 0x8d, 0x46, 0x45, - 0x67, 0x27, 0x0b, 0x7d, 0xa1, 0x25, 0xbf, 0x55, 0xb3, 0x73, 0x59, 0x22, 0x70, 0x4c, 0x63, 0xff, - 0xf7, 0x02, 0x8c, 0x67, 0x98, 0x4e, 0x58, 0x02, 0xd6, 0x84, 0x98, 0x1e, 0xe7, 0x5b, 0x35, 0x23, - 0xf6, 0x17, 0x0e, 0x11, 0xb1, 0xbf, 0xd8, 0x2d, 0x62, 0x7f, 0xdf, 0x3b, 0x89, 0xd8, 0x6f, 0xf6, - 0x58, 0x7f, 0x4f, 0x3d, 0x96, 0x11, 0xe5, 0x7f, 0xe0, 0x90, 0x51, 0xfe, 0x8d, 0x4e, 0x1f, 0xec, - 0xa1, 0xd3, 0x7f, 0xb8, 0x00, 0x13, 0x49, 0xab, 0xcb, 0x11, 0x68, 0x2e, 0x5f, 0x37, 0x34, 0x97, - 0xe7, 0x7b, 0x79, 0xfd, 0x9b, 0xab, 0xc5, 0xc4, 0x09, 0x2d, 0xe6, 0x53, 0x3d, 0x71, 0xeb, 0xac, - 0xd1, 0xfc, 0x7b, 0x05, 0x38, 0x9e, 0x69, 0x8c, 0x3a, 0x82, 0xbe, 0xb9, 0x6a, 0xf4, 0xcd, 0xb3, - 0x3d, 0xbf, 0x8c, 0xce, 0xed, 0xa0, 0x1b, 0x89, 0x0e, 0xba, 0xd0, 0x3b, 0xcb, 0xce, 0xbd, 0xf4, - 0xf5, 0x22, 0x9c, 0xc9, 0x2c, 0x17, 0x2b, 0xfe, 0x96, 0x0d, 0xc5, 0xdf, 0x73, 0x09, 0xc5, 0x9f, - 0xdd, 0xb9, 0xf4, 0xfd, 0xd1, 0x04, 0x8a, 0x17, 0xc2, 0x2c, 0xce, 0xc1, 0x3d, 0x6a, 0x01, 0x8d, - 0x17, 0xc2, 0x8a, 0x11, 0x36, 0xf9, 0x7e, 0x3b, 0x69, 0xff, 0x7e, 0xcb, 0x82, 0x93, 0x99, 0x63, - 0x73, 0x04, 0xda, 0x9e, 0x35, 0x53, 0xdb, 0xf3, 0x64, 0xcf, 0xb3, 0x35, 0x47, 0xfd, 0xf3, 0xf9, - 0x81, 0x9c, 0x6f, 0x61, 0x37, 0xf9, 0xab, 0x30, 0xec, 0xd4, 0xeb, 0x24, 0x0c, 0x57, 0xfd, 0x86, - 0x0a, 0xee, 0xfd, 0x2c, 0xbb, 0x67, 0xc5, 0xe0, 0x83, 0xfd, 0xf2, 0x4c, 0x92, 0x45, 0x8c, 0xc6, - 0x3a, 0x07, 0xf4, 0x09, 0x18, 0x0a, 0x65, 0x5e, 0xb6, 0xbe, 0x7b, 0xcf, 0xcb, 0xc6, 0x94, 0x04, - 0x4a, 0x53, 0xa1, 0x58, 0xa2, 0xff, 0x4f, 0x8f, 0x38, 0x93, 0x96, 0x2a, 0x13, 0xf1, 0x4f, 0xee, - 0x21, 0xee, 0xcc, 0x73, 0x00, 0xbb, 0xea, 0x4a, 0x90, 0xd4, 0x42, 0x68, 0x97, 0x05, 0x8d, 0x0a, - 0x7d, 0x04, 0x26, 0x42, 0x1e, 0x6c, 0x31, 0x76, 0x1f, 0xe0, 0x73, 0x91, 0xc5, 0xab, 0xaa, 0x25, - 0x70, 0x38, 0x45, 0x8d, 0x96, 0x65, 0xad, 0xcc, 0x51, 0x84, 0x4f, 0xcf, 0x73, 0x71, 0x8d, 0xc2, - 0x59, 0xe4, 0x58, 0x72, 0x10, 0x58, 0xf7, 0x6b, 0x25, 0xd1, 0x27, 0x00, 0xe8, 0x24, 0x12, 0xda, - 0x88, 0xc1, 0xfc, 0x2d, 0x94, 0xee, 0x2d, 0x8d, 0x4c, 0xef, 0x69, 0xf6, 0xb4, 0x77, 0x51, 0x31, - 0xc1, 0x1a, 0x43, 0xe4, 0xc0, 0x68, 0xfc, 0x2f, 0xce, 0x91, 0x7c, 0x3e, 0xb7, 0x86, 0x24, 0x73, - 0xa6, 0xfa, 0x5d, 0xd4, 0x59, 0x60, 0x93, 0x23, 0xfa, 0x38, 0x9c, 0xdc, 0xcd, 0xf5, 0xc9, 0x28, - 0xc5, 0x69, 0x0f, 0xf3, 0x3d, 0x31, 0xf2, 0xcb, 0xdb, 0xbf, 0x0d, 0xf0, 0x70, 0x87, 0x9d, 0x1e, - 0xcd, 0x99, 0xf6, 0xd4, 0xa7, 0x93, 0x2a, 0x82, 0x99, 0xcc, 0xc2, 0x86, 0xce, 0x20, 0xb1, 0xa0, - 0x0a, 0xef, 0x78, 0x41, 0xfd, 0xa0, 0xa5, 0x29, 0x6f, 0xb8, 0x43, 0xeb, 0x87, 0x0f, 0x79, 0x82, - 0xdd, 0x47, 0x6d, 0xce, 0x46, 0x86, 0x4a, 0xe4, 0xb9, 0x9e, 0x9b, 0xd3, 0xbb, 0x8e, 0xe4, 0xab, - 0xd9, 0xe1, 0x8b, 0xb9, 0xb6, 0xe4, 0xd2, 0x61, 0xbf, 0xff, 0xa8, 0x42, 0x19, 0xff, 0xbe, 0x05, - 0x27, 0x53, 0x60, 0xde, 0x06, 0x12, 0x8a, 0x08, 0x5b, 0x6b, 0xef, 0xb8, 0xf1, 0x92, 0x21, 0xff, - 0x86, 0xcb, 0xe2, 0x1b, 0x4e, 0xe6, 0xd2, 0x25, 0x9b, 0xfe, 0x85, 0x3f, 0x2a, 0x4f, 0xb1, 0x0a, - 0x4c, 0x42, 0x9c, 0xdf, 0x74, 0xd4, 0x82, 0xb3, 0xf5, 0x76, 0x10, 0xc4, 0x93, 0x35, 0x63, 0x71, - 0xf2, 0xbb, 0xde, 0x63, 0x77, 0xf7, 0xcb, 0x67, 0x17, 0xba, 0xd0, 0xe2, 0xae, 0xdc, 0x90, 0x07, - 0x68, 0x27, 0xe5, 0xf9, 0x24, 0x52, 0xa3, 0x67, 0xfa, 0x2a, 0xa4, 0xfd, 0xa4, 0xf8, 0x13, 0xce, - 0x0c, 0xff, 0xa9, 0x0c, 0xce, 0x47, 0xab, 0x3d, 0xf9, 0xe6, 0xc4, 0xa6, 0x9e, 0x59, 0x81, 0x33, - 0x9d, 0x27, 0xd3, 0xa1, 0x9e, 0x8f, 0xff, 0x9e, 0x05, 0xa7, 0x3b, 0xc6, 0x28, 0xfa, 0x16, 0xbc, - 0x2c, 0xd8, 0x9f, 0xb5, 0xe0, 0x91, 0xcc, 0x12, 0x86, 0x93, 0xdd, 0x05, 0x28, 0xd5, 0x13, 0x89, - 0x7d, 0xe3, 0x68, 0x1d, 0x2a, 0xa9, 0x6f, 0x4c, 0x63, 0xf8, 0xd2, 0x15, 0xba, 0xfa, 0xd2, 0xfd, - 0xba, 0x05, 0xa9, 0xa3, 0xfe, 0x08, 0x24, 0xcf, 0x8a, 0x29, 0x79, 0x3e, 0xd6, 0x4b, 0x6f, 0xe6, - 0x08, 0x9d, 0x7f, 0x3e, 0x0e, 0x27, 0x72, 0x5e, 0x7f, 0xee, 0xc2, 0xe4, 0x66, 0x9d, 0x98, 0xcf, - 0xfd, 0x3b, 0x85, 0xc1, 0xea, 0x18, 0x1b, 0x80, 0xe7, 0x53, 0x4e, 0x91, 0xe0, 0x74, 0x15, 0xe8, - 0xb3, 0x16, 0x1c, 0x73, 0x6e, 0x85, 0x4b, 0xf4, 0x06, 0xe1, 0xd6, 0xe7, 0x9b, 0x7e, 0x7d, 0x9b, - 0x0a, 0x66, 0x72, 0x59, 0xbd, 0x90, 0xa9, 0xd5, 0xbd, 0x51, 0x4b, 0xd1, 0x1b, 0xd5, 0xb3, 0xec, - 0xf9, 0x59, 0x54, 0x38, 0xb3, 0x2e, 0x84, 0x45, 0xfe, 0x1a, 0x27, 0xda, 0xea, 0x14, 0x90, 0x22, - 0xeb, 0x99, 0x2e, 0x17, 0x89, 0x25, 0x06, 0x2b, 0x3e, 0xe8, 0x53, 0x50, 0xda, 0x94, 0x6f, 0xcf, - 0x33, 0x44, 0xee, 0xb8, 0x23, 0x3b, 0xbf, 0xc8, 0xe7, 0xce, 0x09, 0x8a, 0x08, 0xc7, 0x4c, 0xd1, - 0x6b, 0x50, 0xf4, 0x36, 0xc2, 0x4e, 0x09, 0xe8, 0x13, 0x5e, 0xa8, 0x3c, 0xec, 0xcb, 0xda, 0x72, - 0x0d, 0xd3, 0x82, 0xe8, 0x32, 0x14, 0x83, 0x9b, 0x0d, 0x61, 0x92, 0xc8, 0x5c, 0xa4, 0x78, 0x7e, - 0x31, 0xa7, 0x55, 0x8c, 0x13, 0x9e, 0x5f, 0xc4, 0x94, 0x05, 0xaa, 0x42, 0x3f, 0x7b, 0x32, 0x29, - 0x44, 0xdb, 0xcc, 0xab, 0x7c, 0x87, 0xa7, 0xc7, 0xfc, 0x39, 0x16, 0x23, 0xc0, 0x9c, 0x11, 0x5a, - 0x87, 0x81, 0x3a, 0x4b, 0x56, 0x2e, 0x64, 0xd9, 0xf7, 0x67, 0x1a, 0x1f, 0x3a, 0x64, 0x71, 0x17, - 0xba, 0x78, 0x46, 0x81, 0x05, 0x2f, 0xc6, 0x95, 0xb4, 0xb6, 0x36, 0xe4, 0x89, 0x95, 0xcd, 0x95, - 0x65, 0xd6, 0xef, 0xc8, 0x95, 0x51, 0x60, 0xc1, 0x0b, 0xbd, 0x0c, 0x85, 0x8d, 0xba, 0x78, 0x0e, - 0x99, 0x69, 0x85, 0x30, 0x23, 0xf7, 0xcc, 0x0f, 0xdc, 0xdd, 0x2f, 0x17, 0x96, 0x17, 0x70, 0x61, - 0xa3, 0x8e, 0xd6, 0x60, 0x70, 0x83, 0xc7, 0xfa, 0x10, 0x86, 0x86, 0x27, 0xb2, 0xc3, 0x90, 0xa4, - 0xc2, 0x81, 0xf0, 0xa7, 0x75, 0x02, 0x81, 0x25, 0x13, 0x96, 0x4e, 0x45, 0xc5, 0x2c, 0x11, 0x21, - 0x13, 0x67, 0x0f, 0x17, 0x67, 0x86, 0x5f, 0x35, 0xe2, 0xc8, 0x27, 0x58, 0xe3, 0x48, 0x67, 0xb5, - 0x73, 0xa7, 0x1d, 0xb0, 0x78, 0xfa, 0x22, 0xb6, 0x56, 0xe6, 0xac, 0x9e, 0x93, 0x44, 0x9d, 0x66, - 0xb5, 0x22, 0xc2, 0x31, 0x53, 0xb4, 0x0d, 0xa3, 0xbb, 0x61, 0x6b, 0x8b, 0xc8, 0x25, 0xcd, 0x42, - 0x6d, 0xe5, 0x48, 0xb3, 0xd7, 0x05, 0xa1, 0x1b, 0x44, 0x6d, 0xa7, 0x99, 0xda, 0x85, 0xd8, 0xb5, - 0xe6, 0xba, 0xce, 0x0c, 0x9b, 0xbc, 0x69, 0xf7, 0xbf, 0xdd, 0xf6, 0x6f, 0xee, 0x45, 0x44, 0x44, - 0x3a, 0xcc, 0xec, 0xfe, 0x37, 0x38, 0x49, 0xba, 0xfb, 0x05, 0x02, 0x4b, 0x26, 0xe8, 0xba, 0xe8, - 0x1e, 0xb6, 0x7b, 0x4e, 0xe4, 0x87, 0x51, 0x9e, 0x93, 0x44, 0x39, 0x9d, 0xc2, 0x76, 0xcb, 0x98, - 0x15, 0xdb, 0x25, 0x5b, 0x5b, 0x7e, 0xe4, 0x7b, 0x89, 0x1d, 0x7a, 0x32, 0x7f, 0x97, 0xac, 0x66, - 0xd0, 0xa7, 0x77, 0xc9, 0x2c, 0x2a, 0x9c, 0x59, 0x17, 0x6a, 0xc0, 0x58, 0xcb, 0x0f, 0xa2, 0x5b, - 0x7e, 0x20, 0xe7, 0x17, 0xea, 0xa0, 0x28, 0x35, 0x28, 0x45, 0x8d, 0x2c, 0x88, 0xa8, 0x89, 0xc1, - 0x09, 0x9e, 0xe8, 0xa3, 0x30, 0x18, 0xd6, 0x9d, 0x26, 0xa9, 0x5c, 0x9d, 0x9e, 0xca, 0x3f, 0x7e, - 0x6a, 0x9c, 0x24, 0x67, 0x76, 0xf1, 0x50, 0x2d, 0x9c, 0x04, 0x4b, 0x76, 0x68, 0x19, 0xfa, 0x59, - 0x9a, 0x52, 0x16, 0x96, 0x33, 0x27, 0x1a, 0x74, 0xea, 0xc1, 0x03, 0xdf, 0x9b, 0x18, 0x18, 0xf3, - 0xe2, 0x74, 0x0d, 0x08, 0x4d, 0x81, 0x1f, 0x4e, 0x1f, 0xcf, 0x5f, 0x03, 0x42, 0xc1, 0x70, 0xb5, - 0xd6, 0x69, 0x0d, 0x28, 0x22, 0x1c, 0x33, 0xa5, 0x3b, 0x33, 0xdd, 0x4d, 0x4f, 0x74, 0x70, 0x66, - 0xcb, 0xdd, 0x4b, 0xd9, 0xce, 0x4c, 0x77, 0x52, 0xca, 0xc2, 0xfe, 0xd5, 0xa1, 0xb4, 0xcc, 0xc2, - 0x34, 0x4c, 0x7f, 0xcd, 0x4a, 0x39, 0x1f, 0x7c, 0xa0, 0x57, 0x85, 0xf7, 0x7d, 0xbc, 0xb8, 0x7e, - 0xd6, 0x82, 0x13, 0xad, 0xcc, 0x0f, 0x11, 0x02, 0x40, 0x6f, 0x7a, 0x73, 0xfe, 0xe9, 0x2a, 0x84, - 0x6b, 0x36, 0x1e, 0xe7, 0xd4, 0x94, 0x54, 0x0e, 0x14, 0xdf, 0xb1, 0x72, 0x60, 0x15, 0x86, 0xea, - 0xfc, 0x26, 0x27, 0x43, 0x8f, 0xf7, 0x14, 0x80, 0x90, 0x89, 0x12, 0xe2, 0x0a, 0xb8, 0x81, 0x15, - 0x0b, 0xf4, 0x43, 0x16, 0x9c, 0x4e, 0x36, 0x1d, 0x13, 0x86, 0x16, 0x71, 0x5f, 0xb9, 0x5a, 0x6b, - 0x59, 0x7c, 0x7f, 0x4a, 0xfe, 0x37, 0x88, 0x0f, 0xba, 0x11, 0xe0, 0xce, 0x95, 0xa1, 0xc5, 0x0c, - 0xbd, 0xda, 0x80, 0x69, 0x51, 0xec, 0x41, 0xb7, 0xf6, 0x02, 0x8c, 0xec, 0xf8, 0x6d, 0x2f, 0x12, - 0xbe, 0x6f, 0xc2, 0x0b, 0x89, 0x79, 0xdf, 0xac, 0x6a, 0x70, 0x6c, 0x50, 0x25, 0x34, 0x72, 0x43, - 0xf7, 0xac, 0x91, 0x7b, 0x0b, 0x46, 0x3c, 0xcd, 0x59, 0xbb, 0xd3, 0x0d, 0x56, 0x68, 0x17, 0x35, - 0x6a, 0xde, 0x4a, 0x1d, 0x82, 0x0d, 0x6e, 0x9d, 0xb5, 0x65, 0xf0, 0xce, 0xb4, 0x65, 0x47, 0x7a, - 0x25, 0xb6, 0x7f, 0xb6, 0x90, 0x71, 0x63, 0xe0, 0x5a, 0xb9, 0x57, 0x4d, 0xad, 0xdc, 0xb9, 0xa4, - 0x56, 0x2e, 0x65, 0xaa, 0x32, 0x14, 0x72, 0xbd, 0xe7, 0x47, 0xeb, 0x39, 0xa8, 0xec, 0xf7, 0x58, - 0xf0, 0x10, 0xb3, 0x7d, 0xd0, 0x0a, 0xde, 0xb1, 0xbd, 0xe3, 0xe1, 0xbb, 0xfb, 0xe5, 0x87, 0x56, - 0xb2, 0xd9, 0xe1, 0xbc, 0x7a, 0xec, 0x26, 0x9c, 0xed, 0x76, 0xee, 0x32, 0x2f, 0xcf, 0x86, 0x72, - 0x8e, 0x88, 0xbd, 0x3c, 0x1b, 0x95, 0x45, 0xcc, 0x30, 0xbd, 0x86, 0x4c, 0xb3, 0xff, 0xab, 0x05, - 0xc5, 0xaa, 0xdf, 0x38, 0x82, 0x1b, 0xfd, 0x87, 0x8d, 0x1b, 0xfd, 0xc3, 0xd9, 0x27, 0x7e, 0x23, - 0xd7, 0xd8, 0xb7, 0x94, 0x30, 0xf6, 0x9d, 0xce, 0x63, 0xd0, 0xd9, 0xb4, 0xf7, 0x13, 0x45, 0x18, - 0xae, 0xfa, 0x0d, 0xb5, 0xce, 0xfe, 0xe5, 0xbd, 0x3c, 0xb1, 0xc8, 0xcd, 0x78, 0xa3, 0x71, 0x66, - 0xae, 0xb1, 0xf2, 0xd1, 0xfd, 0xb7, 0xd8, 0x4b, 0x8b, 0x1b, 0xc4, 0xdd, 0xdc, 0x8a, 0x48, 0x23, - 0xf9, 0x39, 0x47, 0xf7, 0xd2, 0xe2, 0x1b, 0x45, 0x18, 0x4f, 0xd4, 0x8e, 0x9a, 0x30, 0xda, 0xd4, - 0x4d, 0x49, 0x62, 0x9e, 0xde, 0x93, 0x15, 0x4a, 0x78, 0xaa, 0x6b, 0x20, 0x6c, 0x32, 0x47, 0xb3, - 0x00, 0xca, 0xb7, 0x42, 0x6a, 0xfb, 0xd9, 0xb5, 0x46, 0x39, 0x5f, 0x84, 0x58, 0xa3, 0x40, 0x2f, - 0xc2, 0x70, 0xe4, 0xb7, 0xfc, 0xa6, 0xbf, 0xb9, 0x77, 0x85, 0xc8, 0x68, 0x7a, 0xca, 0xfb, 0x76, - 0x3d, 0x46, 0x61, 0x9d, 0x0e, 0xdd, 0x86, 0x49, 0xc5, 0xa4, 0x76, 0x1f, 0xcc, 0x6b, 0x4c, 0x6d, - 0xb2, 0x96, 0xe4, 0x88, 0xd3, 0x95, 0xa0, 0x97, 0x61, 0x8c, 0xb9, 0x01, 0xb3, 0xf2, 0x57, 0xc8, - 0x9e, 0x8c, 0xb2, 0xca, 0x24, 0xec, 0x55, 0x03, 0x83, 0x13, 0x94, 0x68, 0x01, 0x26, 0x77, 0xdc, - 0x30, 0x51, 0x7c, 0x80, 0x15, 0x67, 0x0d, 0x58, 0x4d, 0x22, 0x71, 0x9a, 0xde, 0xfe, 0x69, 0x31, - 0xc6, 0x5e, 0xe4, 0xbe, 0xb7, 0x1c, 0xdf, 0xdd, 0xcb, 0xf1, 0xeb, 0x16, 0x4c, 0xd0, 0xda, 0x99, - 0x6f, 0xa3, 0x14, 0xa4, 0x54, 0x1c, 0x7e, 0xab, 0x43, 0x1c, 0xfe, 0x73, 0x74, 0xdb, 0x6e, 0xf8, - 0xed, 0x48, 0x68, 0x47, 0xb5, 0x7d, 0x99, 0x42, 0xb1, 0xc0, 0x0a, 0x3a, 0x12, 0x04, 0xe2, 0x45, - 0xb2, 0x4e, 0x47, 0x82, 0x00, 0x0b, 0xac, 0x0c, 0xd3, 0xdf, 0x97, 0x1d, 0xa6, 0x9f, 0x47, 0x5b, - 0x16, 0x5e, 0x70, 0x42, 0xa4, 0xd5, 0xa2, 0x2d, 0x4b, 0xf7, 0xb8, 0x98, 0xc6, 0xfe, 0x6a, 0x11, - 0x46, 0xaa, 0x7e, 0x23, 0x76, 0xec, 0x78, 0xc1, 0x70, 0xec, 0x38, 0x9b, 0x70, 0xec, 0x98, 0xd0, - 0x69, 0xdf, 0x73, 0xe3, 0xf8, 0x66, 0xb9, 0x71, 0xfc, 0x9a, 0xc5, 0x46, 0x6d, 0x71, 0xad, 0xc6, - 0x5d, 0x65, 0xd1, 0x45, 0x18, 0x66, 0x3b, 0x1c, 0x7b, 0x02, 0x2f, 0xbd, 0x1d, 0x58, 0xda, 0xbc, - 0xb5, 0x18, 0x8c, 0x75, 0x1a, 0x74, 0x1e, 0x86, 0x42, 0xe2, 0x04, 0xf5, 0x2d, 0xb5, 0xbd, 0x0b, - 0xd7, 0x04, 0x0e, 0xc3, 0x0a, 0x8b, 0xde, 0x88, 0x03, 0xfd, 0x16, 0xf3, 0x9f, 0xd4, 0xea, 0xed, - 0xe1, 0x4b, 0x24, 0x3f, 0xba, 0xaf, 0x7d, 0x03, 0x50, 0x9a, 0xbe, 0x87, 0x50, 0x94, 0x65, 0x33, - 0x14, 0x65, 0x29, 0x15, 0x86, 0xf2, 0x2f, 0x2d, 0x18, 0xab, 0xfa, 0x0d, 0xba, 0x74, 0xbf, 0x9d, - 0xd6, 0xa9, 0x1e, 0xe5, 0x7c, 0xa0, 0x43, 0x94, 0xf3, 0x47, 0xa1, 0xbf, 0xea, 0x37, 0xba, 0x84, - 0xcb, 0xfc, 0xfb, 0x16, 0x0c, 0x56, 0xfd, 0xc6, 0x11, 0x18, 0x5e, 0x5e, 0x35, 0x0d, 0x2f, 0x0f, - 0xe5, 0xcc, 0x9b, 0x1c, 0x5b, 0xcb, 0xdf, 0xed, 0x83, 0x51, 0xda, 0x4e, 0x7f, 0x53, 0x0e, 0xa5, - 0xd1, 0x6d, 0x56, 0x0f, 0xdd, 0x46, 0xaf, 0x01, 0x7e, 0xb3, 0xe9, 0xdf, 0x4a, 0x0e, 0xeb, 0x32, - 0x83, 0x62, 0x81, 0x45, 0xcf, 0xc0, 0x50, 0x2b, 0x20, 0xbb, 0xae, 0x2f, 0xe4, 0x6b, 0xcd, 0x8c, - 0x55, 0x15, 0x70, 0xac, 0x28, 0xe8, 0xc5, 0x3b, 0x74, 0x3d, 0x2a, 0x4b, 0xd4, 0x7d, 0xaf, 0xc1, - 0x6d, 0x13, 0x45, 0x91, 0x8a, 0x47, 0x83, 0x63, 0x83, 0x0a, 0xdd, 0x80, 0x12, 0xfb, 0xcf, 0xb6, - 0x9d, 0xc3, 0x27, 0x01, 0x17, 0xc9, 0x49, 0x05, 0x03, 0x1c, 0xf3, 0x42, 0xcf, 0x01, 0x44, 0x32, - 0x9d, 0x45, 0x28, 0xc2, 0x26, 0xaa, 0xbb, 0x88, 0x4a, 0x74, 0x11, 0x62, 0x8d, 0x0a, 0x3d, 0x0d, - 0xa5, 0xc8, 0x71, 0x9b, 0x2b, 0xae, 0xc7, 0xec, 0xf7, 0xb4, 0xfd, 0x22, 0x47, 0xa8, 0x00, 0xe2, - 0x18, 0x4f, 0x65, 0x41, 0x16, 0x10, 0x67, 0x7e, 0x2f, 0x12, 0xe9, 0xb0, 0x8a, 0x5c, 0x16, 0x5c, - 0x51, 0x50, 0xac, 0x51, 0xa0, 0x2d, 0x38, 0xe5, 0x7a, 0x2c, 0x6d, 0x0d, 0xa9, 0x6d, 0xbb, 0xad, - 0xf5, 0x95, 0xda, 0x75, 0x12, 0xb8, 0x1b, 0x7b, 0xf3, 0x4e, 0x7d, 0x9b, 0x78, 0x32, 0xbd, 0xb3, - 0xcc, 0xfa, 0x7f, 0xaa, 0xd2, 0x81, 0x16, 0x77, 0xe4, 0x64, 0x3f, 0xcf, 0xe6, 0xfb, 0xd5, 0x1a, - 0x7a, 0xca, 0xd8, 0x3a, 0x4e, 0xe8, 0x5b, 0xc7, 0xc1, 0x7e, 0x79, 0xe0, 0x6a, 0x4d, 0x8b, 0xca, - 0xf2, 0x12, 0x1c, 0xaf, 0xfa, 0x8d, 0xaa, 0x1f, 0x44, 0xcb, 0x7e, 0x70, 0xcb, 0x09, 0x1a, 0x72, - 0x7a, 0x95, 0x65, 0x5c, 0x1a, 0xba, 0x7f, 0xf6, 0xf3, 0xdd, 0xc5, 0x88, 0x39, 0xf3, 0x3c, 0x93, - 0xd8, 0x0e, 0xf9, 0xe0, 0xb0, 0xce, 0x64, 0x07, 0x95, 0xf8, 0xe9, 0x92, 0x13, 0x11, 0x74, 0x15, - 0x46, 0xeb, 0xfa, 0x31, 0x2a, 0x8a, 0x3f, 0x29, 0x0f, 0x32, 0xe3, 0x8c, 0xcd, 0x3c, 0x77, 0xcd, - 0xf2, 0xf6, 0x77, 0x8a, 0x4a, 0xb8, 0x22, 0x82, 0xbb, 0xb4, 0xf6, 0x92, 0x01, 0x5d, 0x66, 0x86, - 0x29, 0xe4, 0x47, 0xfd, 0xe3, 0x76, 0xe5, 0x8e, 0x99, 0x61, 0xec, 0xef, 0x82, 0x13, 0xc9, 0xea, - 0x7b, 0x4e, 0xc3, 0xbe, 0x00, 0x93, 0x81, 0x5e, 0x50, 0x4b, 0xb3, 0x77, 0x9c, 0x67, 0xf3, 0x48, - 0x20, 0x71, 0x9a, 0xde, 0x7e, 0x11, 0x26, 0xe9, 0xe5, 0x57, 0x09, 0x72, 0xac, 0x97, 0xbb, 0x07, - 0xe8, 0xf9, 0x6f, 0xfd, 0xec, 0x20, 0x4a, 0xe4, 0x5c, 0x42, 0x9f, 0x84, 0xb1, 0x90, 0xac, 0xb8, - 0x5e, 0xfb, 0xb6, 0xd4, 0xad, 0x75, 0x78, 0x69, 0x5b, 0x5b, 0xd2, 0x29, 0xf9, 0xfd, 0xc1, 0x84, - 0xe1, 0x04, 0x37, 0xb4, 0x03, 0x63, 0xb7, 0x5c, 0xaf, 0xe1, 0xdf, 0x0a, 0x25, 0xff, 0xa1, 0x7c, - 0x45, 0xfd, 0x0d, 0x4e, 0x99, 0x68, 0xa3, 0x51, 0xdd, 0x0d, 0x83, 0x19, 0x4e, 0x30, 0xa7, 0x8b, - 0x3d, 0x68, 0x7b, 0x73, 0xe1, 0xb5, 0x90, 0xf0, 0x97, 0xa3, 0x62, 0xb1, 0x63, 0x09, 0xc4, 0x31, - 0x9e, 0x2e, 0x76, 0xf6, 0xe7, 0x52, 0xe0, 0xb7, 0x79, 0x82, 0x1f, 0xb1, 0xd8, 0xb1, 0x82, 0x62, - 0x8d, 0x82, 0x6e, 0x86, 0xec, 0xdf, 0x9a, 0xef, 0x61, 0xdf, 0x8f, 0xe4, 0xf6, 0xc9, 0x12, 0xd4, - 0x69, 0x70, 0x6c, 0x50, 0xa1, 0x65, 0x40, 0x61, 0xbb, 0xd5, 0x6a, 0x32, 0xd7, 0x45, 0xa7, 0xc9, - 0x58, 0x71, 0xb7, 0xab, 0x22, 0xf7, 0x6e, 0xa9, 0xa5, 0xb0, 0x38, 0xa3, 0x04, 0x3d, 0x17, 0x37, - 0x44, 0x53, 0xfb, 0x59, 0x53, 0xb9, 0x51, 0xaf, 0xc6, 0xdb, 0x29, 0x71, 0x68, 0x09, 0x06, 0xc3, - 0xbd, 0xb0, 0x1e, 0x35, 0xc3, 0x4e, 0xe9, 0x00, 0x6b, 0x8c, 0x44, 0xcb, 0x46, 0xcb, 0x8b, 0x60, - 0x59, 0x16, 0xd5, 0x61, 0x4a, 0x70, 0x5c, 0xd8, 0x72, 0x3c, 0x95, 0xa4, 0x8c, 0x7b, 0xef, 0x5d, - 0xbc, 0xbb, 0x5f, 0x9e, 0x12, 0x35, 0xeb, 0xe8, 0x83, 0xfd, 0x32, 0x5d, 0x1c, 0x19, 0x18, 0x9c, - 0xc5, 0x8d, 0x4f, 0xbe, 0x7a, 0xdd, 0xdf, 0x69, 0x55, 0x03, 0x7f, 0xc3, 0x6d, 0x92, 0x4e, 0x86, - 0xd1, 0x9a, 0x41, 0x29, 0x26, 0x9f, 0x01, 0xc3, 0x09, 0x6e, 0xf6, 0x77, 0x32, 0xd9, 0xb1, 0xe6, - 0x6e, 0x7a, 0x4e, 0xd4, 0x0e, 0x08, 0xda, 0x81, 0xd1, 0x16, 0xdb, 0x5d, 0x44, 0xda, 0x1d, 0x31, - 0xd7, 0x5f, 0xe8, 0x51, 0xff, 0x75, 0x8b, 0x25, 0x0e, 0x34, 0xfc, 0x20, 0xab, 0x3a, 0x3b, 0x6c, - 0x72, 0xb7, 0xff, 0xed, 0x49, 0x26, 0x7d, 0xd4, 0xb8, 0x52, 0x6b, 0x50, 0x3c, 0x1b, 0x13, 0xd7, - 0xd8, 0x99, 0x7c, 0xf5, 0x71, 0x3c, 0x2c, 0xe2, 0xe9, 0x19, 0x96, 0x65, 0xd1, 0x27, 0x60, 0x8c, - 0xde, 0x0a, 0x95, 0x04, 0x10, 0x4e, 0x1f, 0xcb, 0x0f, 0x70, 0xa3, 0xa8, 0xf4, 0x94, 0x5c, 0x7a, - 0x61, 0x9c, 0x60, 0x86, 0xde, 0x60, 0xae, 0x81, 0x92, 0x75, 0xa1, 0x17, 0xd6, 0xba, 0x17, 0xa0, - 0x64, 0xab, 0x31, 0x41, 0x6d, 0x98, 0x4a, 0x27, 0x1e, 0x0d, 0xa7, 0xed, 0x7c, 0xf1, 0x3a, 0x9d, - 0x3b, 0x34, 0xce, 0x9d, 0x94, 0xc6, 0x85, 0x38, 0x8b, 0x3f, 0x5a, 0x49, 0xa6, 0x85, 0x2c, 0x1a, - 0x8a, 0xe7, 0x54, 0x6a, 0xc8, 0xd1, 0x8e, 0x19, 0x21, 0x37, 0xe1, 0xb4, 0x96, 0x59, 0xef, 0x52, - 0xe0, 0x30, 0xd7, 0x14, 0x97, 0x6d, 0xa7, 0x9a, 0x5c, 0xf4, 0xc8, 0xdd, 0xfd, 0xf2, 0xe9, 0xf5, - 0x4e, 0x84, 0xb8, 0x33, 0x1f, 0x74, 0x15, 0x8e, 0xf3, 0xf0, 0x0c, 0x8b, 0xc4, 0x69, 0x34, 0x5d, - 0x4f, 0x09, 0x5e, 0x7c, 0xc9, 0x9f, 0xbc, 0xbb, 0x5f, 0x3e, 0x3e, 0x97, 0x45, 0x80, 0xb3, 0xcb, - 0xa1, 0x57, 0xa1, 0xd4, 0xf0, 0x42, 0xd1, 0x07, 0x03, 0x46, 0xf2, 0xc2, 0xd2, 0xe2, 0x5a, 0x4d, - 0x7d, 0x7f, 0xfc, 0x07, 0xc7, 0x05, 0xd0, 0x26, 0xb7, 0x7c, 0x28, 0x75, 0xd5, 0x60, 0x2a, 0x6a, - 0x5f, 0x52, 0xa3, 0x6b, 0x3c, 0x4f, 0xe7, 0x26, 0x3f, 0xf5, 0x6a, 0xcb, 0x78, 0xb9, 0x6e, 0x30, - 0x46, 0xaf, 0x03, 0x12, 0x49, 0x32, 0xe6, 0xea, 0x2c, 0xa7, 0x93, 0xe6, 0x8e, 0xa8, 0x6e, 0xa1, - 0xb5, 0x14, 0x05, 0xce, 0x28, 0x85, 0x2e, 0xd3, 0x5d, 0x45, 0x87, 0x8a, 0x5d, 0x4b, 0xa5, 0xc8, - 0x5d, 0x24, 0xad, 0x80, 0x30, 0x0f, 0x3a, 0x93, 0x23, 0x4e, 0x94, 0x43, 0x0d, 0x38, 0xe5, 0xb4, - 0x23, 0x9f, 0x19, 0x95, 0x4c, 0xd2, 0x75, 0x7f, 0x9b, 0x78, 0xcc, 0x9e, 0x3b, 0xc4, 0xa2, 0x01, - 0x9e, 0x9a, 0xeb, 0x40, 0x87, 0x3b, 0x72, 0xa1, 0x12, 0xb9, 0xca, 0x89, 0x0f, 0x66, 0x2c, 0xc2, - 0x8c, 0xbc, 0xf8, 0x2f, 0xc2, 0xf0, 0x96, 0x1f, 0x46, 0x6b, 0x24, 0xba, 0xe5, 0x07, 0xdb, 0x22, - 0x2a, 0x77, 0x9c, 0x09, 0x21, 0x46, 0x61, 0x9d, 0x8e, 0x5e, 0xb9, 0x99, 0xb7, 0x51, 0x65, 0x91, - 0x39, 0x7a, 0x0c, 0xc5, 0x7b, 0xcc, 0x65, 0x0e, 0xc6, 0x12, 0x2f, 0x49, 0x2b, 0xd5, 0x05, 0xe6, - 0xb4, 0x91, 0x20, 0xad, 0x54, 0x17, 0xb0, 0xc4, 0xd3, 0xe9, 0x1a, 0x6e, 0x39, 0x01, 0xa9, 0x06, - 0x7e, 0x9d, 0x84, 0x5a, 0xfe, 0x8d, 0x87, 0x79, 0xcc, 0x71, 0x3a, 0x5d, 0x6b, 0x59, 0x04, 0x38, - 0xbb, 0x1c, 0x22, 0xe9, 0xac, 0x92, 0x63, 0xf9, 0xd6, 0xb6, 0xb4, 0x3c, 0xd3, 0x63, 0x62, 0x49, - 0x0f, 0x26, 0x54, 0x3e, 0x4b, 0x1e, 0x65, 0x3c, 0x9c, 0x1e, 0x67, 0x73, 0xbb, 0xf7, 0x10, 0xe5, - 0xca, 0x7e, 0x59, 0x49, 0x70, 0xc2, 0x29, 0xde, 0x46, 0xb8, 0xc9, 0x89, 0xae, 0xe1, 0x26, 0x2f, - 0x40, 0x29, 0x6c, 0xdf, 0x6c, 0xf8, 0x3b, 0x8e, 0xeb, 0x31, 0xa7, 0x0d, 0xed, 0xee, 0x57, 0x93, - 0x08, 0x1c, 0xd3, 0xa0, 0x65, 0x18, 0x72, 0xa4, 0x71, 0x12, 0xe5, 0x47, 0xd2, 0x52, 0x26, 0x49, - 0x1e, 0x5c, 0x46, 0x9a, 0x23, 0x55, 0x59, 0xf4, 0x0a, 0x8c, 0x8a, 0xe0, 0x0a, 0x22, 0x05, 0xf4, - 0x94, 0xf9, 0x02, 0xb6, 0xa6, 0x23, 0xb1, 0x49, 0x8b, 0xae, 0xc1, 0x70, 0xe4, 0x37, 0xd9, 0x33, - 0x4e, 0x2a, 0xe6, 0x9d, 0xc8, 0x0f, 0x78, 0xb9, 0xae, 0xc8, 0x74, 0xb5, 0xb9, 0x2a, 0x8a, 0x75, - 0x3e, 0x68, 0x9d, 0xcf, 0x77, 0x96, 0x6d, 0x83, 0x84, 0x22, 0x87, 0xf0, 0xe9, 0x3c, 0x8f, 0x3b, - 0x46, 0x66, 0x2e, 0x07, 0x51, 0x12, 0xeb, 0x6c, 0xd0, 0x25, 0x98, 0x6c, 0x05, 0xae, 0xcf, 0xe6, - 0x84, 0x32, 0xb6, 0x4e, 0x9b, 0xb9, 0xf5, 0xaa, 0x49, 0x02, 0x9c, 0x2e, 0xc3, 0x62, 0x63, 0x08, - 0xe0, 0xf4, 0x49, 0x9e, 0x1f, 0x88, 0x5f, 0xa5, 0x39, 0x0c, 0x2b, 0x2c, 0x5a, 0x65, 0x3b, 0x31, - 0xd7, 0x02, 0x4d, 0xcf, 0xe4, 0x07, 0xef, 0xd2, 0xb5, 0x45, 0x5c, 0x78, 0x55, 0x7f, 0x71, 0xcc, - 0x01, 0x35, 0xb4, 0xb4, 0xbc, 0xf4, 0x0a, 0x10, 0x4e, 0x9f, 0xea, 0xe0, 0xf2, 0x99, 0xb8, 0x95, - 0xc5, 0x02, 0x81, 0x01, 0x0e, 0x71, 0x82, 0x27, 0xfa, 0x08, 0x4c, 0x88, 0x48, 0xac, 0x71, 0x37, - 0x9d, 0x8e, 0x9f, 0xc5, 0xe0, 0x04, 0x0e, 0xa7, 0xa8, 0x79, 0x7e, 0x1e, 0xe7, 0x66, 0x93, 0x88, - 0xad, 0x6f, 0xc5, 0xf5, 0xb6, 0xc3, 0xe9, 0x33, 0x6c, 0x7f, 0x10, 0xf9, 0x79, 0x92, 0x58, 0x9c, - 0x51, 0x02, 0xad, 0xc3, 0x44, 0x2b, 0x20, 0x64, 0x87, 0x09, 0xfa, 0xe2, 0x3c, 0x2b, 0xf3, 0xd0, - 0x30, 0xb4, 0x25, 0xd5, 0x04, 0xee, 0x20, 0x03, 0x86, 0x53, 0x1c, 0xd0, 0x2d, 0x18, 0xf2, 0x77, - 0x49, 0xb0, 0x45, 0x9c, 0xc6, 0xf4, 0xd9, 0x0e, 0x8f, 0xb5, 0xc4, 0xe1, 0x76, 0x55, 0xd0, 0x26, - 0x7c, 0x59, 0x24, 0xb8, 0xbb, 0x2f, 0x8b, 0xac, 0x0c, 0xfd, 0x75, 0x0b, 0x4e, 0x4a, 0xeb, 0x50, - 0xad, 0x45, 0x7b, 0x7d, 0xc1, 0xf7, 0xc2, 0x28, 0xe0, 0xc1, 0x4c, 0x1e, 0xc9, 0x0f, 0xf0, 0xb1, - 0x9e, 0x53, 0x48, 0x29, 0xa2, 0x4f, 0xe6, 0x51, 0x84, 0x38, 0xbf, 0x46, 0x7a, 0x35, 0x0d, 0x49, - 0x24, 0x37, 0xa3, 0xb9, 0x70, 0xf9, 0x8d, 0xc5, 0xb5, 0xe9, 0x47, 0x79, 0x24, 0x16, 0xba, 0x18, - 0x6a, 0x49, 0x24, 0x4e, 0xd3, 0xa3, 0x8b, 0x50, 0xf0, 0xc3, 0xe9, 0xc7, 0x3a, 0x64, 0x72, 0xf6, - 0x1b, 0x57, 0x6b, 0xdc, 0xa7, 0xf1, 0x6a, 0x0d, 0x17, 0xfc, 0x50, 0xe6, 0xc8, 0xa1, 0xf7, 0xb1, - 0x70, 0xfa, 0x71, 0xae, 0xb6, 0x94, 0x39, 0x72, 0x18, 0x10, 0xc7, 0x78, 0xb4, 0x05, 0xe3, 0xa1, - 0x71, 0xef, 0x0d, 0xa7, 0xcf, 0xb1, 0x9e, 0x7a, 0x3c, 0x6f, 0xd0, 0x0c, 0x6a, 0x2d, 0x79, 0x85, - 0xc9, 0x05, 0x27, 0xd9, 0xf2, 0xd5, 0xa5, 0xdd, 0xbc, 0xc3, 0xe9, 0x27, 0xba, 0xac, 0x2e, 0x8d, - 0x58, 0x5f, 0x5d, 0x3a, 0x0f, 0x9c, 0xe0, 0x39, 0xf3, 0x1d, 0x30, 0x99, 0x12, 0x97, 0x0e, 0xe3, - 0xbf, 0x3f, 0xb3, 0x0d, 0xa3, 0xc6, 0x94, 0x7c, 0xa0, 0xee, 0x1d, 0xbf, 0x55, 0x82, 0x92, 0x32, - 0xbb, 0xa3, 0x0b, 0xa6, 0x47, 0xc7, 0xc9, 0xa4, 0x47, 0xc7, 0x50, 0xd5, 0x6f, 0x18, 0x4e, 0x1c, - 0xeb, 0x19, 0x11, 0x2b, 0xf3, 0x36, 0xc0, 0xde, 0x1f, 0x19, 0x69, 0xa6, 0x84, 0x62, 0xcf, 0xae, - 0x21, 0x7d, 0x1d, 0xad, 0x13, 0x97, 0x60, 0xd2, 0xf3, 0x99, 0x8c, 0x4e, 0x1a, 0x52, 0x00, 0x63, - 0x72, 0x56, 0x49, 0x0f, 0x80, 0x95, 0x20, 0xc0, 0xe9, 0x32, 0xb4, 0x42, 0x2e, 0x28, 0x25, 0xcd, - 0x21, 0x5c, 0x8e, 0xc2, 0x02, 0x4b, 0xef, 0x86, 0xfc, 0x57, 0x38, 0x3d, 0x91, 0x7f, 0x37, 0xe4, - 0x85, 0x92, 0xc2, 0x58, 0x28, 0x85, 0x31, 0xa6, 0xfd, 0x6f, 0xf9, 0x8d, 0x4a, 0x55, 0x88, 0xf9, - 0x5a, 0x2c, 0xe9, 0x46, 0xa5, 0x8a, 0x39, 0x0e, 0xcd, 0xc1, 0x00, 0xfb, 0x11, 0x4e, 0x8f, 0xe4, - 0x07, 0x4c, 0x62, 0x25, 0xb4, 0x1c, 0x7d, 0xac, 0x00, 0x16, 0x05, 0x99, 0x76, 0x97, 0xde, 0x8d, - 0x98, 0x76, 0x77, 0xf0, 0x1e, 0xb5, 0xbb, 0x92, 0x01, 0x8e, 0x79, 0xa1, 0xdb, 0x70, 0xdc, 0xb8, - 0x8f, 0xaa, 0x57, 0x57, 0x90, 0x6f, 0xf8, 0x4d, 0x10, 0xcf, 0x9f, 0x16, 0x8d, 0x3e, 0x5e, 0xc9, - 0xe2, 0x84, 0xb3, 0x2b, 0x40, 0x4d, 0x98, 0xac, 0xa7, 0x6a, 0x1d, 0xea, 0xbd, 0x56, 0x35, 0x2f, - 0xd2, 0x35, 0xa6, 0x19, 0xa3, 0x57, 0x60, 0xe8, 0x6d, 0x9f, 0x3b, 0x69, 0x89, 0xab, 0x89, 0x8c, - 0xf8, 0x31, 0xf4, 0xc6, 0xd5, 0x1a, 0x83, 0x1f, 0xec, 0x97, 0x87, 0xab, 0x7e, 0x43, 0xfe, 0xc5, - 0xaa, 0x00, 0xfa, 0x7e, 0x0b, 0x66, 0xd2, 0x17, 0x5e, 0xd5, 0xe8, 0xd1, 0xde, 0x1b, 0x6d, 0x8b, - 0x4a, 0x67, 0x96, 0x72, 0xd9, 0xe1, 0x0e, 0x55, 0xa1, 0x0f, 0xd1, 0xf5, 0x14, 0xba, 0x77, 0x88, - 0x48, 0x70, 0xfc, 0x48, 0xbc, 0x9e, 0x28, 0xf4, 0x60, 0xbf, 0x3c, 0xce, 0x77, 0x46, 0xf7, 0x8e, - 0x8a, 0x7a, 0xcd, 0x0b, 0xa0, 0xef, 0x82, 0xe3, 0x41, 0x5a, 0x83, 0x4a, 0xa4, 0x10, 0xfe, 0x54, - 0x2f, 0xbb, 0x6c, 0x72, 0xc0, 0x71, 0x16, 0x43, 0x9c, 0x5d, 0x8f, 0xfd, 0xcb, 0x16, 0xd3, 0x6f, - 0x8b, 0x66, 0x91, 0xb0, 0xdd, 0x3c, 0x8a, 0xb4, 0xea, 0x4b, 0x86, 0xed, 0xf8, 0x9e, 0x3d, 0x9b, - 0xfe, 0x85, 0xc5, 0x3c, 0x9b, 0x8e, 0xf0, 0x8d, 0xd6, 0x1b, 0x30, 0x14, 0xc9, 0x74, 0xf7, 0x1d, - 0x32, 0xc1, 0x6b, 0x8d, 0x62, 0xde, 0x5d, 0xea, 0x92, 0xa3, 0x32, 0xdb, 0x2b, 0x36, 0xf6, 0x3f, - 0xe5, 0x23, 0x20, 0x31, 0x47, 0x60, 0xa2, 0x5b, 0x34, 0x4d, 0x74, 0xe5, 0x2e, 0x5f, 0x90, 0x63, - 0xaa, 0xfb, 0x27, 0x66, 0xbb, 0x99, 0x72, 0xef, 0xdd, 0xee, 0x52, 0x67, 0x7f, 0xde, 0x02, 0x88, - 0xd3, 0x0c, 0xf4, 0x90, 0xd0, 0xf4, 0x25, 0x7a, 0xad, 0xf1, 0x23, 0xbf, 0xee, 0x37, 0x85, 0x81, - 0xe2, 0x54, 0x6c, 0x25, 0xe4, 0xf0, 0x03, 0xed, 0x37, 0x56, 0xd4, 0xa8, 0x2c, 0xe3, 0x7e, 0x16, - 0x63, 0xbb, 0xb5, 0x11, 0xf3, 0xf3, 0x4b, 0x16, 0x1c, 0xcb, 0x72, 0xf8, 0xa7, 0x97, 0x64, 0xae, - 0xe6, 0x54, 0xee, 0x8e, 0x6a, 0x34, 0xaf, 0x0b, 0x38, 0x56, 0x14, 0x3d, 0x67, 0x8a, 0x3d, 0x5c, - 0x08, 0xfc, 0xab, 0x30, 0x5a, 0x0d, 0x88, 0x26, 0x5f, 0xbc, 0xc6, 0x23, 0xe9, 0xf0, 0xf6, 0x3c, - 0x73, 0xe8, 0x28, 0x3a, 0xf6, 0x97, 0x0b, 0x70, 0x8c, 0x3b, 0xed, 0xcc, 0xed, 0xfa, 0x6e, 0xa3, - 0xea, 0x37, 0xc4, 0x33, 0xcd, 0x37, 0x61, 0xa4, 0xa5, 0xe9, 0xa6, 0x3b, 0x85, 0x73, 0xd6, 0x75, - 0xd8, 0xb1, 0x36, 0x4d, 0x87, 0x62, 0x83, 0x17, 0x6a, 0xc0, 0x08, 0xd9, 0x75, 0xeb, 0xca, 0xf3, - 0xa3, 0x70, 0xe8, 0x43, 0x5a, 0xd5, 0xb2, 0xa4, 0xf1, 0xc1, 0x06, 0xd7, 0x9e, 0x5d, 0x6d, 0x35, - 0x11, 0xad, 0xaf, 0x8b, 0xb7, 0xc7, 0x8f, 0x58, 0xf0, 0x50, 0x4e, 0xf0, 0x67, 0x5a, 0xdd, 0x2d, - 0xe6, 0x1e, 0x25, 0xa6, 0xad, 0xaa, 0x8e, 0x3b, 0x4d, 0x61, 0x81, 0x45, 0x1f, 0x05, 0xe0, 0x4e, - 0x4f, 0xc4, 0xab, 0x77, 0x8d, 0x92, 0x6b, 0x84, 0x37, 0xd5, 0x22, 0x55, 0xca, 0xf2, 0x58, 0xe3, - 0x65, 0x7f, 0xa9, 0x0f, 0xfa, 0x99, 0x93, 0x0d, 0xaa, 0xc2, 0xe0, 0x16, 0xcf, 0x93, 0xd6, 0x71, - 0xdc, 0x28, 0xad, 0x4c, 0xbd, 0x16, 0x8f, 0x9b, 0x06, 0xc5, 0x92, 0x0d, 0x5a, 0x85, 0x29, 0x9e, - 0xae, 0xae, 0xb9, 0x48, 0x9a, 0xce, 0x9e, 0x54, 0xfb, 0xf2, 0x0c, 0xec, 0x4a, 0xfd, 0x5d, 0x49, - 0x93, 0xe0, 0xac, 0x72, 0xe8, 0x35, 0x18, 0xa3, 0xd7, 0x70, 0xbf, 0x1d, 0x49, 0x4e, 0x3c, 0x51, - 0x9d, 0xba, 0x99, 0xac, 0x1b, 0x58, 0x9c, 0xa0, 0x46, 0xaf, 0xc0, 0x68, 0x2b, 0xa5, 0xe0, 0xee, - 0x8f, 0x35, 0x41, 0xa6, 0x52, 0xdb, 0xa4, 0x65, 0x3e, 0xff, 0x6d, 0xf6, 0xc2, 0x61, 0x7d, 0x2b, - 0x20, 0xe1, 0x96, 0xdf, 0x6c, 0x30, 0x09, 0xb8, 0x5f, 0xf3, 0xf9, 0x4f, 0xe0, 0x71, 0xaa, 0x04, - 0xe5, 0xb2, 0xe1, 0xb8, 0xcd, 0x76, 0x40, 0x62, 0x2e, 0x03, 0x26, 0x97, 0xe5, 0x04, 0x1e, 0xa7, - 0x4a, 0x74, 0xd7, 0xdc, 0x0f, 0xde, 0x1f, 0xcd, 0xbd, 0xfd, 0x93, 0x05, 0x30, 0x86, 0xf6, 0xdb, - 0x38, 0x81, 0xde, 0xab, 0xd0, 0xb7, 0x19, 0xb4, 0xea, 0xc2, 0xa1, 0x2c, 0xf3, 0xcb, 0xe2, 0xec, - 0xd9, 0xfc, 0xcb, 0xe8, 0x7f, 0xcc, 0x4a, 0xd1, 0x35, 0x7e, 0xbc, 0x1a, 0xf8, 0xf4, 0x90, 0x93, - 0xb1, 0x16, 0xd5, 0xd3, 0x9a, 0x41, 0x19, 0x24, 0xa2, 0x43, 0x54, 0x62, 0xf1, 0x3e, 0x80, 0x73, - 0x30, 0x7c, 0xaf, 0x6a, 0x22, 0x14, 0x8c, 0xe4, 0x82, 0x2e, 0xc2, 0xb0, 0xc8, 0x69, 0xc6, 0x5e, - 0x80, 0xf0, 0xc5, 0xc4, 0x7c, 0xc5, 0x16, 0x63, 0x30, 0xd6, 0x69, 0xec, 0x1f, 0x28, 0xc0, 0x54, - 0xc6, 0x13, 0x3e, 0x7e, 0x8c, 0x6c, 0xba, 0x61, 0xa4, 0x12, 0x74, 0x6b, 0xc7, 0x08, 0x87, 0x63, - 0x45, 0x41, 0xf7, 0x2a, 0x7e, 0x50, 0x25, 0x0f, 0x27, 0xf1, 0x44, 0x46, 0x60, 0x0f, 0x99, 0xea, - 0xfa, 0x2c, 0xf4, 0xb5, 0x43, 0x22, 0x23, 0x6a, 0xab, 0x63, 0x9b, 0x99, 0xb5, 0x19, 0x86, 0x5e, - 0x01, 0x37, 0x95, 0x85, 0x58, 0xbb, 0x02, 0x72, 0x1b, 0x31, 0xc7, 0xd1, 0xc6, 0x45, 0xc4, 0x73, - 0xbc, 0x48, 0x5c, 0x14, 0xe3, 0xc0, 0xb8, 0x0c, 0x8a, 0x05, 0xd6, 0xfe, 0x62, 0x11, 0x4e, 0xe6, - 0x3e, 0xea, 0xa5, 0x4d, 0xdf, 0xf1, 0x3d, 0x37, 0xf2, 0x95, 0x13, 0x1e, 0x0f, 0x86, 0x4b, 0x5a, - 0x5b, 0xab, 0x02, 0x8e, 0x15, 0x05, 0x3a, 0x07, 0xfd, 0x4c, 0x29, 0x9e, 0x4a, 0x55, 0x3e, 0xbf, - 0xc8, 0xa3, 0x23, 0x72, 0xb4, 0x76, 0xaa, 0x17, 0x3b, 0x9e, 0xea, 0x8f, 0x52, 0x09, 0xc6, 0x6f, - 0x26, 0x0f, 0x14, 0xda, 0x5c, 0xdf, 0x6f, 0x62, 0x86, 0x44, 0x8f, 0x8b, 0xfe, 0x4a, 0x78, 0x9d, - 0x61, 0xa7, 0xe1, 0x87, 0x5a, 0xa7, 0x3d, 0x09, 0x83, 0xdb, 0x64, 0x2f, 0x70, 0xbd, 0xcd, 0xa4, - 0x37, 0xe2, 0x15, 0x0e, 0xc6, 0x12, 0x6f, 0x66, 0xcd, 0x1d, 0xbc, 0x1f, 0x59, 0x73, 0xf5, 0x19, - 0x30, 0xd4, 0x55, 0x3c, 0xf9, 0xc1, 0x22, 0x8c, 0xe3, 0xf9, 0xc5, 0xf7, 0x06, 0xe2, 0x5a, 0x7a, - 0x20, 0xee, 0x47, 0x72, 0xd9, 0xc3, 0x8d, 0xc6, 0x2f, 0x58, 0x30, 0xce, 0x32, 0xab, 0x89, 0x88, - 0x1c, 0xae, 0xef, 0x1d, 0xc1, 0x55, 0xe0, 0x51, 0xe8, 0x0f, 0x68, 0xa5, 0xc9, 0x1c, 0xe5, 0xac, - 0x25, 0x98, 0xe3, 0xd0, 0x29, 0xe8, 0x63, 0x4d, 0xa0, 0x83, 0x37, 0xc2, 0xb7, 0xe0, 0x45, 0x27, - 0x72, 0x30, 0x83, 0xb2, 0xd8, 0x80, 0x98, 0xb4, 0x9a, 0x2e, 0x6f, 0x74, 0xec, 0xb2, 0xf0, 0xee, - 0x08, 0xf7, 0x91, 0xd9, 0xb4, 0x77, 0x16, 0x1b, 0x30, 0x9b, 0x65, 0xe7, 0x6b, 0xf6, 0x9f, 0x15, - 0xe0, 0x4c, 0x66, 0xb9, 0x9e, 0x63, 0x03, 0x76, 0x2e, 0xfd, 0x20, 0x93, 0x44, 0x15, 0x8f, 0xd0, - 0xd7, 0xbb, 0xaf, 0x57, 0xe9, 0xbf, 0xbf, 0x87, 0x90, 0x7d, 0x99, 0x5d, 0xf6, 0x2e, 0x09, 0xd9, - 0x97, 0xd9, 0xb6, 0x1c, 0x35, 0xc1, 0x5f, 0x15, 0x72, 0xbe, 0x85, 0x29, 0x0c, 0xce, 0xd3, 0x7d, - 0x86, 0x21, 0x43, 0x79, 0x09, 0xe7, 0x7b, 0x0c, 0x87, 0x61, 0x85, 0x45, 0x73, 0x30, 0xbe, 0xe3, - 0x7a, 0x74, 0xf3, 0xd9, 0x33, 0x45, 0x71, 0x65, 0xcb, 0x58, 0x35, 0xd1, 0x38, 0x49, 0x8f, 0x5c, - 0x2d, 0x9c, 0x1f, 0xff, 0xba, 0x57, 0x0e, 0xb5, 0xea, 0x66, 0x4d, 0x77, 0x0e, 0xd5, 0x8b, 0x19, - 0xa1, 0xfd, 0x56, 0x35, 0x3d, 0x51, 0xb1, 0x77, 0x3d, 0xd1, 0x48, 0xb6, 0x8e, 0x68, 0xe6, 0x15, - 0x18, 0xbd, 0x67, 0xdb, 0x88, 0xfd, 0xf5, 0x22, 0x3c, 0xdc, 0x61, 0xd9, 0xf3, 0xbd, 0xde, 0x18, - 0x03, 0x6d, 0xaf, 0x4f, 0x8d, 0x43, 0x15, 0x8e, 0x6d, 0xb4, 0x9b, 0xcd, 0x3d, 0xf6, 0xa8, 0x89, - 0x34, 0x24, 0x85, 0x90, 0x29, 0xa5, 0x72, 0xe4, 0xd8, 0x72, 0x06, 0x0d, 0xce, 0x2c, 0x49, 0xaf, - 0x58, 0xf4, 0x24, 0xd9, 0x53, 0xac, 0x12, 0x57, 0x2c, 0xac, 0x23, 0xb1, 0x49, 0x8b, 0x2e, 0xc1, - 0xa4, 0xb3, 0xeb, 0xb8, 0x3c, 0x27, 0x82, 0x64, 0xc0, 0xef, 0x58, 0x4a, 0x17, 0x3d, 0x97, 0x24, - 0xc0, 0xe9, 0x32, 0xe8, 0x75, 0x40, 0xfe, 0x4d, 0xf6, 0x50, 0xa2, 0x71, 0x89, 0x78, 0xc2, 0xea, - 0xce, 0xc6, 0xae, 0x18, 0x6f, 0x09, 0x57, 0x53, 0x14, 0x38, 0xa3, 0x54, 0x22, 0xb0, 0xdc, 0x40, - 0x7e, 0x60, 0xb9, 0xce, 0xfb, 0x62, 0xd7, 0xfc, 0x64, 0x17, 0x61, 0xf4, 0x90, 0xee, 0xbf, 0xf6, - 0x7f, 0xb2, 0x40, 0x29, 0x88, 0xcd, 0xc0, 0xd0, 0xaf, 0x30, 0xff, 0x64, 0xae, 0xda, 0xd6, 0x62, - 0x41, 0x1d, 0xd7, 0xfc, 0x93, 0x63, 0x24, 0x36, 0x69, 0xf9, 0x1c, 0xd2, 0xfc, 0x8a, 0x8d, 0x5b, - 0x81, 0x88, 0x5b, 0xa9, 0x28, 0xd0, 0xc7, 0x60, 0xb0, 0xe1, 0xee, 0xba, 0xa1, 0x50, 0x8e, 0x1d, - 0xda, 0x18, 0x17, 0x6f, 0x9d, 0x8b, 0x9c, 0x0d, 0x96, 0xfc, 0xec, 0x1f, 0x2c, 0xc4, 0x7d, 0xf2, - 0x46, 0xdb, 0x8f, 0x9c, 0x23, 0x38, 0xc9, 0x2f, 0x19, 0x27, 0xf9, 0xe3, 0xd9, 0x03, 0xad, 0x35, - 0x29, 0xf7, 0x04, 0xbf, 0x9a, 0x38, 0xc1, 0x9f, 0xe8, 0xce, 0xaa, 0xf3, 0xc9, 0xfd, 0xcf, 0x2c, - 0x98, 0x34, 0xe8, 0x8f, 0xe0, 0x00, 0x59, 0x36, 0x0f, 0x90, 0x47, 0xba, 0x7e, 0x43, 0xce, 0xc1, - 0xf1, 0x7d, 0xc5, 0x44, 0xdb, 0xd9, 0x81, 0xf1, 0x36, 0xf4, 0x6d, 0x39, 0x41, 0x43, 0xdc, 0x8b, - 0x2f, 0xf4, 0xd4, 0xd7, 0xb3, 0x97, 0x9d, 0x40, 0x78, 0x2a, 0x3c, 0x23, 0x7b, 0x9d, 0x82, 0xba, - 0x7a, 0x29, 0xb0, 0xaa, 0xd0, 0x4b, 0x30, 0x10, 0xd6, 0xfd, 0x96, 0x7a, 0x33, 0xc5, 0x92, 0xde, - 0xd6, 0x18, 0xe4, 0x60, 0xbf, 0x8c, 0xcc, 0xea, 0x28, 0x18, 0x0b, 0x7a, 0xf4, 0x26, 0x8c, 0xb2, - 0x5f, 0xca, 0x6d, 0xb0, 0x98, 0xaf, 0xc1, 0xa8, 0xe9, 0x84, 0xdc, 0xa7, 0xd6, 0x00, 0x61, 0x93, - 0xd5, 0xcc, 0x26, 0x94, 0xd4, 0x67, 0x3d, 0x50, 0x6b, 0xf7, 0xbf, 0x2f, 0xc2, 0x54, 0xc6, 0x9c, - 0x43, 0xa1, 0x31, 0x12, 0x17, 0x7b, 0x9c, 0xaa, 0xef, 0x70, 0x2c, 0x42, 0x76, 0x81, 0x6a, 0x88, - 0xb9, 0xd5, 0x73, 0xa5, 0xd7, 0x42, 0x92, 0xac, 0x94, 0x82, 0xba, 0x57, 0x4a, 0x2b, 0x3b, 0xb2, - 0xae, 0xa6, 0x15, 0xa9, 0x96, 0x3e, 0xd0, 0x31, 0xfd, 0xb5, 0x3e, 0x38, 0x96, 0x15, 0x4f, 0x18, - 0x7d, 0x26, 0x91, 0x49, 0xfb, 0x85, 0x4e, 0x3d, 0xac, 0x97, 0xe4, 0xe9, 0xb5, 0x45, 0x18, 0xcf, - 0x59, 0x33, 0xb7, 0x76, 0xd7, 0x6e, 0x16, 0x75, 0xb2, 0xf0, 0x3a, 0x01, 0xcf, 0x80, 0x2e, 0xb7, - 0x8f, 0x0f, 0xf4, 0xdc, 0x00, 0x91, 0x3a, 0x3d, 0x4c, 0xb8, 0x24, 0x49, 0x70, 0x77, 0x97, 0x24, - 0x59, 0x33, 0xaa, 0xc0, 0x40, 0x9d, 0xfb, 0xba, 0x14, 0xbb, 0x6f, 0x61, 0xdc, 0xd1, 0x45, 0x6d, - 0xc0, 0xc2, 0xc1, 0x45, 0x30, 0x98, 0x71, 0x61, 0x58, 0xeb, 0x98, 0x07, 0x3a, 0x79, 0xb6, 0xe9, - 0xc1, 0xa7, 0x75, 0xc1, 0x03, 0x9d, 0x40, 0x3f, 0x62, 0x41, 0xe2, 0xc1, 0x8b, 0x52, 0xca, 0x59, - 0xb9, 0x4a, 0xb9, 0xb3, 0xd0, 0x17, 0xf8, 0x4d, 0x92, 0x4c, 0xd3, 0x8c, 0xfd, 0x26, 0xc1, 0x0c, - 0x43, 0x29, 0xa2, 0x58, 0xd5, 0x32, 0xa2, 0x5f, 0x23, 0xc5, 0x05, 0xf1, 0x51, 0xe8, 0x6f, 0x92, - 0x5d, 0xd2, 0x4c, 0x66, 0xd3, 0x5b, 0xa1, 0x40, 0xcc, 0x71, 0xf6, 0x2f, 0xf4, 0xc1, 0xe9, 0x8e, - 0xb1, 0xae, 0xe8, 0x65, 0x6c, 0xd3, 0x89, 0xc8, 0x2d, 0x67, 0x2f, 0x99, 0xf4, 0xeb, 0x12, 0x07, - 0x63, 0x89, 0x67, 0xcf, 0x3f, 0x79, 0xee, 0x8e, 0x84, 0x0a, 0x53, 0xa4, 0xec, 0x10, 0x58, 0x53, - 0x25, 0x56, 0xbc, 0x1f, 0x2a, 0xb1, 0xe7, 0x00, 0xc2, 0xb0, 0xc9, 0xdd, 0x02, 0x1b, 0xe2, 0x5d, - 0x69, 0x9c, 0xe3, 0xa5, 0xb6, 0x22, 0x30, 0x58, 0xa3, 0x42, 0x8b, 0x30, 0xd1, 0x0a, 0xfc, 0x88, - 0x6b, 0x84, 0x17, 0xb9, 0xe7, 0x6c, 0xbf, 0x19, 0x66, 0xa8, 0x9a, 0xc0, 0xe3, 0x54, 0x09, 0xf4, - 0x22, 0x0c, 0x8b, 0xd0, 0x43, 0x55, 0xdf, 0x6f, 0x0a, 0x25, 0x94, 0x72, 0x26, 0xad, 0xc5, 0x28, - 0xac, 0xd3, 0x69, 0xc5, 0x98, 0x9a, 0x79, 0x30, 0xb3, 0x18, 0x57, 0x35, 0x6b, 0x74, 0x89, 0x30, - 0xe5, 0x43, 0x3d, 0x85, 0x29, 0x8f, 0xd5, 0x72, 0xa5, 0x9e, 0xad, 0x9e, 0xd0, 0x55, 0x91, 0xf5, - 0x95, 0x3e, 0x98, 0x12, 0x13, 0xe7, 0x41, 0x4f, 0x97, 0x6b, 0xe9, 0xe9, 0x72, 0x3f, 0x14, 0x77, - 0xef, 0xcd, 0x99, 0xa3, 0x9e, 0x33, 0x3f, 0x64, 0x81, 0x29, 0xa9, 0xa1, 0xff, 0x3f, 0x37, 0x6b, - 0xe2, 0x8b, 0xb9, 0x92, 0x5f, 0x1c, 0xc3, 0xf8, 0x9d, 0xe5, 0x4f, 0xb4, 0xff, 0x83, 0x05, 0x8f, - 0x74, 0xe5, 0x88, 0x96, 0xa0, 0xc4, 0xc4, 0x49, 0xed, 0xa2, 0xf7, 0x84, 0xf2, 0xac, 0x97, 0x88, - 0x1c, 0xe9, 0x36, 0x2e, 0x89, 0x96, 0x52, 0xe9, 0x29, 0x9f, 0xcc, 0x48, 0x4f, 0x79, 0xdc, 0xe8, - 0x9e, 0x7b, 0xcc, 0x4f, 0xf9, 0x05, 0x7a, 0xe2, 0x18, 0xaf, 0xda, 0xd0, 0x07, 0x0c, 0xa5, 0xa3, - 0x9d, 0x50, 0x3a, 0x22, 0x93, 0x5a, 0x3b, 0x43, 0x3e, 0x02, 0x13, 0x2c, 0x26, 0x21, 0x7b, 0xe7, - 0x21, 0xde, 0xdb, 0x15, 0x62, 0x5f, 0xee, 0x95, 0x04, 0x0e, 0xa7, 0xa8, 0xed, 0x3f, 0x29, 0xc2, - 0x00, 0x5f, 0x7e, 0x47, 0x70, 0xbd, 0x7c, 0x1a, 0x4a, 0xee, 0xce, 0x4e, 0x9b, 0x67, 0x1c, 0xec, - 0x8f, 0x3d, 0x83, 0x2b, 0x12, 0x88, 0x63, 0x3c, 0x5a, 0x16, 0xfa, 0xee, 0x0e, 0x61, 0x8f, 0x79, - 0xc3, 0x67, 0x17, 0x9d, 0xc8, 0xe1, 0xb2, 0x92, 0x3a, 0x67, 0x63, 0xcd, 0x38, 0xfa, 0x24, 0x40, - 0x18, 0x05, 0xae, 0xb7, 0x49, 0x61, 0x22, 0x36, 0xfe, 0x53, 0x1d, 0xb8, 0xd5, 0x14, 0x31, 0xe7, - 0x19, 0xef, 0x39, 0x0a, 0x81, 0x35, 0x8e, 0x68, 0xd6, 0x38, 0xe9, 0x67, 0x12, 0x63, 0x07, 0x9c, - 0x6b, 0x3c, 0x66, 0x33, 0x1f, 0x84, 0x92, 0x62, 0xde, 0x4d, 0xfb, 0x35, 0xa2, 0x8b, 0x45, 0x1f, - 0x86, 0xf1, 0x44, 0xdb, 0x0e, 0xa5, 0x3c, 0xfb, 0x45, 0x0b, 0xc6, 0x79, 0x63, 0x96, 0xbc, 0x5d, - 0x71, 0x1a, 0xdc, 0x81, 0x63, 0xcd, 0x8c, 0x5d, 0x59, 0x0c, 0x7f, 0xef, 0xbb, 0xb8, 0x52, 0x96, - 0x65, 0x61, 0x71, 0x66, 0x1d, 0xe8, 0x3c, 0x5d, 0x71, 0x74, 0xd7, 0x75, 0x9a, 0x22, 0xbe, 0xc1, - 0x08, 0x5f, 0x6d, 0x1c, 0x86, 0x15, 0xd6, 0xfe, 0x03, 0x0b, 0x26, 0x79, 0xcb, 0xaf, 0x90, 0x3d, - 0xb5, 0x37, 0x7d, 0x33, 0xdb, 0x2e, 0x72, 0xdd, 0x16, 0x72, 0x72, 0xdd, 0xea, 0x9f, 0x56, 0xec, - 0xf8, 0x69, 0x5f, 0xb6, 0x40, 0xcc, 0x90, 0x23, 0xd0, 0x67, 0x7c, 0x87, 0xa9, 0xcf, 0x98, 0xc9, - 0x5f, 0x04, 0x39, 0x8a, 0x8c, 0xbf, 0xb4, 0x60, 0x82, 0x13, 0xc4, 0xb6, 0xfa, 0x6f, 0xea, 0x38, - 0xcc, 0x9b, 0x5f, 0x94, 0xe9, 0x7c, 0x79, 0x85, 0xec, 0xad, 0xfb, 0x55, 0x27, 0xda, 0xca, 0xfe, - 0x28, 0x63, 0xb0, 0xfa, 0x3a, 0x0e, 0x56, 0x43, 0x2e, 0x20, 0x23, 0x15, 0x5c, 0x97, 0x00, 0x01, - 0x87, 0x4d, 0x05, 0x67, 0xff, 0xa9, 0x05, 0x88, 0x57, 0x63, 0x08, 0x6e, 0x54, 0x1c, 0x62, 0x50, - 0xed, 0xa0, 0x8b, 0xb7, 0x26, 0x85, 0xc1, 0x1a, 0xd5, 0x7d, 0xe9, 0x9e, 0x84, 0xc3, 0x45, 0xb1, - 0xbb, 0xc3, 0xc5, 0x21, 0x7a, 0xf4, 0xdf, 0x0c, 0x40, 0xf2, 0x65, 0x1f, 0xba, 0x0e, 0x23, 0x75, - 0xa7, 0xe5, 0xdc, 0x74, 0x9b, 0x6e, 0xe4, 0x92, 0xb0, 0x93, 0x37, 0xd6, 0x82, 0x46, 0x27, 0x4c, - 0xe4, 0x1a, 0x04, 0x1b, 0x7c, 0xd0, 0x2c, 0x40, 0x2b, 0x70, 0x77, 0xdd, 0x26, 0xd9, 0x64, 0x6a, - 0x17, 0x16, 0x51, 0x85, 0xbb, 0x86, 0x49, 0x28, 0xd6, 0x28, 0x32, 0xc2, 0x28, 0x14, 0x1f, 0x70, - 0x18, 0x05, 0x38, 0xb2, 0x30, 0x0a, 0x7d, 0x87, 0x0a, 0xa3, 0x30, 0x74, 0xe8, 0x30, 0x0a, 0xfd, - 0x3d, 0x85, 0x51, 0xc0, 0x70, 0x42, 0xca, 0x9e, 0xf4, 0xff, 0xb2, 0xdb, 0x24, 0xe2, 0xc2, 0xc1, - 0xc3, 0xc0, 0xcc, 0xdc, 0xdd, 0x2f, 0x9f, 0xc0, 0x99, 0x14, 0x38, 0xa7, 0x24, 0xfa, 0x28, 0x4c, - 0x3b, 0xcd, 0xa6, 0x7f, 0x4b, 0x0d, 0xea, 0x52, 0x58, 0x77, 0x9a, 0xdc, 0x04, 0x32, 0xc8, 0xb8, - 0x9e, 0xba, 0xbb, 0x5f, 0x9e, 0x9e, 0xcb, 0xa1, 0xc1, 0xb9, 0xa5, 0xd1, 0xab, 0x50, 0x6a, 0x05, - 0x7e, 0x7d, 0x55, 0x7b, 0x7e, 0x7c, 0x86, 0x76, 0x60, 0x55, 0x02, 0x0f, 0xf6, 0xcb, 0xa3, 0xea, - 0x0f, 0x3b, 0xf0, 0xe3, 0x02, 0x19, 0x71, 0x11, 0x86, 0xef, 0x6b, 0x5c, 0x84, 0x6d, 0x98, 0xaa, - 0x91, 0xc0, 0x75, 0x9a, 0xee, 0x1d, 0x2a, 0x2f, 0xcb, 0xfd, 0x69, 0x1d, 0x4a, 0x41, 0x62, 0x47, - 0xee, 0x29, 0x14, 0xb1, 0x96, 0x8d, 0x4b, 0xee, 0xc0, 0x31, 0x23, 0xfb, 0x7f, 0x5b, 0x30, 0x28, - 0x5e, 0xf2, 0x1d, 0x81, 0xd4, 0x38, 0x67, 0x18, 0x25, 0xca, 0xd9, 0x1d, 0xc6, 0x1a, 0x93, 0x6b, - 0x8e, 0xa8, 0x24, 0xcc, 0x11, 0x8f, 0x74, 0x62, 0xd2, 0xd9, 0x10, 0xf1, 0x77, 0x8a, 0x54, 0x7a, - 0x37, 0xde, 0x94, 0x3f, 0xf8, 0x2e, 0x58, 0x83, 0xc1, 0x50, 0xbc, 0x69, 0x2e, 0xe4, 0xbf, 0x06, - 0x49, 0x0e, 0x62, 0xec, 0x45, 0x27, 0x5e, 0x31, 0x4b, 0x26, 0x99, 0x8f, 0xa5, 0x8b, 0x0f, 0xf0, - 0xb1, 0x74, 0xb7, 0x57, 0xf7, 0x7d, 0xf7, 0xe3, 0xd5, 0xbd, 0xfd, 0x35, 0x76, 0x72, 0xea, 0xf0, - 0x23, 0x10, 0xaa, 0x2e, 0x99, 0x67, 0xac, 0xdd, 0x61, 0x66, 0x89, 0x46, 0xe5, 0x08, 0x57, 0x3f, - 0x6f, 0xc1, 0xe9, 0x8c, 0xaf, 0xd2, 0x24, 0xad, 0x67, 0x60, 0xc8, 0x69, 0x37, 0x5c, 0xb5, 0x96, - 0x35, 0xd3, 0xe4, 0x9c, 0x80, 0x63, 0x45, 0x81, 0x16, 0x60, 0x92, 0xdc, 0x6e, 0xb9, 0xdc, 0x90, - 0xab, 0x3b, 0x1f, 0x17, 0xf9, 0xf3, 0xcf, 0xa5, 0x24, 0x12, 0xa7, 0xe9, 0x55, 0x80, 0xa8, 0x62, - 0x6e, 0x80, 0xa8, 0x9f, 0xb5, 0x60, 0x58, 0xbd, 0xea, 0x7d, 0xe0, 0xbd, 0xfd, 0x11, 0xb3, 0xb7, - 0x1f, 0xee, 0xd0, 0xdb, 0x39, 0xdd, 0xfc, 0x7b, 0x05, 0xd5, 0xde, 0xaa, 0x1f, 0x44, 0x3d, 0x48, - 0x70, 0xf7, 0xfe, 0x70, 0xe2, 0x22, 0x0c, 0x3b, 0xad, 0x96, 0x44, 0x48, 0x0f, 0x38, 0x16, 0x58, - 0x3e, 0x06, 0x63, 0x9d, 0x46, 0xbd, 0xe3, 0x28, 0xe6, 0xbe, 0xe3, 0x68, 0x00, 0x44, 0x4e, 0xb0, - 0x49, 0x22, 0x0a, 0x13, 0x0e, 0xbb, 0xf9, 0xfb, 0x4d, 0x3b, 0x72, 0x9b, 0xb3, 0xae, 0x17, 0x85, - 0x51, 0x30, 0x5b, 0xf1, 0xa2, 0xab, 0x01, 0xbf, 0x42, 0x6a, 0x21, 0xd6, 0x14, 0x2f, 0xac, 0xf1, - 0x95, 0x11, 0x2c, 0x58, 0x1d, 0xfd, 0xa6, 0x2b, 0xc5, 0x9a, 0x80, 0x63, 0x45, 0x61, 0x7f, 0x90, - 0x9d, 0x3e, 0xac, 0x4f, 0x0f, 0x17, 0x5e, 0xec, 0xcf, 0x46, 0xd4, 0x68, 0x30, 0xa3, 0xe8, 0xa2, - 0x1e, 0xc4, 0xac, 0xf3, 0x66, 0x4f, 0x2b, 0xd6, 0x5f, 0x44, 0xc6, 0x91, 0xce, 0xd0, 0xc7, 0x53, - 0xee, 0x31, 0xcf, 0x76, 0x39, 0x35, 0x0e, 0xe1, 0x10, 0xc3, 0xb2, 0x4c, 0xb1, 0x1c, 0x3c, 0x95, - 0xaa, 0x58, 0x17, 0x5a, 0x96, 0x29, 0x81, 0xc0, 0x31, 0x0d, 0x15, 0xa6, 0xd4, 0x9f, 0x70, 0x1a, - 0xc5, 0xc1, 0x88, 0x15, 0x75, 0x88, 0x35, 0x0a, 0x74, 0x41, 0x28, 0x14, 0xb8, 0x5d, 0xe0, 0xe1, - 0x84, 0x42, 0x41, 0x76, 0x97, 0xa6, 0x05, 0xba, 0x08, 0xc3, 0xe4, 0x76, 0x44, 0x02, 0xcf, 0x69, - 0xd2, 0x1a, 0xfa, 0xe3, 0xf8, 0x99, 0x4b, 0x31, 0x18, 0xeb, 0x34, 0x68, 0x1d, 0xc6, 0x43, 0xae, - 0x67, 0x53, 0x21, 0xf0, 0xb9, 0xbe, 0xf2, 0x29, 0xf5, 0x9e, 0xda, 0x44, 0x1f, 0x30, 0x10, 0xdf, - 0x9d, 0x64, 0x94, 0x89, 0x24, 0x0b, 0xf4, 0x1a, 0x8c, 0x35, 0x7d, 0xa7, 0x31, 0xef, 0x34, 0x1d, - 0xaf, 0xce, 0xfa, 0x67, 0xc8, 0xcc, 0x55, 0xbe, 0x62, 0x60, 0x71, 0x82, 0x9a, 0x0a, 0x6f, 0x3a, - 0x44, 0x84, 0x69, 0x73, 0xbc, 0x4d, 0x12, 0x4e, 0x97, 0xd8, 0x57, 0x31, 0xe1, 0x6d, 0x25, 0x87, - 0x06, 0xe7, 0x96, 0x46, 0x2f, 0xc1, 0x88, 0xfc, 0x7c, 0x2d, 0x28, 0x4b, 0xfc, 0x24, 0x46, 0xc3, - 0x61, 0x83, 0x12, 0x85, 0x70, 0x5c, 0xfe, 0x5f, 0x0f, 0x9c, 0x8d, 0x0d, 0xb7, 0x2e, 0x22, 0x15, - 0xf0, 0xe7, 0xc3, 0x1f, 0x96, 0x6f, 0x15, 0x97, 0xb2, 0x88, 0x0e, 0xf6, 0xcb, 0xa7, 0x44, 0xaf, - 0x65, 0xe2, 0x71, 0x36, 0x6f, 0xb4, 0x0a, 0x53, 0x5b, 0xc4, 0x69, 0x46, 0x5b, 0x0b, 0x5b, 0xa4, - 0xbe, 0x2d, 0x17, 0x1c, 0x0b, 0xf3, 0xa2, 0x3d, 0x1d, 0xb9, 0x9c, 0x26, 0xc1, 0x59, 0xe5, 0xd0, - 0x5b, 0x30, 0xdd, 0x6a, 0xdf, 0x6c, 0xba, 0xe1, 0xd6, 0x9a, 0x1f, 0x31, 0x27, 0xa4, 0xb9, 0x46, - 0x23, 0x20, 0x21, 0x7f, 0x5d, 0xca, 0x8e, 0x5e, 0x19, 0x48, 0xa7, 0x9a, 0x43, 0x87, 0x73, 0x39, - 0xa0, 0x3b, 0x70, 0x3c, 0x31, 0x11, 0x44, 0x44, 0x8c, 0xb1, 0xfc, 0x04, 0x38, 0xb5, 0xac, 0x02, - 0x22, 0xb8, 0x4c, 0x16, 0x0a, 0x67, 0x57, 0x81, 0x5e, 0x06, 0x70, 0x5b, 0xcb, 0xce, 0x8e, 0xdb, - 0xa4, 0x57, 0xc5, 0x29, 0x36, 0x47, 0xe8, 0xb5, 0x01, 0x2a, 0x55, 0x09, 0xa5, 0x7b, 0xb3, 0xf8, - 0xb7, 0x87, 0x35, 0x6a, 0xb4, 0x02, 0x63, 0xe2, 0xdf, 0x9e, 0x18, 0xd2, 0x49, 0x95, 0x2b, 0x71, - 0x4c, 0x96, 0x50, 0xe3, 0x98, 0x80, 0xe0, 0x44, 0x59, 0xb4, 0x09, 0xa7, 0x65, 0xa2, 0x46, 0x7d, - 0x7e, 0xca, 0x31, 0x08, 0x59, 0xd6, 0x99, 0x21, 0xfe, 0x2a, 0x65, 0xae, 0x13, 0x21, 0xee, 0xcc, - 0x87, 0x9e, 0xeb, 0xfa, 0x34, 0xe7, 0x6f, 0x8e, 0x8f, 0xc7, 0x11, 0x07, 0x57, 0x92, 0x48, 0x9c, - 0xa6, 0x47, 0x3e, 0x1c, 0x77, 0xbd, 0xac, 0x59, 0x7d, 0x82, 0x31, 0xfa, 0x10, 0x7f, 0x6e, 0xdd, - 0x79, 0x46, 0x67, 0xe2, 0x71, 0x36, 0x5f, 0x54, 0x81, 0xa9, 0x88, 0x03, 0x16, 0xdd, 0x90, 0x27, - 0xb5, 0xa0, 0x57, 0xb2, 0x87, 0x78, 0x2a, 0x79, 0x3a, 0x9b, 0xd7, 0xd3, 0x68, 0x9c, 0x55, 0xe6, - 0x9d, 0xb9, 0x10, 0xfe, 0xbe, 0x45, 0x4b, 0x6b, 0x82, 0x3e, 0xfa, 0x14, 0x8c, 0xe8, 0xfd, 0x23, - 0x84, 0x96, 0x73, 0xd9, 0x72, 0xb0, 0xb6, 0xbd, 0xf0, 0x6b, 0x82, 0xda, 0x42, 0x74, 0x1c, 0x36, - 0x38, 0xa2, 0x7a, 0x46, 0x98, 0x84, 0x0b, 0xbd, 0x09, 0x45, 0xbd, 0x7b, 0xd0, 0x11, 0xc8, 0x5e, - 0x39, 0x68, 0x05, 0x86, 0xea, 0x4d, 0x97, 0x78, 0x51, 0xa5, 0xda, 0x29, 0x10, 0xe4, 0x82, 0xa0, - 0x11, 0x4b, 0x51, 0xe4, 0xa2, 0xe1, 0x30, 0xac, 0x38, 0xd8, 0x2f, 0xc1, 0x70, 0xad, 0x49, 0x48, - 0x8b, 0xbf, 0x04, 0x42, 0x4f, 0xb2, 0x8b, 0x09, 0x13, 0x2d, 0x2d, 0x26, 0x5a, 0xea, 0x77, 0x0e, - 0x26, 0x54, 0x4a, 0xbc, 0xfd, 0x1b, 0x05, 0x28, 0x77, 0x49, 0x89, 0x94, 0xb0, 0x85, 0x59, 0x3d, - 0xd9, 0xc2, 0xe6, 0x60, 0x3c, 0xfe, 0xa7, 0xab, 0xd9, 0x94, 0x3b, 0xed, 0x75, 0x13, 0x8d, 0x93, - 0xf4, 0x3d, 0xbf, 0x8c, 0xd0, 0xcd, 0x69, 0x7d, 0x5d, 0xdf, 0xf6, 0x18, 0x66, 0xf4, 0xfe, 0xde, - 0xef, 0xde, 0xb9, 0x26, 0x51, 0xfb, 0x6b, 0x05, 0x38, 0xae, 0xba, 0xf0, 0xdb, 0xb7, 0xe3, 0xae, - 0xa5, 0x3b, 0xee, 0x3e, 0x18, 0x94, 0xed, 0xab, 0x30, 0xc0, 0x63, 0x62, 0xf6, 0x20, 0xf3, 0x3f, - 0x6a, 0x86, 0xea, 0x56, 0x62, 0xa6, 0x11, 0xae, 0xfb, 0xfb, 0x2d, 0x18, 0x4f, 0x3c, 0xb1, 0x43, - 0x58, 0x7b, 0x87, 0x7d, 0x2f, 0x72, 0x79, 0x96, 0xc4, 0x7f, 0x16, 0xfa, 0xb6, 0xfc, 0x30, 0x4a, - 0x7a, 0x9b, 0x5c, 0xf6, 0xc3, 0x08, 0x33, 0x8c, 0xfd, 0x87, 0x16, 0xf4, 0xaf, 0x3b, 0xae, 0x17, - 0x49, 0xcb, 0x84, 0x95, 0x63, 0x99, 0xe8, 0xe5, 0xbb, 0xd0, 0x8b, 0x30, 0x40, 0x36, 0x36, 0x48, - 0x3d, 0x12, 0xa3, 0x2a, 0xe3, 0x31, 0x0c, 0x2c, 0x31, 0x28, 0x15, 0x42, 0x59, 0x65, 0xfc, 0x2f, - 0x16, 0xc4, 0xe8, 0x06, 0x94, 0x22, 0x77, 0x87, 0xcc, 0x35, 0x1a, 0xc2, 0x5e, 0x7f, 0x0f, 0x41, - 0x44, 0xd6, 0x25, 0x03, 0x1c, 0xf3, 0xb2, 0xbf, 0x58, 0x00, 0x88, 0x83, 0x89, 0x75, 0xfb, 0xc4, - 0xf9, 0x94, 0x25, 0xf7, 0x5c, 0x86, 0x25, 0x17, 0xc5, 0x0c, 0x33, 0xcc, 0xb8, 0xaa, 0x9b, 0x8a, - 0x3d, 0x75, 0x53, 0xdf, 0x61, 0xba, 0x69, 0x01, 0x26, 0xe3, 0x60, 0x68, 0x66, 0x2c, 0x48, 0x76, - 0x7e, 0xaf, 0x27, 0x91, 0x38, 0x4d, 0x6f, 0x13, 0x38, 0xab, 0x62, 0x42, 0x89, 0xb3, 0x90, 0x39, - 0xa3, 0xeb, 0x96, 0xf1, 0x2e, 0xfd, 0x14, 0x9b, 0xaa, 0x0b, 0xb9, 0xa6, 0xea, 0x1f, 0xb7, 0xe0, - 0x58, 0xb2, 0x1e, 0xf6, 0x72, 0xfb, 0xf3, 0x16, 0x1c, 0x8f, 0x33, 0x82, 0xa4, 0xdd, 0x03, 0x5e, - 0xe8, 0x18, 0xe7, 0x2a, 0xa7, 0xc5, 0x71, 0xe0, 0x8f, 0xd5, 0x2c, 0xd6, 0x38, 0xbb, 0x46, 0xfb, - 0x7f, 0xf5, 0xc1, 0x74, 0x5e, 0x80, 0x2c, 0xf6, 0x56, 0xc5, 0xb9, 0x5d, 0xdb, 0x26, 0xb7, 0xc4, - 0x8b, 0x80, 0xf8, 0xad, 0x0a, 0x07, 0x63, 0x89, 0x4f, 0x26, 0x81, 0x29, 0xf4, 0x98, 0x04, 0x66, - 0x0b, 0x26, 0x6f, 0x6d, 0x11, 0xef, 0x9a, 0x17, 0x3a, 0x91, 0x1b, 0x6e, 0xb8, 0xcc, 0xb8, 0xcd, - 0xe7, 0x8d, 0x4c, 0x64, 0x3e, 0x79, 0x23, 0x49, 0x70, 0xb0, 0x5f, 0x3e, 0x6d, 0x00, 0xe2, 0x26, - 0xf3, 0x8d, 0x04, 0xa7, 0x99, 0xa6, 0x73, 0xe8, 0xf4, 0x3d, 0xe0, 0x1c, 0x3a, 0x3b, 0xae, 0x70, - 0x89, 0x91, 0x0f, 0x11, 0xd8, 0xb5, 0x75, 0x55, 0x41, 0xb1, 0x46, 0x81, 0x3e, 0x01, 0x48, 0x4f, - 0x82, 0x66, 0xc4, 0x27, 0x7d, 0xf6, 0xee, 0x7e, 0x19, 0xad, 0xa5, 0xb0, 0x07, 0xfb, 0xe5, 0x29, - 0x0a, 0xad, 0x78, 0xf4, 0xfa, 0x1b, 0x07, 0x75, 0xcb, 0x60, 0x84, 0x6e, 0xc0, 0x04, 0x85, 0xb2, - 0x15, 0x25, 0x83, 0x9f, 0xf2, 0x2b, 0xeb, 0xd3, 0x77, 0xf7, 0xcb, 0x13, 0x6b, 0x09, 0x5c, 0x1e, - 0xeb, 0x14, 0x93, 0x8c, 0x54, 0x3a, 0x43, 0xbd, 0xa6, 0xd2, 0xb1, 0x3f, 0x6f, 0xc1, 0x49, 0x7a, - 0xc0, 0x35, 0x56, 0x72, 0x2c, 0xdc, 0x4e, 0xcb, 0xe5, 0x36, 0x14, 0x71, 0xd4, 0x30, 0x5d, 0x5d, - 0xb5, 0xc2, 0x2d, 0x28, 0x0a, 0x4b, 0x77, 0xf8, 0x6d, 0xd7, 0x6b, 0x24, 0x77, 0xf8, 0x2b, 0xae, - 0xd7, 0xc0, 0x0c, 0xa3, 0x8e, 0xac, 0x62, 0xee, 0x7b, 0x88, 0xaf, 0xd0, 0xb5, 0x4a, 0xdb, 0xf2, - 0x4d, 0x6d, 0x06, 0x7a, 0x5a, 0xb7, 0x77, 0x0a, 0xd7, 0xc6, 0x5c, 0x5b, 0xe7, 0xe7, 0x2c, 0x10, - 0xef, 0xa7, 0x7b, 0x38, 0x93, 0xdf, 0x84, 0x91, 0xdd, 0x74, 0x82, 0xc8, 0xb3, 0xf9, 0x0f, 0xca, - 0x45, 0xd8, 0x77, 0x25, 0xa2, 0x1b, 0xc9, 0x20, 0x0d, 0x5e, 0x76, 0x03, 0x04, 0x76, 0x91, 0x30, - 0xab, 0x46, 0xf7, 0xd6, 0x3c, 0x07, 0xd0, 0x60, 0xb4, 0x2c, 0x6b, 0x74, 0xc1, 0x94, 0xb8, 0x16, - 0x15, 0x06, 0x6b, 0x54, 0xf6, 0x6f, 0x17, 0x60, 0x58, 0x26, 0x24, 0x6c, 0x7b, 0xbd, 0xe8, 0x1e, - 0x0f, 0x95, 0xa1, 0x1c, 0x5d, 0x80, 0x12, 0x53, 0x8e, 0x57, 0x63, 0x95, 0xad, 0x52, 0x4d, 0xad, - 0x4a, 0x04, 0x8e, 0x69, 0x98, 0xf8, 0xde, 0xbe, 0xc9, 0xc8, 0x13, 0xaf, 0x7d, 0x6b, 0x1c, 0x8c, - 0x25, 0x1e, 0x7d, 0x14, 0x26, 0x78, 0xb9, 0xc0, 0x6f, 0x39, 0x9b, 0xdc, 0xa0, 0xd6, 0xaf, 0x42, - 0xa8, 0x4c, 0xac, 0x26, 0x70, 0x07, 0xfb, 0xe5, 0x63, 0x49, 0x18, 0xb3, 0x14, 0xa7, 0xb8, 0x30, - 0xbf, 0x39, 0x5e, 0x09, 0xdd, 0xd5, 0x53, 0xee, 0x76, 0x31, 0x0a, 0xeb, 0x74, 0xf6, 0xa7, 0x00, - 0xa5, 0x53, 0x33, 0xa2, 0xd7, 0xb9, 0xdf, 0xb5, 0x1b, 0x90, 0x46, 0x27, 0xcb, 0xb1, 0x1e, 0x28, - 0x44, 0x3e, 0xd4, 0xe3, 0xa5, 0xb0, 0x2a, 0x6f, 0xff, 0x40, 0x1f, 0x4c, 0x24, 0x43, 0x13, 0xa0, - 0xcb, 0x30, 0xc0, 0x45, 0x4a, 0xc1, 0xbe, 0x83, 0x63, 0x92, 0x16, 0xd0, 0x80, 0x1d, 0xae, 0x42, - 0x2a, 0x15, 0xe5, 0xd1, 0x5b, 0x30, 0xdc, 0xf0, 0x6f, 0x79, 0xb7, 0x9c, 0xa0, 0x31, 0x57, 0xad, - 0x88, 0xe9, 0x9c, 0xa9, 0x2d, 0x59, 0x8c, 0xc9, 0xf4, 0x20, 0x09, 0xcc, 0x08, 0x1f, 0xa3, 0xb0, - 0xce, 0x0e, 0xad, 0xb3, 0x6c, 0x23, 0x1b, 0xee, 0xe6, 0xaa, 0xd3, 0xea, 0xf4, 0x08, 0x67, 0x41, - 0x12, 0x69, 0x9c, 0x47, 0x45, 0x4a, 0x12, 0x8e, 0xc0, 0x31, 0x23, 0xf4, 0x19, 0x98, 0x0a, 0x73, - 0xec, 0x37, 0x79, 0x99, 0x7a, 0x3b, 0x99, 0x34, 0xf8, 0xcd, 0x3f, 0xcb, 0xd2, 0x93, 0x55, 0x0d, - 0xba, 0x0d, 0x48, 0xe8, 0x49, 0xd7, 0x83, 0x76, 0x18, 0xcd, 0xb7, 0xbd, 0x46, 0x53, 0x66, 0x23, - 0xc9, 0xce, 0xe5, 0x9d, 0xa2, 0xd6, 0xea, 0x66, 0xa1, 0x4a, 0xd3, 0x14, 0x38, 0xa3, 0x0e, 0xfb, - 0x73, 0x7d, 0x30, 0x23, 0x73, 0xa1, 0x66, 0x3c, 0x36, 0xf8, 0xac, 0x95, 0x78, 0x6d, 0xf0, 0x72, - 0xfe, 0xae, 0xf4, 0xc0, 0xde, 0x1c, 0x7c, 0x21, 0xfd, 0xe6, 0xe0, 0xd5, 0x43, 0x36, 0xe3, 0xbe, - 0xbd, 0x3c, 0xf8, 0xb6, 0x7d, 0x2e, 0xf0, 0xa5, 0x63, 0x60, 0x9c, 0x23, 0x08, 0x83, 0xca, 0xf9, - 0xdf, 0xc9, 0xe5, 0xe9, 0xb2, 0xa0, 0x31, 0x4e, 0xa6, 0x11, 0x19, 0x2d, 0x9a, 0x6d, 0xb5, 0x8a, - 0x0f, 0xe5, 0x49, 0x76, 0x5a, 0xd1, 0xde, 0xa2, 0x1b, 0x88, 0x16, 0x67, 0xf2, 0x5c, 0x12, 0x34, - 0x69, 0x9e, 0x12, 0x83, 0x15, 0x1f, 0xb4, 0x0b, 0x93, 0x9b, 0x75, 0x92, 0x48, 0x1f, 0x5e, 0xcc, - 0x5f, 0xb7, 0x97, 0x16, 0x96, 0x3a, 0xe4, 0x0e, 0x67, 0x37, 0x95, 0x14, 0x09, 0x4e, 0x57, 0xc1, - 0x52, 0x97, 0x3b, 0xb7, 0xc2, 0xa5, 0xa6, 0x13, 0x46, 0x6e, 0x7d, 0xbe, 0xe9, 0xd7, 0xb7, 0x6b, - 0x91, 0x1f, 0xc8, 0xdc, 0x65, 0x99, 0x17, 0x85, 0xb9, 0x1b, 0xb5, 0x14, 0x7d, 0x3a, 0x75, 0x79, - 0x16, 0x15, 0xce, 0xac, 0x0b, 0xad, 0xc1, 0xe0, 0xa6, 0x1b, 0x61, 0xd2, 0xf2, 0xc5, 0x6e, 0x91, - 0xb9, 0x15, 0x5e, 0xe2, 0x24, 0xe9, 0x54, 0xe2, 0x02, 0x81, 0x25, 0x13, 0xf4, 0xba, 0x3a, 0x04, - 0x06, 0xf2, 0xb5, 0x85, 0x69, 0x27, 0xae, 0xcc, 0x63, 0xe0, 0x35, 0x28, 0x7a, 0x1b, 0x61, 0xa7, - 0xd0, 0x23, 0x6b, 0xcb, 0xb5, 0x74, 0x8a, 0xef, 0xb5, 0xe5, 0x1a, 0xa6, 0x05, 0xd9, 0x2b, 0xc5, - 0xb0, 0x1e, 0xba, 0x22, 0x0b, 0x4b, 0xe6, 0xa3, 0xcd, 0x4a, 0x6d, 0xa1, 0x56, 0x49, 0xa7, 0x35, - 0x67, 0x60, 0xcc, 0x8b, 0xa3, 0xeb, 0x50, 0xda, 0xe4, 0x1b, 0xdf, 0x46, 0x28, 0xf2, 0x21, 0x67, - 0x1e, 0x46, 0x97, 0x24, 0x51, 0x3a, 0x99, 0xb9, 0x42, 0xe1, 0x98, 0x15, 0xfa, 0x9c, 0x05, 0xc7, - 0x93, 0x09, 0xa5, 0xd9, 0xdb, 0x22, 0xe1, 0xef, 0xf4, 0x62, 0x2f, 0x19, 0xbe, 0x59, 0x01, 0xa3, - 0x42, 0x66, 0x2b, 0xc8, 0x24, 0xc3, 0xd9, 0xd5, 0xd1, 0x8e, 0x0e, 0x6e, 0x36, 0x84, 0xdf, 0x4d, - 0x66, 0x47, 0x27, 0xe2, 0xb0, 0xf0, 0x8e, 0xc6, 0xf3, 0x8b, 0x98, 0x16, 0x44, 0xeb, 0x00, 0x1b, - 0x4d, 0x22, 0x73, 0xdf, 0x8f, 0xe4, 0x9f, 0xfe, 0xcb, 0x8a, 0x4a, 0x26, 0x1e, 0xa2, 0x32, 0x61, - 0x0c, 0xc5, 0x1a, 0x1f, 0x3a, 0x95, 0xea, 0xae, 0xd7, 0x20, 0x01, 0xb3, 0xc4, 0xe4, 0x4c, 0xa5, - 0x05, 0x46, 0x91, 0x9e, 0x4a, 0x1c, 0x8e, 0x05, 0x07, 0xc6, 0x8b, 0xb4, 0xb6, 0x36, 0xc2, 0x4e, - 0x11, 0xf6, 0x17, 0x48, 0x6b, 0x2b, 0x31, 0xa1, 0x38, 0x2f, 0x06, 0xc7, 0x82, 0x03, 0x5d, 0x32, - 0x1b, 0x74, 0x01, 0x91, 0x60, 0x7a, 0x3c, 0x7f, 0xc9, 0x2c, 0x73, 0x92, 0xf4, 0x92, 0x11, 0x08, - 0x2c, 0x99, 0xa0, 0x4f, 0x9a, 0xd2, 0xce, 0x04, 0xe3, 0xf9, 0x74, 0x17, 0x69, 0xc7, 0xe0, 0xdb, - 0x59, 0xde, 0x79, 0x19, 0x0a, 0x1b, 0x75, 0x66, 0xc1, 0xc9, 0x51, 0x70, 0x2f, 0x2f, 0x18, 0xdc, - 0x58, 0xc4, 0xea, 0xe5, 0x05, 0x5c, 0xd8, 0xa8, 0xd3, 0xa9, 0xef, 0xdc, 0x69, 0x07, 0x64, 0xd9, - 0x6d, 0x12, 0x11, 0x6d, 0x3f, 0x73, 0xea, 0xcf, 0x49, 0xa2, 0xf4, 0xd4, 0x57, 0x28, 0x1c, 0xb3, - 0xa2, 0x7c, 0x63, 0x19, 0x6c, 0x2a, 0x9f, 0xaf, 0x12, 0xb5, 0xd2, 0x7c, 0x33, 0xa5, 0xb0, 0x6d, - 0x18, 0xdd, 0x0d, 0x5b, 0x5b, 0x44, 0xee, 0x8a, 0xcc, 0xb6, 0x94, 0xf3, 0x30, 0xff, 0xba, 0x20, - 0x74, 0x83, 0xa8, 0xed, 0x34, 0x53, 0x1b, 0x39, 0xd3, 0x03, 0x5c, 0xd7, 0x99, 0x61, 0x93, 0x37, - 0x9d, 0x08, 0x6f, 0xf3, 0xe8, 0x59, 0xcc, 0xca, 0x94, 0x33, 0x11, 0x32, 0x02, 0x6c, 0xf1, 0x89, - 0x20, 0x10, 0x58, 0x32, 0x51, 0x9d, 0xcd, 0x0e, 0xa0, 0x13, 0x5d, 0x3a, 0x3b, 0xd5, 0xde, 0xb8, - 0xb3, 0xd9, 0x81, 0x13, 0xb3, 0x62, 0x07, 0x4d, 0x2b, 0x23, 0xf7, 0x36, 0xb3, 0x31, 0xe5, 0x1c, - 0x34, 0xdd, 0x72, 0x75, 0xf3, 0x83, 0x26, 0x8b, 0x0a, 0x67, 0xd6, 0x45, 0x3f, 0xae, 0x25, 0x03, - 0xa1, 0x89, 0x8c, 0x00, 0x4f, 0xe6, 0xc4, 0x11, 0x4c, 0x47, 0x4b, 0xe3, 0x1f, 0xa7, 0x50, 0x38, - 0x66, 0x85, 0x1a, 0x30, 0xd6, 0x32, 0x02, 0x6c, 0xb2, 0xcc, 0x06, 0x39, 0x72, 0x41, 0x56, 0x28, - 0x4e, 0xae, 0xce, 0x30, 0x31, 0x38, 0xc1, 0x93, 0xb9, 0x99, 0xf1, 0x37, 0x63, 0x2c, 0xf1, 0x41, - 0xce, 0x50, 0x67, 0x3c, 0x2b, 0xe3, 0x43, 0x2d, 0x10, 0x58, 0x32, 0xa1, 0xbd, 0x21, 0x5e, 0x3a, - 0xf9, 0x21, 0xcb, 0x1f, 0x92, 0x67, 0x0d, 0xce, 0xb2, 0x69, 0xc8, 0xa8, 0xd2, 0x02, 0x85, 0x63, - 0x56, 0x74, 0x27, 0xa7, 0x07, 0xde, 0xa9, 0xfc, 0x9d, 0x3c, 0x79, 0xdc, 0xb1, 0x9d, 0x9c, 0x1e, - 0x76, 0x45, 0x71, 0xd4, 0xa9, 0x20, 0xc8, 0x2c, 0xf7, 0x41, 0x4e, 0xbb, 0x54, 0x14, 0xe5, 0x74, - 0xbb, 0x14, 0x0a, 0xc7, 0xac, 0xec, 0x1f, 0x28, 0xc0, 0x99, 0xce, 0xeb, 0x2d, 0x36, 0xd4, 0x54, - 0x63, 0xc7, 0x98, 0x84, 0xa1, 0x86, 0xab, 0x0d, 0x62, 0xaa, 0x9e, 0xe3, 0xa2, 0x5e, 0x82, 0x49, - 0xf5, 0x1e, 0xad, 0xe9, 0xd6, 0xf7, 0xd6, 0x62, 0x4d, 0x8d, 0x8a, 0x20, 0x52, 0x4b, 0x12, 0xe0, - 0x74, 0x19, 0x34, 0x07, 0xe3, 0x06, 0xb0, 0xb2, 0x28, 0xd4, 0x03, 0x71, 0xb4, 0x7d, 0x13, 0x8d, - 0x93, 0xf4, 0xf6, 0xcf, 0x58, 0xf0, 0x50, 0x4e, 0xea, 0xe3, 0x9e, 0xc3, 0x7e, 0x6e, 0xc0, 0x78, - 0xcb, 0x2c, 0xda, 0x25, 0x52, 0xb1, 0x91, 0x60, 0x59, 0xb5, 0x35, 0x81, 0xc0, 0x49, 0xa6, 0xf6, - 0x4f, 0x15, 0xe0, 0x74, 0x47, 0x07, 0x6b, 0x84, 0xe1, 0xc4, 0xe6, 0x4e, 0xe8, 0x2c, 0x04, 0xa4, - 0x41, 0xbc, 0xc8, 0x75, 0x9a, 0xb5, 0x16, 0xa9, 0x6b, 0xa6, 0x36, 0xe6, 0xa9, 0x7c, 0x69, 0xb5, - 0x36, 0x97, 0xa6, 0xc0, 0x39, 0x25, 0xd1, 0x32, 0xa0, 0x34, 0x46, 0x8c, 0x30, 0xbb, 0x9a, 0xa6, - 0xf9, 0xe1, 0x8c, 0x12, 0xe8, 0x83, 0x30, 0xaa, 0x1c, 0xb7, 0xb5, 0x11, 0x67, 0x1b, 0x3b, 0xd6, - 0x11, 0xd8, 0xa4, 0x43, 0x17, 0x79, 0x1a, 0x16, 0x91, 0xb0, 0x47, 0xd8, 0xe5, 0xc6, 0x65, 0x8e, - 0x15, 0x01, 0xc6, 0x3a, 0xcd, 0xfc, 0x4b, 0xbf, 0xf9, 0x8d, 0x33, 0xef, 0xfb, 0xdd, 0x6f, 0x9c, - 0x79, 0xdf, 0x1f, 0x7c, 0xe3, 0xcc, 0xfb, 0xbe, 0xfb, 0xee, 0x19, 0xeb, 0x37, 0xef, 0x9e, 0xb1, - 0x7e, 0xf7, 0xee, 0x19, 0xeb, 0x0f, 0xee, 0x9e, 0xb1, 0xfe, 0xf3, 0xdd, 0x33, 0xd6, 0x17, 0xff, - 0xf8, 0xcc, 0xfb, 0xde, 0x44, 0x71, 0x20, 0xdd, 0x0b, 0x74, 0x74, 0x2e, 0xec, 0x5e, 0xfc, 0x7f, - 0x01, 0x00, 0x00, 0xff, 0xff, 0xf4, 0xd2, 0x6b, 0xb7, 0x27, 0x1a, 0x01, 0x00, + // 15529 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0xbd, 0x69, 0x8c, 0x5c, 0xd9, + 0x79, 0x18, 0xaa, 0x5b, 0xd5, 0x5b, 0x7d, 0xbd, 0x9f, 0x26, 0x39, 0xcd, 0x1e, 0x92, 0xc5, 0xb9, + 0x33, 0xc3, 0xe1, 0x6c, 0x4d, 0x71, 0x16, 0xcd, 0x68, 0x66, 0x34, 0x56, 0xaf, 0x64, 0x0d, 0xd9, + 0xcd, 0x9a, 0x53, 0x4d, 0x52, 0x1a, 0x8d, 0xf4, 0x74, 0x59, 0x75, 0xba, 0xfb, 0xaa, 0xab, 0xee, + 0xad, 0xb9, 0xf7, 0x56, 0x93, 0xcd, 0x27, 0xc3, 0xb6, 0xfc, 0x2c, 0x5b, 0xb2, 0x1f, 0x20, 0x3c, + 0xf8, 0xbd, 0x17, 0xc8, 0x86, 0x11, 0x38, 0x8e, 0x97, 0x28, 0x76, 0xa2, 0xc8, 0xb1, 0x1d, 0xcb, + 0x5b, 0x36, 0xc0, 0x36, 0x02, 0xc7, 0x31, 0x60, 0xcb, 0x88, 0x91, 0x76, 0x44, 0x07, 0x30, 0xfc, + 0x23, 0xb6, 0x91, 0xe4, 0x47, 0x42, 0x38, 0x71, 0x70, 0xd6, 0x7b, 0xce, 0x5d, 0xaa, 0xaa, 0x39, + 0x64, 0x6b, 0x24, 0xcc, 0xbf, 0xaa, 0xf3, 0x7d, 0xe7, 0x3b, 0xe7, 0x9e, 0xf5, 0x3b, 0xdf, 0x0a, + 0xf6, 0xce, 0xcb, 0xe1, 0xbc, 0xeb, 0x9f, 0x73, 0xda, 0xee, 0xb9, 0xba, 0x1f, 0x90, 0x73, 0xbb, + 0xe7, 0xcf, 0x6d, 0x11, 0x8f, 0x04, 0x4e, 0x44, 0x1a, 0xf3, 0xed, 0xc0, 0x8f, 0x7c, 0x84, 0x38, + 0xce, 0xbc, 0xd3, 0x76, 0xe7, 0x29, 0xce, 0xfc, 0xee, 0xf9, 0xb9, 0x67, 0xb7, 0xdc, 0x68, 0xbb, + 0x73, 0x63, 0xbe, 0xee, 0xb7, 0xce, 0x6d, 0xf9, 0x5b, 0xfe, 0x39, 0x86, 0x7a, 0xa3, 0xb3, 0xc9, + 0xfe, 0xb1, 0x3f, 0xec, 0x17, 0x27, 0x31, 0xf7, 0x42, 0xdc, 0x4c, 0xcb, 0xa9, 0x6f, 0xbb, 0x1e, + 0x09, 0xf6, 0xce, 0xb5, 0x77, 0xb6, 0x58, 0xbb, 0x01, 0x09, 0xfd, 0x4e, 0x50, 0x27, 0xc9, 0x86, + 0xbb, 0xd6, 0x0a, 0xcf, 0xb5, 0x48, 0xe4, 0x64, 0x74, 0x77, 0xee, 0x5c, 0x5e, 0xad, 0xa0, 0xe3, + 0x45, 0x6e, 0x2b, 0xdd, 0xcc, 0x87, 0x7a, 0x55, 0x08, 0xeb, 0xdb, 0xa4, 0xe5, 0xa4, 0xea, 0x3d, + 0x9f, 0x57, 0xaf, 0x13, 0xb9, 0xcd, 0x73, 0xae, 0x17, 0x85, 0x51, 0x90, 0xac, 0x64, 0x7f, 0xc3, + 0x82, 0xd3, 0x0b, 0xd7, 0x6b, 0x2b, 0x4d, 0x27, 0x8c, 0xdc, 0xfa, 0x62, 0xd3, 0xaf, 0xef, 0xd4, + 0x22, 0x3f, 0x20, 0xd7, 0xfc, 0x66, 0xa7, 0x45, 0x6a, 0x6c, 0x20, 0xd0, 0x33, 0x30, 0xb2, 0xcb, + 0xfe, 0x57, 0x96, 0x67, 0xad, 0xd3, 0xd6, 0xd9, 0xd2, 0xe2, 0xd4, 0x6f, 0xef, 0x97, 0x3f, 0x70, + 0x67, 0xbf, 0x3c, 0x72, 0x4d, 0x94, 0x63, 0x85, 0x81, 0xce, 0xc0, 0xd0, 0x66, 0xb8, 0xb1, 0xd7, + 0x26, 0xb3, 0x05, 0x86, 0x3b, 0x21, 0x70, 0x87, 0x56, 0x6b, 0xb4, 0x14, 0x0b, 0x28, 0x3a, 0x07, + 0xa5, 0xb6, 0x13, 0x44, 0x6e, 0xe4, 0xfa, 0xde, 0x6c, 0xf1, 0xb4, 0x75, 0x76, 0x70, 0x71, 0x5a, + 0xa0, 0x96, 0xaa, 0x12, 0x80, 0x63, 0x1c, 0xda, 0x8d, 0x80, 0x38, 0x8d, 0x2b, 0x5e, 0x73, 0x6f, + 0x76, 0xe0, 0xb4, 0x75, 0x76, 0x24, 0xee, 0x06, 0x16, 0xe5, 0x58, 0x61, 0xd8, 0x5f, 0x2e, 0xc0, + 0xc8, 0xc2, 0xe6, 0xa6, 0xeb, 0xb9, 0xd1, 0x1e, 0xba, 0x06, 0x63, 0x9e, 0xdf, 0x20, 0xf2, 0x3f, + 0xfb, 0x8a, 0xd1, 0xe7, 0x4e, 0xcf, 0xa7, 0x97, 0xd2, 0xfc, 0xba, 0x86, 0xb7, 0x38, 0x75, 0x67, + 0xbf, 0x3c, 0xa6, 0x97, 0x60, 0x83, 0x0e, 0xc2, 0x30, 0xda, 0xf6, 0x1b, 0x8a, 0x6c, 0x81, 0x91, + 0x2d, 0x67, 0x91, 0xad, 0xc6, 0x68, 0x8b, 0x93, 0x77, 0xf6, 0xcb, 0xa3, 0x5a, 0x01, 0xd6, 0x89, + 0xa0, 0x1b, 0x30, 0x49, 0xff, 0x7a, 0x91, 0xab, 0xe8, 0x16, 0x19, 0xdd, 0x47, 0xf3, 0xe8, 0x6a, + 0xa8, 0x8b, 0x33, 0x77, 0xf6, 0xcb, 0x93, 0x89, 0x42, 0x9c, 0x24, 0x68, 0xff, 0x88, 0x05, 0x93, + 0x0b, 0xed, 0xf6, 0x42, 0xd0, 0xf2, 0x83, 0x6a, 0xe0, 0x6f, 0xba, 0x4d, 0x82, 0x5e, 0x82, 0x81, + 0x88, 0xce, 0x1a, 0x9f, 0xe1, 0x47, 0xc5, 0xd0, 0x0e, 0xd0, 0xb9, 0xba, 0xbb, 0x5f, 0x9e, 0x49, + 0xa0, 0xb3, 0xa9, 0x64, 0x15, 0xd0, 0x47, 0x61, 0xaa, 0xe9, 0xd7, 0x9d, 0xe6, 0xb6, 0x1f, 0x46, + 0x02, 0x2a, 0xa6, 0xfe, 0xc8, 0x9d, 0xfd, 0xf2, 0xd4, 0xe5, 0x04, 0x0c, 0xa7, 0xb0, 0xed, 0xdb, + 0x30, 0xb1, 0x10, 0x45, 0x4e, 0x7d, 0x9b, 0x34, 0xf8, 0x82, 0x42, 0x2f, 0xc0, 0x80, 0xe7, 0xb4, + 0x64, 0x67, 0x4e, 0xcb, 0xce, 0xac, 0x3b, 0x2d, 0xda, 0x99, 0xa9, 0xab, 0x9e, 0xfb, 0x4e, 0x47, + 0x2c, 0x52, 0x5a, 0x86, 0x19, 0x36, 0x7a, 0x0e, 0xa0, 0x41, 0x76, 0xdd, 0x3a, 0xa9, 0x3a, 0xd1, + 0xb6, 0xe8, 0x03, 0x12, 0x75, 0x61, 0x59, 0x41, 0xb0, 0x86, 0x65, 0xdf, 0x82, 0xd2, 0xc2, 0xae, + 0xef, 0x36, 0xaa, 0x7e, 0x23, 0x44, 0x3b, 0x30, 0xd9, 0x0e, 0xc8, 0x26, 0x09, 0x54, 0xd1, 0xac, + 0x75, 0xba, 0x78, 0x76, 0xf4, 0xb9, 0xb3, 0x99, 0x63, 0x6f, 0xa2, 0xae, 0x78, 0x51, 0xb0, 0xb7, + 0xf8, 0x90, 0x68, 0x6f, 0x32, 0x01, 0xc5, 0x49, 0xca, 0xf6, 0xbf, 0x2a, 0xc0, 0xd1, 0x85, 0xdb, + 0x9d, 0x80, 0x2c, 0xbb, 0xe1, 0x4e, 0x72, 0xc3, 0x35, 0xdc, 0x70, 0x67, 0x3d, 0x1e, 0x01, 0xb5, + 0xd2, 0x97, 0x45, 0x39, 0x56, 0x18, 0xe8, 0x59, 0x18, 0xa6, 0xbf, 0xaf, 0xe2, 0x8a, 0xf8, 0xe4, + 0x19, 0x81, 0x3c, 0xba, 0xec, 0x44, 0xce, 0x32, 0x07, 0x61, 0x89, 0x83, 0xd6, 0x60, 0xb4, 0xce, + 0xce, 0x87, 0xad, 0x35, 0xbf, 0x41, 0xd8, 0xda, 0x2a, 0x2d, 0x3e, 0x4d, 0xd1, 0x97, 0xe2, 0xe2, + 0xbb, 0xfb, 0xe5, 0x59, 0xde, 0x37, 0x41, 0x42, 0x83, 0x61, 0xbd, 0x3e, 0xb2, 0xd5, 0x76, 0x1f, + 0x60, 0x94, 0x20, 0x63, 0xab, 0x9f, 0xd5, 0x76, 0xee, 0x20, 0xdb, 0xb9, 0x63, 0xd9, 0xbb, 0x16, + 0x9d, 0x87, 0x81, 0x1d, 0xd7, 0x6b, 0xcc, 0x0e, 0x31, 0x5a, 0x27, 0xe9, 0x9c, 0x5f, 0x72, 0xbd, + 0xc6, 0xdd, 0xfd, 0xf2, 0xb4, 0xd1, 0x1d, 0x5a, 0x88, 0x19, 0xaa, 0xfd, 0x5f, 0x2d, 0x28, 0x33, + 0xd8, 0xaa, 0xdb, 0x24, 0x55, 0x12, 0x84, 0x6e, 0x18, 0x11, 0x2f, 0x32, 0x06, 0xf4, 0x39, 0x80, + 0x90, 0xd4, 0x03, 0x12, 0x69, 0x43, 0xaa, 0x16, 0x46, 0x4d, 0x41, 0xb0, 0x86, 0x45, 0xcf, 0xa7, + 0x70, 0xdb, 0x09, 0xd8, 0xfa, 0x12, 0x03, 0xab, 0xce, 0xa7, 0x9a, 0x04, 0xe0, 0x18, 0xc7, 0x38, + 0x9f, 0x8a, 0xbd, 0xce, 0x27, 0xf4, 0x11, 0x98, 0x8c, 0x1b, 0x0b, 0xdb, 0x4e, 0x5d, 0x0e, 0x20, + 0xdb, 0xc1, 0x35, 0x13, 0x84, 0x93, 0xb8, 0xf6, 0x3f, 0xb0, 0xc4, 0xe2, 0xa1, 0x5f, 0xfd, 0x1e, + 0xff, 0x56, 0xfb, 0x57, 0x2c, 0x18, 0x5e, 0x74, 0xbd, 0x86, 0xeb, 0x6d, 0xa1, 0x4f, 0xc3, 0x08, + 0xbd, 0x2a, 0x1b, 0x4e, 0xe4, 0x88, 0x63, 0xf8, 0x83, 0xda, 0xde, 0x52, 0x37, 0xd7, 0x7c, 0x7b, + 0x67, 0x8b, 0x16, 0x84, 0xf3, 0x14, 0x9b, 0xee, 0xb6, 0x2b, 0x37, 0x3e, 0x43, 0xea, 0xd1, 0x1a, + 0x89, 0x9c, 0xf8, 0x73, 0xe2, 0x32, 0xac, 0xa8, 0xa2, 0x4b, 0x30, 0x14, 0x39, 0xc1, 0x16, 0x89, + 0xc4, 0x79, 0x9c, 0x79, 0x6e, 0xf2, 0x9a, 0x98, 0xee, 0x48, 0xe2, 0xd5, 0x49, 0x7c, 0x4b, 0x6d, + 0xb0, 0xaa, 0x58, 0x90, 0xb0, 0xff, 0xe7, 0x30, 0x1c, 0x5f, 0xaa, 0x55, 0x72, 0xd6, 0xd5, 0x19, + 0x18, 0x6a, 0x04, 0xee, 0x2e, 0x09, 0xc4, 0x38, 0x2b, 0x2a, 0xcb, 0xac, 0x14, 0x0b, 0x28, 0x7a, + 0x19, 0xc6, 0xf8, 0xfd, 0x78, 0xd1, 0xf1, 0x1a, 0xf1, 0xf1, 0x28, 0xb0, 0xc7, 0xae, 0x69, 0x30, + 0x6c, 0x60, 0x1e, 0x70, 0x51, 0x9d, 0x49, 0x6c, 0xc6, 0xbc, 0xbb, 0xf7, 0x0b, 0x16, 0x4c, 0xf1, + 0x66, 0x16, 0xa2, 0x28, 0x70, 0x6f, 0x74, 0x22, 0x12, 0xce, 0x0e, 0xb2, 0x93, 0x6e, 0x29, 0x6b, + 0xb4, 0x72, 0x47, 0x60, 0xfe, 0x5a, 0x82, 0x0a, 0x3f, 0x04, 0x67, 0x45, 0xbb, 0x53, 0x49, 0x30, + 0x4e, 0x35, 0x8b, 0xbe, 0xdf, 0x82, 0xb9, 0xba, 0xef, 0x45, 0x81, 0xdf, 0x6c, 0x92, 0xa0, 0xda, + 0xb9, 0xd1, 0x74, 0xc3, 0x6d, 0xbe, 0x4e, 0x31, 0xd9, 0x64, 0x27, 0x41, 0xce, 0x1c, 0x2a, 0x24, + 0x31, 0x87, 0xa7, 0xee, 0xec, 0x97, 0xe7, 0x96, 0x72, 0x49, 0xe1, 0x2e, 0xcd, 0xa0, 0x1d, 0x40, + 0xf4, 0x66, 0xaf, 0x45, 0xce, 0x16, 0x89, 0x1b, 0x1f, 0xee, 0xbf, 0xf1, 0x63, 0x77, 0xf6, 0xcb, + 0x68, 0x3d, 0x45, 0x02, 0x67, 0x90, 0x45, 0xef, 0xc0, 0x11, 0x5a, 0x9a, 0xfa, 0xd6, 0x91, 0xfe, + 0x9b, 0x9b, 0xbd, 0xb3, 0x5f, 0x3e, 0xb2, 0x9e, 0x41, 0x04, 0x67, 0x92, 0x46, 0xdf, 0x6b, 0xc1, + 0xf1, 0xf8, 0xf3, 0x57, 0x6e, 0xb5, 0x1d, 0xaf, 0x11, 0x37, 0x5c, 0xea, 0xbf, 0x61, 0x7a, 0x26, + 0x1f, 0x5f, 0xca, 0xa3, 0x84, 0xf3, 0x1b, 0x41, 0x1e, 0xcc, 0xd0, 0xae, 0x25, 0xdb, 0x86, 0xfe, + 0xdb, 0x7e, 0xe8, 0xce, 0x7e, 0x79, 0x66, 0x3d, 0x4d, 0x03, 0x67, 0x11, 0x9e, 0x5b, 0x82, 0xa3, + 0x99, 0xab, 0x13, 0x4d, 0x41, 0x71, 0x87, 0x70, 0x26, 0xb0, 0x84, 0xe9, 0x4f, 0x74, 0x04, 0x06, + 0x77, 0x9d, 0x66, 0x47, 0x6c, 0x4c, 0xcc, 0xff, 0xbc, 0x52, 0x78, 0xd9, 0xb2, 0xff, 0x75, 0x11, + 0x26, 0x97, 0x6a, 0x95, 0x7b, 0xda, 0xf5, 0xfa, 0xb5, 0x57, 0xe8, 0x7a, 0xed, 0xc5, 0x97, 0x68, + 0x31, 0xf7, 0x12, 0xfd, 0x9e, 0x8c, 0x2d, 0x3b, 0xc0, 0xb6, 0xec, 0x87, 0x73, 0xb6, 0xec, 0x7d, + 0xde, 0xa8, 0xbb, 0x39, 0xab, 0x76, 0x90, 0x4d, 0x60, 0x26, 0x87, 0xc4, 0x78, 0xbf, 0xe4, 0x51, + 0x7b, 0xc0, 0xa5, 0x7b, 0x7f, 0xe6, 0xb1, 0x0e, 0x63, 0x4b, 0x4e, 0xdb, 0xb9, 0xe1, 0x36, 0xdd, + 0xc8, 0x25, 0x21, 0x7a, 0x02, 0x8a, 0x4e, 0xa3, 0xc1, 0xb8, 0xbb, 0xd2, 0xe2, 0xd1, 0x3b, 0xfb, + 0xe5, 0xe2, 0x42, 0x83, 0xb2, 0x19, 0xa0, 0xb0, 0xf6, 0x30, 0xc5, 0x40, 0x4f, 0xc1, 0x40, 0x23, + 0xf0, 0xdb, 0xb3, 0x05, 0x86, 0x49, 0x77, 0xf9, 0xc0, 0x72, 0xe0, 0xb7, 0x13, 0xa8, 0x0c, 0xc7, + 0xfe, 0xad, 0x02, 0x9c, 0x58, 0x22, 0xed, 0xed, 0xd5, 0x5a, 0xce, 0x7d, 0x71, 0x16, 0x46, 0x5a, + 0xbe, 0xe7, 0x46, 0x7e, 0x10, 0x8a, 0xa6, 0xd9, 0x8a, 0x58, 0x13, 0x65, 0x58, 0x41, 0xd1, 0x69, + 0x18, 0x68, 0xc7, 0x4c, 0xec, 0x98, 0x64, 0x80, 0x19, 0xfb, 0xca, 0x20, 0x14, 0xa3, 0x13, 0x92, + 0x40, 0xac, 0x18, 0x85, 0x71, 0x35, 0x24, 0x01, 0x66, 0x90, 0x98, 0x13, 0xa0, 0x3c, 0x82, 0xb8, + 0x11, 0x12, 0x9c, 0x00, 0x85, 0x60, 0x0d, 0x0b, 0x55, 0xa1, 0x14, 0x26, 0x66, 0xb6, 0xaf, 0xad, + 0x39, 0xce, 0x58, 0x05, 0x35, 0x93, 0x31, 0x11, 0xe3, 0x06, 0x1b, 0xea, 0xc9, 0x2a, 0x7c, 0xbd, + 0x00, 0x88, 0x0f, 0xe1, 0xb7, 0xd9, 0xc0, 0x5d, 0x4d, 0x0f, 0x5c, 0xff, 0x5b, 0xe2, 0x7e, 0x8d, + 0xde, 0x7f, 0xb3, 0xe0, 0xc4, 0x92, 0xeb, 0x35, 0x48, 0x90, 0xb3, 0x00, 0x1f, 0xcc, 0x53, 0xfe, + 0x60, 0x4c, 0x8a, 0xb1, 0xc4, 0x06, 0xee, 0xc3, 0x12, 0xb3, 0xff, 0xca, 0x02, 0xc4, 0x3f, 0xfb, + 0x3d, 0xf7, 0xb1, 0x57, 0xd3, 0x1f, 0x7b, 0x1f, 0x96, 0x85, 0xfd, 0x8f, 0x2c, 0x18, 0x5d, 0x6a, + 0x3a, 0x6e, 0x4b, 0x7c, 0xea, 0x12, 0x4c, 0x4b, 0xb9, 0x15, 0x2b, 0xd6, 0x78, 0x7f, 0x7a, 0xb8, + 0x4d, 0xe3, 0x24, 0x10, 0xa7, 0xf1, 0xd1, 0x27, 0xe0, 0xb8, 0x51, 0xb8, 0x41, 0x5a, 0xed, 0xa6, + 0x13, 0xe9, 0xaf, 0x02, 0x76, 0xfb, 0xe3, 0x3c, 0x24, 0x9c, 0x5f, 0xdf, 0xbe, 0x0c, 0x13, 0x4b, + 0x4d, 0x97, 0x78, 0x51, 0xa5, 0xba, 0xe4, 0x7b, 0x9b, 0xee, 0x16, 0x7a, 0x05, 0x26, 0x22, 0xb7, + 0x45, 0xfc, 0x4e, 0x54, 0x23, 0x75, 0xdf, 0x63, 0x6f, 0x6d, 0xeb, 0xec, 0xe0, 0x22, 0xba, 0xb3, + 0x5f, 0x9e, 0xd8, 0x30, 0x20, 0x38, 0x81, 0x69, 0xff, 0x34, 0x3d, 0x69, 0x9b, 0x9d, 0x30, 0x22, + 0xc1, 0x46, 0xd0, 0x09, 0xa3, 0xc5, 0x0e, 0xe5, 0x96, 0xab, 0x81, 0x4f, 0x07, 0xd0, 0xf5, 0x3d, + 0x74, 0xc2, 0x10, 0x20, 0x8c, 0x48, 0xe1, 0x81, 0x10, 0x14, 0xcc, 0x03, 0x84, 0xee, 0x96, 0x47, + 0x02, 0xed, 0xd3, 0x26, 0xd8, 0xe6, 0x56, 0xa5, 0x58, 0xc3, 0x40, 0x4d, 0x18, 0x6f, 0x3a, 0x37, + 0x48, 0xb3, 0x46, 0x9a, 0xa4, 0x1e, 0xf9, 0x81, 0x90, 0xc8, 0x3c, 0xdf, 0xdf, 0xcb, 0xe5, 0xb2, + 0x5e, 0x75, 0x71, 0xfa, 0xce, 0x7e, 0x79, 0xdc, 0x28, 0xc2, 0x26, 0x71, 0x7a, 0xd8, 0xf9, 0x6d, + 0xfa, 0x15, 0x4e, 0x53, 0x7f, 0x2e, 0x5f, 0x11, 0x65, 0x58, 0x41, 0xd5, 0x61, 0x37, 0x90, 0x77, + 0xd8, 0xd9, 0x7f, 0x42, 0xb7, 0x86, 0xdf, 0x6a, 0xfb, 0x1e, 0xf1, 0xa2, 0x25, 0xdf, 0x6b, 0x70, + 0x59, 0xda, 0x2b, 0x86, 0xb0, 0xe7, 0x4c, 0x42, 0xd8, 0x73, 0x2c, 0x5d, 0x43, 0x93, 0xf7, 0x7c, + 0x18, 0x86, 0xc2, 0xc8, 0x89, 0x3a, 0xa1, 0x18, 0xb8, 0x47, 0xe4, 0x46, 0xa9, 0xb1, 0xd2, 0xbb, + 0xfb, 0xe5, 0x49, 0x55, 0x8d, 0x17, 0x61, 0x51, 0x01, 0x3d, 0x09, 0xc3, 0x2d, 0x12, 0x86, 0xce, + 0x96, 0x64, 0x74, 0x26, 0x45, 0xdd, 0xe1, 0x35, 0x5e, 0x8c, 0x25, 0x1c, 0x3d, 0x0a, 0x83, 0x24, + 0x08, 0xfc, 0x40, 0x7c, 0xdb, 0xb8, 0x40, 0x1c, 0x5c, 0xa1, 0x85, 0x98, 0xc3, 0xec, 0x7f, 0x6b, + 0xc1, 0xa4, 0xea, 0x2b, 0x6f, 0xeb, 0x10, 0x1e, 0x98, 0x6f, 0x01, 0xd4, 0xe5, 0x07, 0x86, 0x8c, + 0x31, 0x18, 0x7d, 0xee, 0x4c, 0x26, 0x0f, 0x96, 0x1a, 0xc6, 0x98, 0xb2, 0x2a, 0x0a, 0xb1, 0x46, + 0xcd, 0xfe, 0x75, 0x0b, 0x66, 0x12, 0x5f, 0x74, 0xd9, 0x0d, 0x23, 0xf4, 0x76, 0xea, 0xab, 0xe6, + 0xfb, 0x5c, 0x7c, 0x6e, 0xc8, 0xbf, 0x49, 0x9d, 0x52, 0xb2, 0x44, 0xfb, 0xa2, 0x8b, 0x30, 0xe8, + 0x46, 0xa4, 0x25, 0x3f, 0xe6, 0xd1, 0xae, 0x1f, 0xc3, 0x7b, 0x15, 0xcf, 0x48, 0x85, 0xd6, 0xc4, + 0x9c, 0x80, 0xfd, 0x5b, 0x45, 0x28, 0xf1, 0xfd, 0xbd, 0xe6, 0xb4, 0x0f, 0x61, 0x2e, 0x9e, 0x86, + 0x92, 0xdb, 0x6a, 0x75, 0x22, 0xe7, 0x86, 0xb8, 0xa9, 0x47, 0xf8, 0xa9, 0x59, 0x91, 0x85, 0x38, + 0x86, 0xa3, 0x0a, 0x0c, 0xb0, 0xae, 0xf0, 0xaf, 0x7c, 0x22, 0xfb, 0x2b, 0x45, 0xdf, 0xe7, 0x97, + 0x9d, 0xc8, 0xe1, 0x4c, 0xb2, 0xda, 0x57, 0xb4, 0x08, 0x33, 0x12, 0xc8, 0x01, 0xb8, 0xe1, 0x7a, + 0x4e, 0xb0, 0x47, 0xcb, 0x66, 0x8b, 0x8c, 0xe0, 0xb3, 0xdd, 0x09, 0x2e, 0x2a, 0x7c, 0x4e, 0x56, + 0x7d, 0x58, 0x0c, 0xc0, 0x1a, 0xd1, 0xb9, 0x97, 0xa0, 0xa4, 0x90, 0x0f, 0xc2, 0xeb, 0xce, 0x7d, + 0x04, 0x26, 0x13, 0x6d, 0xf5, 0xaa, 0x3e, 0xa6, 0xb3, 0xca, 0xbf, 0xca, 0x8e, 0x0c, 0xd1, 0xeb, + 0x15, 0x6f, 0x57, 0x5c, 0x31, 0xb7, 0xe1, 0x48, 0x33, 0xe3, 0x92, 0x12, 0xf3, 0xda, 0xff, 0xa5, + 0x76, 0x42, 0x7c, 0xf6, 0x91, 0x2c, 0x28, 0xce, 0x6c, 0xc3, 0x38, 0x11, 0x0b, 0xdd, 0x4e, 0x44, + 0x7a, 0xde, 0x1d, 0x51, 0x9d, 0xbf, 0x44, 0xf6, 0xd4, 0xa1, 0xfa, 0xad, 0xec, 0xfe, 0x49, 0x3e, + 0xfa, 0xfc, 0xb8, 0x1c, 0x15, 0x04, 0x8a, 0x97, 0xc8, 0x1e, 0x9f, 0x0a, 0xfd, 0xeb, 0x8a, 0x5d, + 0xbf, 0xee, 0xab, 0x16, 0x8c, 0xab, 0xaf, 0x3b, 0x84, 0x73, 0x61, 0xd1, 0x3c, 0x17, 0x4e, 0x76, + 0x5d, 0xe0, 0x39, 0x27, 0xc2, 0xd7, 0x0b, 0x70, 0x5c, 0xe1, 0xd0, 0x67, 0x1f, 0xff, 0x23, 0x56, + 0xd5, 0x39, 0x28, 0x79, 0x4a, 0x00, 0x6a, 0x99, 0x92, 0xc7, 0x58, 0xfc, 0x19, 0xe3, 0xd0, 0x2b, + 0xcf, 0x8b, 0x2f, 0xed, 0x31, 0x5d, 0x33, 0x20, 0x2e, 0xf7, 0x45, 0x28, 0x76, 0xdc, 0x86, 0xb8, + 0x60, 0x3e, 0x28, 0x47, 0xfb, 0x6a, 0x65, 0xf9, 0xee, 0x7e, 0xf9, 0x91, 0x3c, 0x25, 0x19, 0xbd, + 0xd9, 0xc2, 0xf9, 0xab, 0x95, 0x65, 0x4c, 0x2b, 0xa3, 0x05, 0x98, 0x94, 0xac, 0xcc, 0x35, 0xca, + 0x49, 0xfb, 0x9e, 0xb8, 0x87, 0x94, 0x78, 0x1f, 0x9b, 0x60, 0x9c, 0xc4, 0x47, 0xcb, 0x30, 0xb5, + 0xd3, 0xb9, 0x41, 0x9a, 0x24, 0xe2, 0x1f, 0x7c, 0x89, 0x70, 0xe1, 0x77, 0x29, 0x7e, 0x74, 0x5f, + 0x4a, 0xc0, 0x71, 0xaa, 0x86, 0xfd, 0xb7, 0xec, 0x3e, 0x10, 0xa3, 0xa7, 0xf1, 0x37, 0xdf, 0xca, + 0xe5, 0xdc, 0xcf, 0xaa, 0xb8, 0x44, 0xf6, 0x36, 0x7c, 0xca, 0x87, 0x64, 0xaf, 0x0a, 0x63, 0xcd, + 0x0f, 0x74, 0x5d, 0xf3, 0xbf, 0x58, 0x80, 0xa3, 0x6a, 0x04, 0x0c, 0xfe, 0xfe, 0xdb, 0x7d, 0x0c, + 0xce, 0xc3, 0x68, 0x83, 0x6c, 0x3a, 0x9d, 0x66, 0xa4, 0x34, 0x31, 0x83, 0x5c, 0x39, 0xb8, 0x1c, + 0x17, 0x63, 0x1d, 0xe7, 0x00, 0xc3, 0xf6, 0xf3, 0xe3, 0xec, 0x22, 0x8e, 0x1c, 0xba, 0xc6, 0xd5, + 0xae, 0xb1, 0x72, 0x77, 0xcd, 0xa3, 0x30, 0xe8, 0xb6, 0x28, 0x63, 0x56, 0x30, 0xf9, 0xad, 0x0a, + 0x2d, 0xc4, 0x1c, 0x86, 0x1e, 0x87, 0xe1, 0xba, 0xdf, 0x6a, 0x39, 0x5e, 0x83, 0x5d, 0x79, 0xa5, + 0xc5, 0x51, 0xca, 0xbb, 0x2d, 0xf1, 0x22, 0x2c, 0x61, 0x94, 0xf9, 0x76, 0x82, 0x2d, 0x2e, 0x9e, + 0x12, 0xcc, 0xf7, 0x42, 0xb0, 0x15, 0x62, 0x56, 0x4a, 0x5f, 0xd7, 0x37, 0xfd, 0x60, 0xc7, 0xf5, + 0xb6, 0x96, 0xdd, 0x40, 0x6c, 0x09, 0x75, 0x17, 0x5e, 0x57, 0x10, 0xac, 0x61, 0xa1, 0x55, 0x18, + 0x6c, 0xfb, 0x41, 0x14, 0xce, 0x0e, 0xb1, 0xe1, 0x7e, 0x24, 0xe7, 0x20, 0xe2, 0x5f, 0x5b, 0xf5, + 0x83, 0x28, 0xfe, 0x00, 0xfa, 0x2f, 0xc4, 0xbc, 0x3a, 0xba, 0x0c, 0xc3, 0xc4, 0xdb, 0x5d, 0x0d, + 0xfc, 0xd6, 0xec, 0x4c, 0x3e, 0xa5, 0x15, 0x8e, 0xc2, 0x97, 0x59, 0xcc, 0xa3, 0x8a, 0x62, 0x2c, + 0x49, 0xa0, 0x0f, 0x43, 0x91, 0x78, 0xbb, 0xb3, 0xc3, 0x8c, 0xd2, 0x5c, 0x0e, 0xa5, 0x6b, 0x4e, + 0x10, 0x9f, 0xf9, 0x2b, 0xde, 0x2e, 0xa6, 0x75, 0xd0, 0xc7, 0xa1, 0x24, 0x0f, 0x8c, 0x50, 0xc8, + 0x7d, 0x33, 0x17, 0xac, 0x3c, 0x66, 0x30, 0x79, 0xa7, 0xe3, 0x06, 0xa4, 0x45, 0xbc, 0x28, 0x8c, + 0x4f, 0x48, 0x09, 0x0d, 0x71, 0x4c, 0x0d, 0xd5, 0x61, 0x2c, 0x20, 0xa1, 0x7b, 0x9b, 0x54, 0xfd, + 0xa6, 0x5b, 0xdf, 0x9b, 0x7d, 0x88, 0x75, 0xef, 0xc9, 0xae, 0x43, 0x86, 0xb5, 0x0a, 0xb1, 0x5e, + 0x42, 0x2f, 0xc5, 0x06, 0x51, 0xf4, 0x26, 0x8c, 0x07, 0x24, 0x8c, 0x9c, 0x20, 0x12, 0xad, 0xcc, + 0x2a, 0x3d, 0xe2, 0x38, 0xd6, 0x01, 0xfc, 0x39, 0x11, 0x37, 0x13, 0x43, 0xb0, 0x49, 0x01, 0x7d, + 0x5c, 0x2a, 0x49, 0xd6, 0xfc, 0x8e, 0x17, 0x85, 0xb3, 0x25, 0xd6, 0xef, 0x4c, 0x6d, 0xfa, 0xb5, + 0x18, 0x2f, 0xa9, 0x45, 0xe1, 0x95, 0xb1, 0x41, 0x0a, 0x7d, 0x12, 0xc6, 0xf9, 0x7f, 0xae, 0x04, + 0x0e, 0x67, 0x8f, 0x32, 0xda, 0xa7, 0xf3, 0x69, 0x73, 0xc4, 0xc5, 0xa3, 0x82, 0xf8, 0xb8, 0x5e, + 0x1a, 0x62, 0x93, 0x1a, 0xc2, 0x30, 0xde, 0x74, 0x77, 0x89, 0x47, 0xc2, 0xb0, 0x1a, 0xf8, 0x37, + 0x88, 0x90, 0x69, 0x1f, 0xcf, 0x56, 0x1a, 0xfb, 0x37, 0x88, 0x78, 0x04, 0xea, 0x75, 0xb0, 0x49, + 0x02, 0x5d, 0x85, 0x89, 0x80, 0x38, 0x0d, 0x37, 0x26, 0x3a, 0xda, 0x8b, 0x28, 0x7b, 0x38, 0x63, + 0xa3, 0x12, 0x4e, 0x10, 0x41, 0x57, 0x60, 0x8c, 0x8d, 0x79, 0xa7, 0xcd, 0x89, 0x1e, 0xeb, 0x45, + 0x94, 0x99, 0x40, 0xd4, 0xb4, 0x2a, 0xd8, 0x20, 0x80, 0xde, 0x80, 0x52, 0xd3, 0xdd, 0x24, 0xf5, + 0xbd, 0x7a, 0x93, 0xcc, 0x8e, 0x31, 0x6a, 0x99, 0x87, 0xe1, 0x65, 0x89, 0xc4, 0xf9, 0x73, 0xf5, + 0x17, 0xc7, 0xd5, 0xd1, 0x35, 0x38, 0x16, 0x91, 0xa0, 0xe5, 0x7a, 0x0e, 0x3d, 0xc4, 0xc4, 0x93, + 0x90, 0xe9, 0xf2, 0xc7, 0xd9, 0xea, 0x3a, 0x25, 0x66, 0xe3, 0xd8, 0x46, 0x26, 0x16, 0xce, 0xa9, + 0x8d, 0x6e, 0xc1, 0x6c, 0x06, 0x84, 0xaf, 0xdb, 0x23, 0x8c, 0xf2, 0x6b, 0x82, 0xf2, 0xec, 0x46, + 0x0e, 0xde, 0xdd, 0x2e, 0x30, 0x9c, 0x4b, 0x1d, 0x5d, 0x81, 0x49, 0x76, 0x72, 0x56, 0x3b, 0xcd, + 0xa6, 0x68, 0x70, 0x82, 0x35, 0xf8, 0xb8, 0xe4, 0x23, 0x2a, 0x26, 0xf8, 0xee, 0x7e, 0x19, 0xe2, + 0x7f, 0x38, 0x59, 0x1b, 0xdd, 0x60, 0x6a, 0xe3, 0x4e, 0xe0, 0x46, 0x7b, 0x74, 0x57, 0x91, 0x5b, + 0xd1, 0xec, 0x64, 0x57, 0x11, 0x9a, 0x8e, 0xaa, 0x74, 0xcb, 0x7a, 0x21, 0x4e, 0x12, 0xa4, 0x57, + 0x41, 0x18, 0x35, 0x5c, 0x6f, 0x76, 0x8a, 0xbf, 0xa7, 0xe4, 0x49, 0x5a, 0xa3, 0x85, 0x98, 0xc3, + 0x98, 0xca, 0x98, 0xfe, 0xb8, 0x42, 0x6f, 0xdc, 0x69, 0x86, 0x18, 0xab, 0x8c, 0x25, 0x00, 0xc7, + 0x38, 0x94, 0x09, 0x8e, 0xa2, 0xbd, 0x59, 0xc4, 0x50, 0xd5, 0x81, 0xb8, 0xb1, 0xf1, 0x71, 0x4c, + 0xcb, 0xed, 0x1b, 0x30, 0xa1, 0x8e, 0x09, 0x36, 0x26, 0xa8, 0x0c, 0x83, 0x8c, 0xed, 0x13, 0x02, + 0xdf, 0x12, 0xed, 0x02, 0x63, 0x09, 0x31, 0x2f, 0x67, 0x5d, 0x70, 0x6f, 0x93, 0xc5, 0xbd, 0x88, + 0x70, 0x59, 0x44, 0x51, 0xeb, 0x82, 0x04, 0xe0, 0x18, 0xc7, 0xfe, 0x5f, 0x9c, 0x7d, 0x8e, 0x6f, + 0x89, 0x3e, 0xee, 0xc5, 0x67, 0x60, 0x84, 0x99, 0xaa, 0xf8, 0x01, 0xd7, 0x27, 0x0f, 0xc6, 0x0c, + 0xf3, 0x45, 0x51, 0x8e, 0x15, 0x06, 0x7a, 0x15, 0xc6, 0xeb, 0x7a, 0x03, 0xe2, 0x52, 0x57, 0xc7, + 0x88, 0xd1, 0x3a, 0x36, 0x71, 0xd1, 0xcb, 0x30, 0xc2, 0xac, 0xb2, 0xea, 0x7e, 0x53, 0x70, 0x9b, + 0x92, 0x33, 0x19, 0xa9, 0x8a, 0xf2, 0xbb, 0xda, 0x6f, 0xac, 0xb0, 0xd1, 0x19, 0x18, 0xa2, 0x5d, + 0xa8, 0x54, 0xc5, 0x75, 0xaa, 0x64, 0x97, 0x17, 0x59, 0x29, 0x16, 0x50, 0xfb, 0xd7, 0x2d, 0xc6, + 0x4b, 0xa5, 0xcf, 0x7c, 0x74, 0x91, 0x5d, 0x1a, 0xec, 0x06, 0xd1, 0x64, 0x87, 0x8f, 0x69, 0x37, + 0x81, 0x82, 0xdd, 0x4d, 0xfc, 0xc7, 0x46, 0x4d, 0xf4, 0x56, 0xf2, 0x66, 0xe0, 0x0c, 0xc5, 0x0b, + 0x72, 0x08, 0x92, 0xb7, 0xc3, 0xc3, 0xf1, 0x15, 0x47, 0xfb, 0xd3, 0xed, 0x8a, 0xb0, 0xff, 0x9f, + 0x82, 0xb6, 0x4a, 0x6a, 0x91, 0x13, 0x11, 0x54, 0x85, 0xe1, 0x9b, 0x8e, 0x1b, 0xb9, 0xde, 0x96, + 0xe0, 0xfb, 0xba, 0x5f, 0x74, 0xac, 0xd2, 0x75, 0x5e, 0x81, 0x73, 0x2f, 0xe2, 0x0f, 0x96, 0x64, + 0x28, 0xc5, 0xa0, 0xe3, 0x79, 0x94, 0x62, 0xa1, 0x5f, 0x8a, 0x98, 0x57, 0xe0, 0x14, 0xc5, 0x1f, + 0x2c, 0xc9, 0xa0, 0xb7, 0x01, 0xe4, 0x09, 0x41, 0x1a, 0x42, 0x76, 0xf8, 0x4c, 0x6f, 0xa2, 0x1b, + 0xaa, 0x0e, 0x17, 0x4e, 0xc6, 0xff, 0xb1, 0x46, 0xcf, 0x8e, 0xb4, 0x39, 0xd5, 0x3b, 0x83, 0x3e, + 0x41, 0xb7, 0xa8, 0x13, 0x44, 0xa4, 0xb1, 0x10, 0x89, 0xc1, 0x79, 0xaa, 0xbf, 0xc7, 0xe1, 0x86, + 0xdb, 0x22, 0xfa, 0x76, 0x16, 0x44, 0x70, 0x4c, 0xcf, 0xfe, 0xe5, 0x22, 0xcc, 0xe6, 0x75, 0x97, + 0x6e, 0x1a, 0x72, 0xcb, 0x8d, 0x96, 0x28, 0x5b, 0x6b, 0x99, 0x9b, 0x66, 0x45, 0x94, 0x63, 0x85, + 0x41, 0x57, 0x6f, 0xe8, 0x6e, 0xc9, 0xb7, 0xfd, 0x60, 0xbc, 0x7a, 0x6b, 0xac, 0x14, 0x0b, 0x28, + 0xc5, 0x0b, 0x88, 0x13, 0x0a, 0x73, 0x41, 0x6d, 0x95, 0x63, 0x56, 0x8a, 0x05, 0x54, 0x97, 0x32, + 0x0e, 0xf4, 0x90, 0x32, 0x1a, 0x43, 0x34, 0x78, 0x7f, 0x87, 0x08, 0x7d, 0x0a, 0x60, 0xd3, 0xf5, + 0xdc, 0x70, 0x9b, 0x51, 0x1f, 0x3a, 0x30, 0x75, 0xc5, 0x14, 0xaf, 0x2a, 0x2a, 0x58, 0xa3, 0x88, + 0x5e, 0x84, 0x51, 0x75, 0x80, 0x54, 0x96, 0x99, 0xb1, 0x82, 0x66, 0xfc, 0x15, 0x9f, 0xa6, 0xcb, + 0x58, 0xc7, 0xb3, 0x3f, 0x93, 0x5c, 0x2f, 0x62, 0x07, 0x68, 0xe3, 0x6b, 0xf5, 0x3b, 0xbe, 0x85, + 0xee, 0xe3, 0x6b, 0x7f, 0x73, 0x08, 0x26, 0x8d, 0xc6, 0x3a, 0x61, 0x1f, 0x67, 0xee, 0x05, 0x7a, + 0x01, 0x39, 0x11, 0x11, 0xfb, 0xcf, 0xee, 0xbd, 0x55, 0xf4, 0x4b, 0x8a, 0xee, 0x00, 0x5e, 0x1f, + 0x7d, 0x0a, 0x4a, 0x4d, 0x27, 0x64, 0x12, 0x4b, 0x22, 0xf6, 0x5d, 0x3f, 0xc4, 0xe2, 0x07, 0xa1, + 0x13, 0x46, 0xda, 0xad, 0xcf, 0x69, 0xc7, 0x24, 0xe9, 0x4d, 0x49, 0xf9, 0x2b, 0x69, 0x8f, 0xaa, + 0x3a, 0x41, 0x99, 0xb0, 0x3d, 0xcc, 0x61, 0xe8, 0x65, 0x76, 0xb4, 0xd2, 0x55, 0xb1, 0x44, 0xb9, + 0x51, 0xb6, 0xcc, 0x06, 0x0d, 0x26, 0x5b, 0xc1, 0xb0, 0x81, 0x19, 0xbf, 0xc9, 0x86, 0xba, 0xbc, + 0xc9, 0x9e, 0x84, 0x61, 0xf6, 0x43, 0xad, 0x00, 0x35, 0x1b, 0x15, 0x5e, 0x8c, 0x25, 0x3c, 0xb9, + 0x60, 0x46, 0xfa, 0x5b, 0x30, 0xf4, 0xd5, 0x27, 0x16, 0x35, 0x33, 0x14, 0x19, 0xe1, 0xa7, 0x9c, + 0x58, 0xf2, 0x58, 0xc2, 0xd0, 0xcf, 0x58, 0x80, 0x9c, 0x26, 0x7d, 0x2d, 0xd3, 0x62, 0xf5, 0xb8, + 0x01, 0xc6, 0x6a, 0xbf, 0xda, 0x73, 0xd8, 0x3b, 0xe1, 0xfc, 0x42, 0xaa, 0x36, 0x97, 0x94, 0xbe, + 0x22, 0xba, 0x88, 0xd2, 0x08, 0xfa, 0x65, 0x74, 0xd9, 0x0d, 0xa3, 0xcf, 0xfd, 0x69, 0xe2, 0x72, + 0xca, 0xe8, 0x12, 0xba, 0xaa, 0x3f, 0xbe, 0x46, 0x0f, 0xf8, 0xf8, 0x1a, 0xcf, 0x7b, 0x78, 0xcd, + 0x75, 0xe0, 0xa1, 0x9c, 0x2f, 0xc8, 0x90, 0xbf, 0x2e, 0xeb, 0xf2, 0xd7, 0x1e, 0x52, 0xbb, 0x79, + 0xd9, 0xc6, 0xfc, 0x9b, 0x1d, 0xc7, 0x8b, 0xdc, 0x68, 0x4f, 0x97, 0xd7, 0x3e, 0x05, 0x13, 0xcb, + 0x0e, 0x69, 0xf9, 0xde, 0x8a, 0xd7, 0x68, 0xfb, 0xae, 0x17, 0xa1, 0x59, 0x18, 0x60, 0xcc, 0x07, + 0x3f, 0x7a, 0x07, 0xe8, 0xe8, 0x61, 0x56, 0x62, 0x6f, 0xc1, 0xd1, 0x65, 0xff, 0xa6, 0x77, 0xd3, + 0x09, 0x1a, 0x0b, 0xd5, 0x8a, 0x26, 0x4f, 0x5a, 0x97, 0xf2, 0x0c, 0x2b, 0xff, 0xb5, 0xa8, 0xd5, + 0xe4, 0xcf, 0xa1, 0x55, 0xb7, 0x49, 0x72, 0xa4, 0x7e, 0xff, 0x7f, 0xc1, 0x68, 0x29, 0xc6, 0x57, + 0x3a, 0x2b, 0x2b, 0x57, 0x41, 0xff, 0x26, 0x8c, 0x6c, 0xba, 0xa4, 0xd9, 0xc0, 0x64, 0x53, 0x8c, + 0xce, 0x13, 0xf9, 0x26, 0x7c, 0xab, 0x14, 0x53, 0x29, 0xd7, 0x98, 0x34, 0x64, 0x55, 0x54, 0xc6, + 0x8a, 0x0c, 0xda, 0x81, 0x29, 0x39, 0x86, 0x12, 0x2a, 0xce, 0x83, 0x27, 0xbb, 0x4d, 0xbc, 0x49, + 0x9c, 0x99, 0x33, 0xe3, 0x04, 0x19, 0x9c, 0x22, 0x8c, 0x4e, 0xc0, 0x40, 0x8b, 0xde, 0x7c, 0x03, + 0x6c, 0xf8, 0x99, 0xf8, 0x83, 0x49, 0x72, 0x58, 0xa9, 0xfd, 0xe3, 0x16, 0x3c, 0x94, 0x1a, 0x19, + 0x21, 0xd1, 0xba, 0xcf, 0xb3, 0x90, 0x94, 0x30, 0x15, 0x7a, 0x4b, 0x98, 0xec, 0x7f, 0x68, 0xc1, + 0x91, 0x95, 0x56, 0x3b, 0xda, 0x5b, 0x76, 0x4d, 0x6d, 0xfa, 0x4b, 0x30, 0xd4, 0x22, 0x0d, 0xb7, + 0xd3, 0x12, 0x33, 0x57, 0x96, 0xb7, 0xc3, 0x1a, 0x2b, 0xbd, 0xbb, 0x5f, 0x1e, 0xaf, 0x45, 0x7e, + 0xe0, 0x6c, 0x11, 0x5e, 0x80, 0x05, 0x3a, 0xbb, 0x63, 0xdd, 0xdb, 0xe4, 0xb2, 0xdb, 0x72, 0xa3, + 0x7b, 0x5b, 0xed, 0x42, 0x11, 0x2e, 0x89, 0xe0, 0x98, 0x9e, 0xfd, 0x0d, 0x0b, 0x26, 0xe5, 0xba, + 0x5f, 0x68, 0x34, 0x02, 0x12, 0x86, 0x68, 0x0e, 0x0a, 0x6e, 0x5b, 0xf4, 0x12, 0x44, 0x2f, 0x0b, + 0x95, 0x2a, 0x2e, 0xb8, 0x6d, 0xc9, 0xce, 0xb3, 0x0b, 0xa8, 0x68, 0xda, 0x04, 0x5c, 0x14, 0xe5, + 0x58, 0x61, 0xa0, 0xb3, 0x30, 0xe2, 0xf9, 0x0d, 0xce, 0x11, 0x0b, 0x1d, 0x2b, 0xc5, 0x5c, 0x17, + 0x65, 0x58, 0x41, 0x51, 0x15, 0x4a, 0xdc, 0x62, 0x34, 0x5e, 0xb4, 0x7d, 0xd9, 0x9d, 0xb2, 0x2f, + 0xdb, 0x90, 0x35, 0x71, 0x4c, 0xc4, 0xfe, 0x4d, 0x0b, 0xc6, 0xe4, 0x97, 0xf5, 0xf9, 0x56, 0xa1, + 0x5b, 0x2b, 0x7e, 0xa7, 0xc4, 0x5b, 0x8b, 0xbe, 0x35, 0x18, 0xc4, 0x78, 0x62, 0x14, 0x0f, 0xf4, + 0xc4, 0x38, 0x0f, 0xa3, 0x4e, 0xbb, 0x5d, 0x35, 0xdf, 0x27, 0x6c, 0x29, 0x2d, 0xc4, 0xc5, 0x58, + 0xc7, 0xb1, 0x7f, 0xac, 0x00, 0x13, 0xf2, 0x0b, 0x6a, 0x9d, 0x1b, 0x21, 0x89, 0xd0, 0x06, 0x94, + 0x1c, 0x3e, 0x4b, 0x44, 0x2e, 0xf2, 0x47, 0xb3, 0xe5, 0x66, 0xc6, 0x94, 0xc6, 0x8c, 0xd6, 0x82, + 0xac, 0x8d, 0x63, 0x42, 0xa8, 0x09, 0xd3, 0x9e, 0x1f, 0xb1, 0x4b, 0x57, 0xc1, 0xbb, 0xa9, 0x32, + 0x93, 0xd4, 0x8f, 0x0b, 0xea, 0xd3, 0xeb, 0x49, 0x2a, 0x38, 0x4d, 0x18, 0xad, 0x48, 0x59, 0x64, + 0x31, 0x5f, 0x88, 0xa4, 0x4f, 0x5c, 0xb6, 0x28, 0xd2, 0xfe, 0x35, 0x0b, 0x4a, 0x12, 0xed, 0x30, + 0xb4, 0xd6, 0x6b, 0x30, 0x1c, 0xb2, 0x49, 0x90, 0x43, 0x63, 0x77, 0xeb, 0x38, 0x9f, 0xaf, 0x98, + 0x97, 0xe0, 0xff, 0x43, 0x2c, 0x69, 0x30, 0x55, 0x94, 0xea, 0xfe, 0x7b, 0x44, 0x15, 0xa5, 0xfa, + 0x93, 0x73, 0x29, 0xfd, 0x39, 0xeb, 0xb3, 0x26, 0xdb, 0xa5, 0x2c, 0x6f, 0x3b, 0x20, 0x9b, 0xee, + 0xad, 0x24, 0xcb, 0x5b, 0x65, 0xa5, 0x58, 0x40, 0xd1, 0xdb, 0x30, 0x56, 0x97, 0x3a, 0x88, 0x78, + 0x87, 0x9f, 0xe9, 0xaa, 0x0f, 0x53, 0xaa, 0x53, 0x2e, 0x43, 0x5b, 0xd2, 0xea, 0x63, 0x83, 0x9a, + 0x69, 0x11, 0x55, 0xec, 0x65, 0x11, 0x15, 0xd3, 0xcd, 0xb7, 0x0f, 0xfa, 0x09, 0x0b, 0x86, 0xb8, + 0xec, 0xb9, 0x3f, 0xd1, 0xbf, 0xa6, 0x49, 0x8e, 0xc7, 0xee, 0x1a, 0x2d, 0x14, 0x9c, 0x06, 0x5a, + 0x83, 0x12, 0xfb, 0xc1, 0x64, 0xe7, 0xc5, 0x7c, 0xff, 0x29, 0xde, 0xaa, 0xde, 0xc1, 0x6b, 0xb2, + 0x1a, 0x8e, 0x29, 0xd8, 0x3f, 0x5a, 0xa4, 0xa7, 0x5b, 0x8c, 0x6a, 0x5c, 0xfa, 0xd6, 0x83, 0xbb, + 0xf4, 0x0b, 0x0f, 0xea, 0xd2, 0xdf, 0x82, 0xc9, 0xba, 0xa6, 0x77, 0x8e, 0x67, 0xf2, 0x6c, 0xd7, + 0x45, 0xa2, 0xa9, 0xa8, 0xb9, 0x74, 0x6e, 0xc9, 0x24, 0x82, 0x93, 0x54, 0xd1, 0x27, 0x60, 0x8c, + 0xcf, 0xb3, 0x68, 0x85, 0x1b, 0x95, 0x3d, 0x9e, 0xbf, 0x5e, 0xf4, 0x26, 0xb8, 0x34, 0x57, 0xab, + 0x8e, 0x0d, 0x62, 0xf6, 0x5f, 0x5b, 0x80, 0x56, 0xda, 0xdb, 0xa4, 0x45, 0x02, 0xa7, 0x19, 0xab, + 0x8f, 0xbe, 0x68, 0xc1, 0x2c, 0x49, 0x15, 0x2f, 0xf9, 0xad, 0x96, 0x78, 0x2c, 0xe6, 0xc8, 0x33, + 0x56, 0x72, 0xea, 0x28, 0x8f, 0xae, 0xd9, 0x3c, 0x0c, 0x9c, 0xdb, 0x1e, 0x5a, 0x83, 0x19, 0x7e, + 0x4b, 0x2a, 0x80, 0x66, 0xc5, 0xf5, 0xb0, 0x20, 0x3c, 0xb3, 0x91, 0x46, 0xc1, 0x59, 0xf5, 0xec, + 0x5f, 0x1b, 0x87, 0xdc, 0x5e, 0xbc, 0xaf, 0x37, 0x7b, 0x5f, 0x6f, 0xf6, 0xbe, 0xde, 0xec, 0x7d, + 0xbd, 0xd9, 0xfb, 0x7a, 0xb3, 0xf7, 0xf5, 0x66, 0xef, 0x51, 0xbd, 0xd9, 0xff, 0x6b, 0xc1, 0x51, + 0x75, 0x7d, 0x19, 0x0f, 0xf6, 0xcf, 0xc2, 0x0c, 0xdf, 0x6e, 0x86, 0x31, 0xb6, 0xb8, 0xae, 0xcf, + 0x67, 0xae, 0xdc, 0x84, 0xd3, 0x80, 0x51, 0x91, 0x7b, 0x5f, 0x65, 0x00, 0x70, 0x56, 0x33, 0xf6, + 0x2f, 0x8f, 0xc0, 0xe0, 0xca, 0x2e, 0xf1, 0xa2, 0x43, 0x78, 0xda, 0xd4, 0x61, 0xc2, 0xf5, 0x76, + 0xfd, 0xe6, 0x2e, 0x69, 0x70, 0xf8, 0x41, 0x5e, 0xe0, 0xc7, 0x04, 0xe9, 0x89, 0x8a, 0x41, 0x02, + 0x27, 0x48, 0x3e, 0x08, 0xed, 0xc3, 0x05, 0x18, 0xe2, 0x97, 0x8f, 0x50, 0x3d, 0x64, 0x9e, 0xd9, + 0x6c, 0x10, 0xc5, 0x95, 0x1a, 0x6b, 0x46, 0xf8, 0xe5, 0x26, 0xaa, 0xa3, 0xcf, 0xc0, 0xc4, 0xa6, + 0x1b, 0x84, 0xd1, 0x86, 0xdb, 0xa2, 0x57, 0x43, 0xab, 0x7d, 0x0f, 0xda, 0x06, 0x35, 0x0e, 0xab, + 0x06, 0x25, 0x9c, 0xa0, 0x8c, 0xb6, 0x60, 0xbc, 0xe9, 0xe8, 0x4d, 0x0d, 0x1f, 0xb8, 0x29, 0x75, + 0x3b, 0x5c, 0xd6, 0x09, 0x61, 0x93, 0x2e, 0xdd, 0x4e, 0x75, 0x26, 0x30, 0x1f, 0x61, 0xe2, 0x0c, + 0xb5, 0x9d, 0xb8, 0xa4, 0x9c, 0xc3, 0x28, 0x83, 0xc6, 0x0c, 0xd9, 0x4b, 0x26, 0x83, 0xa6, 0x99, + 0xab, 0x7f, 0x1a, 0x4a, 0x84, 0x0e, 0x21, 0x25, 0x2c, 0x2e, 0x98, 0x73, 0xfd, 0xf5, 0x75, 0xcd, + 0xad, 0x07, 0xbe, 0xa9, 0xe7, 0x59, 0x91, 0x94, 0x70, 0x4c, 0x14, 0x2d, 0xc1, 0x50, 0x48, 0x02, + 0x57, 0xc9, 0x92, 0xbb, 0x4c, 0x23, 0x43, 0xe3, 0xee, 0x7d, 0xfc, 0x37, 0x16, 0x55, 0xe9, 0xf2, + 0x72, 0x98, 0x28, 0x96, 0x5d, 0x06, 0xda, 0xf2, 0x5a, 0x60, 0xa5, 0x58, 0x40, 0xd1, 0x1b, 0x30, + 0x1c, 0x90, 0x26, 0x53, 0x24, 0x8e, 0xf7, 0xbf, 0xc8, 0xb9, 0x5e, 0x92, 0xd7, 0xc3, 0x92, 0x00, + 0xba, 0x04, 0x28, 0x20, 0x94, 0xc1, 0x73, 0xbd, 0x2d, 0x65, 0xde, 0x2d, 0x0e, 0x5a, 0xc5, 0x48, + 0xe3, 0x18, 0x43, 0x7a, 0x76, 0xe2, 0x8c, 0x6a, 0xe8, 0x02, 0x4c, 0xab, 0xd2, 0x8a, 0x17, 0x46, + 0x0e, 0x3d, 0xe0, 0x26, 0x19, 0x2d, 0x25, 0x5f, 0xc1, 0x49, 0x04, 0x9c, 0xae, 0x63, 0xff, 0x9c, + 0x05, 0x7c, 0x9c, 0x0f, 0x41, 0xaa, 0xf0, 0xba, 0x29, 0x55, 0x38, 0x9e, 0x3b, 0x73, 0x39, 0x12, + 0x85, 0x9f, 0xb3, 0x60, 0x54, 0x9b, 0xd9, 0x78, 0xcd, 0x5a, 0x5d, 0xd6, 0x6c, 0x07, 0xa6, 0xe8, + 0x4a, 0xbf, 0x72, 0x23, 0x24, 0xc1, 0x2e, 0x69, 0xb0, 0x85, 0x59, 0xb8, 0xb7, 0x85, 0xa9, 0x4c, + 0x49, 0x2f, 0x27, 0x08, 0xe2, 0x54, 0x13, 0xf6, 0xa7, 0x65, 0x57, 0x95, 0xe5, 0x6d, 0x5d, 0xcd, + 0x79, 0xc2, 0xf2, 0x56, 0xcd, 0x2a, 0x8e, 0x71, 0xe8, 0x56, 0xdb, 0xf6, 0xc3, 0x28, 0x69, 0x79, + 0x7b, 0xd1, 0x0f, 0x23, 0xcc, 0x20, 0xf6, 0xf3, 0x00, 0x2b, 0xb7, 0x48, 0x9d, 0xaf, 0x58, 0xfd, + 0xd1, 0x63, 0xe5, 0x3f, 0x7a, 0xec, 0x3f, 0xb0, 0x60, 0x62, 0x75, 0xc9, 0xb8, 0xb9, 0xe6, 0x01, + 0xf8, 0x4b, 0xed, 0xfa, 0xf5, 0x75, 0x69, 0xfe, 0xc1, 0x35, 0xe0, 0xaa, 0x14, 0x6b, 0x18, 0xe8, + 0x38, 0x14, 0x9b, 0x1d, 0x4f, 0x88, 0x3d, 0x87, 0xe9, 0xf5, 0x78, 0xb9, 0xe3, 0x61, 0x5a, 0xa6, + 0x79, 0x75, 0x15, 0xfb, 0xf6, 0xea, 0xea, 0x19, 0x5c, 0x06, 0x95, 0x61, 0xf0, 0xe6, 0x4d, 0xb7, + 0xc1, 0x7d, 0xe6, 0x85, 0x69, 0xca, 0xf5, 0xeb, 0x95, 0xe5, 0x10, 0xf3, 0x72, 0xfb, 0x4b, 0x45, + 0x98, 0x5b, 0x6d, 0x92, 0x5b, 0xef, 0x32, 0x6e, 0x40, 0xbf, 0x3e, 0x69, 0x07, 0x13, 0x20, 0x1d, + 0xd4, 0xef, 0xb0, 0xf7, 0x78, 0x6c, 0xc2, 0x30, 0x37, 0x3c, 0x95, 0x51, 0x04, 0x32, 0xd5, 0x7d, + 0xf9, 0x03, 0x32, 0xcf, 0x0d, 0x58, 0x85, 0xba, 0x4f, 0x5d, 0x98, 0xa2, 0x14, 0x4b, 0xe2, 0x73, + 0xaf, 0xc0, 0x98, 0x8e, 0x79, 0x20, 0x0f, 0xe0, 0xef, 0x2b, 0xc2, 0x14, 0xed, 0xc1, 0x03, 0x9d, + 0x88, 0xab, 0xe9, 0x89, 0xb8, 0xdf, 0x5e, 0xa0, 0xbd, 0x67, 0xe3, 0xed, 0xe4, 0x6c, 0x9c, 0xcf, + 0x9b, 0x8d, 0xc3, 0x9e, 0x83, 0xef, 0xb7, 0x60, 0x66, 0xb5, 0xe9, 0xd7, 0x77, 0x12, 0x9e, 0x9a, + 0x2f, 0xc2, 0x28, 0x3d, 0x8e, 0x43, 0x23, 0x68, 0x89, 0x11, 0xc6, 0x46, 0x80, 0xb0, 0x8e, 0xa7, + 0x55, 0xbb, 0x7a, 0xb5, 0xb2, 0x9c, 0x15, 0xfd, 0x46, 0x80, 0xb0, 0x8e, 0x67, 0xff, 0x9e, 0x05, + 0x27, 0x2f, 0x2c, 0xad, 0xc4, 0x4b, 0x31, 0x15, 0x80, 0xe7, 0x0c, 0x0c, 0xb5, 0x1b, 0x5a, 0x57, + 0x62, 0xb1, 0xf0, 0x32, 0xeb, 0x85, 0x80, 0xbe, 0x57, 0x62, 0x5d, 0x5d, 0x05, 0xb8, 0x80, 0xab, + 0x4b, 0xe2, 0xdc, 0x95, 0x5a, 0x20, 0x2b, 0x57, 0x0b, 0xf4, 0x38, 0x0c, 0xd3, 0x7b, 0xc1, 0xad, + 0xcb, 0x7e, 0x73, 0x85, 0x3e, 0x2f, 0xc2, 0x12, 0x66, 0xff, 0xac, 0x05, 0x33, 0x17, 0xdc, 0x88, + 0x5e, 0xda, 0xc9, 0x08, 0x33, 0xf4, 0xd6, 0x0e, 0xdd, 0xc8, 0x0f, 0xf6, 0x92, 0x11, 0x66, 0xb0, + 0x82, 0x60, 0x0d, 0x8b, 0x7f, 0xd0, 0xae, 0xcb, 0x3c, 0x29, 0x0a, 0xa6, 0xde, 0x0d, 0x8b, 0x72, + 0xac, 0x30, 0xe8, 0x78, 0x35, 0xdc, 0x80, 0x89, 0x2c, 0xf7, 0xc4, 0xc1, 0xad, 0xc6, 0x6b, 0x59, + 0x02, 0x70, 0x8c, 0x63, 0xff, 0xa5, 0x05, 0xe5, 0x0b, 0xdc, 0x1f, 0x74, 0x33, 0xcc, 0x39, 0x74, + 0x9f, 0x87, 0x12, 0x91, 0x0a, 0x02, 0xe9, 0x1b, 0x2b, 0x19, 0x51, 0xa5, 0x39, 0xe0, 0x81, 0x6e, + 0x14, 0x5e, 0x1f, 0xee, 0xe4, 0x07, 0xf3, 0x07, 0x5e, 0x05, 0x44, 0xf4, 0xb6, 0xf4, 0xc8, 0x3f, + 0x2c, 0x84, 0xc8, 0x4a, 0x0a, 0x8a, 0x33, 0x6a, 0xd8, 0x3f, 0x6e, 0xc1, 0x51, 0xf5, 0xc1, 0xef, + 0xb9, 0xcf, 0xb4, 0xbf, 0x56, 0x80, 0xf1, 0x8b, 0x1b, 0x1b, 0xd5, 0x0b, 0x24, 0xd2, 0x56, 0x65, + 0x77, 0xb5, 0x3f, 0xd6, 0xb4, 0x97, 0xdd, 0xde, 0x88, 0x9d, 0xc8, 0x6d, 0xce, 0xf3, 0x78, 0x76, + 0xf3, 0x15, 0x2f, 0xba, 0x12, 0xd4, 0xa2, 0xc0, 0xf5, 0xb6, 0x32, 0x57, 0xba, 0xe4, 0x59, 0x8a, + 0x79, 0x3c, 0x0b, 0x7a, 0x1e, 0x86, 0x58, 0x40, 0x3d, 0x39, 0x09, 0x0f, 0xab, 0x27, 0x16, 0x2b, + 0xbd, 0xbb, 0x5f, 0x2e, 0x5d, 0xc5, 0x15, 0xfe, 0x07, 0x0b, 0x54, 0x74, 0x15, 0x46, 0xb7, 0xa3, + 0xa8, 0x7d, 0x91, 0x38, 0x0d, 0x12, 0xc8, 0x53, 0xf6, 0x54, 0xd6, 0x29, 0x4b, 0x07, 0x81, 0xa3, + 0xc5, 0x07, 0x53, 0x5c, 0x16, 0x62, 0x9d, 0x8e, 0x5d, 0x03, 0x88, 0x61, 0xf7, 0x49, 0x71, 0x63, + 0x6f, 0x40, 0x89, 0x7e, 0xee, 0x42, 0xd3, 0x75, 0xba, 0xab, 0xc6, 0x9f, 0x86, 0x92, 0x54, 0x7c, + 0x87, 0x22, 0xdc, 0x05, 0xbb, 0x91, 0xa4, 0x5e, 0x3c, 0xc4, 0x31, 0xdc, 0x7e, 0x0c, 0x84, 0x6d, + 0x69, 0x37, 0x92, 0xf6, 0x26, 0x1c, 0x61, 0x46, 0xb2, 0x4e, 0xb4, 0x6d, 0xac, 0xd1, 0xde, 0x8b, + 0xe1, 0x19, 0xf1, 0xae, 0xe3, 0x5f, 0x36, 0xab, 0x39, 0x27, 0x8f, 0x49, 0x8a, 0xf1, 0x1b, 0xcf, + 0xfe, 0x8b, 0x01, 0x78, 0xb8, 0x52, 0xcb, 0x8f, 0xd3, 0xf4, 0x32, 0x8c, 0x71, 0x76, 0x91, 0x2e, + 0x0d, 0xa7, 0x29, 0xda, 0x55, 0x12, 0xd0, 0x0d, 0x0d, 0x86, 0x0d, 0x4c, 0x74, 0x12, 0x8a, 0xee, + 0x3b, 0x5e, 0xd2, 0x75, 0xaf, 0xf2, 0xe6, 0x3a, 0xa6, 0xe5, 0x14, 0x4c, 0x39, 0x4f, 0x7e, 0xa4, + 0x2b, 0xb0, 0xe2, 0x3e, 0x5f, 0x87, 0x09, 0x37, 0xac, 0x87, 0x6e, 0xc5, 0xa3, 0xfb, 0x54, 0xdb, + 0xe9, 0x4a, 0xe6, 0x40, 0x3b, 0xad, 0xa0, 0x38, 0x81, 0xad, 0xdd, 0x2f, 0x83, 0x7d, 0x73, 0xaf, + 0x3d, 0xa3, 0x44, 0xd0, 0xe3, 0xbf, 0xcd, 0xbe, 0x2e, 0x64, 0x22, 0x78, 0x71, 0xfc, 0xf3, 0x0f, + 0x0e, 0xb1, 0x84, 0xd1, 0x07, 0x5d, 0x7d, 0xdb, 0x69, 0x2f, 0x74, 0xa2, 0xed, 0x65, 0x37, 0xac, + 0xfb, 0xbb, 0x24, 0xd8, 0x63, 0x6f, 0xf1, 0x91, 0xf8, 0x41, 0xa7, 0x00, 0x4b, 0x17, 0x17, 0xaa, + 0x14, 0x13, 0xa7, 0xeb, 0xa0, 0x05, 0x98, 0x94, 0x85, 0x35, 0x12, 0xb2, 0x2b, 0x60, 0x94, 0x91, + 0x51, 0xce, 0x74, 0xa2, 0x58, 0x11, 0x49, 0xe2, 0x9b, 0x0c, 0x2e, 0xdc, 0x0f, 0x06, 0xf7, 0x25, + 0x18, 0x77, 0x3d, 0x37, 0x72, 0x9d, 0xc8, 0xe7, 0xfa, 0x23, 0xfe, 0xec, 0x66, 0x02, 0xe6, 0x8a, + 0x0e, 0xc0, 0x26, 0x9e, 0xfd, 0x9f, 0x06, 0x60, 0x9a, 0x4d, 0xdb, 0xfb, 0x2b, 0xec, 0x3b, 0x69, + 0x85, 0x5d, 0x4d, 0xaf, 0xb0, 0xfb, 0xc1, 0xb9, 0xdf, 0xf3, 0x32, 0xfb, 0x0c, 0x94, 0x94, 0xff, + 0xa0, 0x74, 0x20, 0xb6, 0x72, 0x1c, 0x88, 0x7b, 0xdf, 0xde, 0xd2, 0x24, 0xad, 0x98, 0x69, 0x92, + 0xf6, 0x15, 0x0b, 0x62, 0xc5, 0x02, 0x7a, 0x13, 0x4a, 0x6d, 0x9f, 0x59, 0xb8, 0x06, 0xd2, 0x6c, + 0xfc, 0xb1, 0xae, 0x9a, 0x09, 0x1e, 0xaa, 0x2e, 0xe0, 0xa3, 0x50, 0x95, 0x55, 0x71, 0x4c, 0x05, + 0x5d, 0x82, 0xe1, 0x76, 0x40, 0x6a, 0x11, 0x8b, 0xa3, 0xd4, 0x3f, 0x41, 0xbe, 0x6a, 0x78, 0x45, + 0x2c, 0x29, 0xd8, 0xbf, 0x50, 0x80, 0xa9, 0x24, 0x2a, 0x7a, 0x0d, 0x06, 0xc8, 0x2d, 0x52, 0x17, + 0xfd, 0xcd, 0xbc, 0x8a, 0x63, 0xd1, 0x04, 0x1f, 0x00, 0xfa, 0x1f, 0xb3, 0x5a, 0xe8, 0x22, 0x0c, + 0xd3, 0x7b, 0xf8, 0x82, 0x8a, 0x19, 0xf8, 0x48, 0xde, 0x5d, 0xae, 0x18, 0x1a, 0xde, 0x39, 0x51, + 0x84, 0x65, 0x75, 0x66, 0x07, 0x56, 0x6f, 0xd7, 0xe8, 0x13, 0x27, 0xea, 0xf6, 0x12, 0xdf, 0x58, + 0xaa, 0x72, 0x24, 0x41, 0x8d, 0xdb, 0x81, 0xc9, 0x42, 0x1c, 0x13, 0x41, 0x1f, 0x85, 0xc1, 0xb0, + 0x49, 0x48, 0x5b, 0x28, 0xfa, 0x33, 0x85, 0x8b, 0x35, 0x8a, 0x20, 0x28, 0x31, 0x61, 0x04, 0x2b, + 0xc0, 0xbc, 0xa2, 0xfd, 0x8b, 0x16, 0x00, 0x37, 0x9c, 0x73, 0xbc, 0x2d, 0x72, 0x08, 0xf2, 0xf8, + 0x65, 0x18, 0x08, 0xdb, 0xa4, 0xde, 0xcd, 0x7c, 0x3b, 0xee, 0x4f, 0xad, 0x4d, 0xea, 0xf1, 0x9a, + 0xa5, 0xff, 0x30, 0xab, 0x6d, 0xff, 0x00, 0xc0, 0x44, 0x8c, 0x56, 0x89, 0x48, 0x0b, 0x3d, 0x6b, + 0x84, 0x2d, 0x39, 0x9e, 0x08, 0x5b, 0x52, 0x62, 0xd8, 0x9a, 0xe8, 0xf7, 0x33, 0x50, 0x6c, 0x39, + 0xb7, 0x84, 0x6c, 0xef, 0xe9, 0xee, 0xdd, 0xa0, 0xf4, 0xe7, 0xd7, 0x9c, 0x5b, 0xfc, 0xf9, 0xfb, + 0xb4, 0xdc, 0x63, 0x6b, 0xce, 0xad, 0x9e, 0x26, 0xc6, 0xb4, 0x11, 0xd6, 0x96, 0xeb, 0x09, 0x9b, + 0xb0, 0xbe, 0xda, 0x72, 0xbd, 0x64, 0x5b, 0xae, 0xd7, 0x47, 0x5b, 0xae, 0x87, 0x6e, 0xc3, 0xb0, + 0x30, 0xd9, 0x14, 0x11, 0xe0, 0xce, 0xf5, 0xd1, 0x9e, 0xb0, 0xf8, 0xe4, 0x6d, 0x9e, 0x93, 0xcf, + 0x7b, 0x51, 0xda, 0xb3, 0x5d, 0xd9, 0x20, 0xfa, 0xff, 0x2c, 0x98, 0x10, 0xbf, 0x31, 0x79, 0xa7, + 0x43, 0xc2, 0x48, 0xb0, 0xbf, 0x1f, 0xea, 0xbf, 0x0f, 0xa2, 0x22, 0xef, 0xca, 0x87, 0xe4, 0x4d, + 0x65, 0x02, 0x7b, 0xf6, 0x28, 0xd1, 0x0b, 0xf4, 0x0b, 0x16, 0x1c, 0x69, 0x39, 0xb7, 0x78, 0x8b, + 0xbc, 0x0c, 0x3b, 0x91, 0xeb, 0x0b, 0xd3, 0x87, 0xd7, 0xfa, 0x9b, 0xfe, 0x54, 0x75, 0xde, 0x49, + 0xa9, 0xe7, 0x3c, 0x92, 0x85, 0xd2, 0xb3, 0xab, 0x99, 0xfd, 0x9a, 0xdb, 0x84, 0x11, 0xb9, 0xde, + 0x1e, 0xa4, 0x7d, 0x38, 0x6b, 0x47, 0xac, 0xb5, 0x07, 0xda, 0xce, 0x67, 0x60, 0x4c, 0x5f, 0x63, + 0x0f, 0xb4, 0xad, 0x77, 0x60, 0x26, 0x63, 0x2d, 0x3d, 0xd0, 0x26, 0x6f, 0xc2, 0xf1, 0xdc, 0xf5, + 0xf1, 0x40, 0xed, 0xfb, 0xbf, 0x66, 0xe9, 0xe7, 0xe0, 0x21, 0x28, 0x45, 0x96, 0x4c, 0xa5, 0xc8, + 0xa9, 0xee, 0x3b, 0x27, 0x47, 0x33, 0xf2, 0xb6, 0xde, 0x69, 0x7a, 0xaa, 0xa3, 0x37, 0x60, 0xa8, + 0x49, 0x4b, 0xa4, 0xe1, 0xaf, 0xdd, 0x7b, 0x47, 0xc6, 0xec, 0x28, 0x2b, 0x0f, 0xb1, 0xa0, 0x60, + 0xff, 0x8a, 0x05, 0x03, 0x87, 0x30, 0x12, 0xd8, 0x1c, 0x89, 0x67, 0x73, 0x49, 0x8b, 0xd8, 0xfc, + 0xf3, 0xd8, 0xb9, 0xb9, 0x72, 0x2b, 0x22, 0x5e, 0xc8, 0xee, 0xf4, 0xcc, 0x81, 0xd9, 0xb7, 0x60, + 0xe6, 0xb2, 0xef, 0x34, 0x16, 0x9d, 0xa6, 0xe3, 0xd5, 0x49, 0x50, 0xf1, 0xb6, 0x0e, 0x64, 0xb5, + 0x5e, 0xe8, 0x69, 0xb5, 0xfe, 0x32, 0x0c, 0xb9, 0x6d, 0x2d, 0xb8, 0xf7, 0x69, 0x3a, 0x80, 0x95, + 0xaa, 0x88, 0xeb, 0x8d, 0x8c, 0xc6, 0x59, 0x29, 0x16, 0xf8, 0x74, 0xe6, 0xb9, 0xb9, 0xd8, 0x40, + 0xfe, 0xcc, 0x53, 0x2e, 0x3e, 0x19, 0x02, 0xca, 0x30, 0x6c, 0xde, 0x06, 0xa3, 0x09, 0xe1, 0xf5, + 0x85, 0x61, 0xd8, 0xe5, 0x5f, 0x2a, 0xa6, 0xff, 0x89, 0x6c, 0xee, 0x3a, 0x35, 0x30, 0x9a, 0x3f, + 0x13, 0x2f, 0xc0, 0x92, 0x90, 0xfd, 0x32, 0x64, 0x86, 0xec, 0xe8, 0x2d, 0x39, 0xb1, 0x3f, 0x0e, + 0xd3, 0xac, 0xe6, 0x01, 0xa5, 0x12, 0x76, 0x42, 0xde, 0x9b, 0x11, 0xa7, 0xd5, 0xfe, 0xf7, 0x16, + 0xa0, 0x35, 0xbf, 0xe1, 0x6e, 0xee, 0x09, 0xe2, 0xfc, 0xfb, 0xdf, 0x81, 0x32, 0x7f, 0xf6, 0x25, + 0x63, 0x99, 0x2e, 0x35, 0x9d, 0x30, 0xd4, 0x64, 0xcd, 0x4f, 0x88, 0x76, 0xcb, 0x1b, 0xdd, 0xd1, + 0x71, 0x2f, 0x7a, 0xe8, 0xcd, 0x44, 0xa0, 0xb6, 0x0f, 0xa7, 0x02, 0xb5, 0x3d, 0x91, 0x69, 0xf1, + 0x91, 0xee, 0xbd, 0x0c, 0xe0, 0x66, 0x7f, 0xc1, 0x82, 0xc9, 0xf5, 0x44, 0x6c, 0xce, 0x33, 0x4c, + 0xfd, 0x9d, 0xa1, 0x43, 0xa9, 0xb1, 0x52, 0x2c, 0xa0, 0xf7, 0x5d, 0xc6, 0xf8, 0xb7, 0x16, 0xc4, + 0x21, 0x82, 0x0e, 0x81, 0xab, 0x5d, 0x32, 0xb8, 0xda, 0xcc, 0x17, 0x82, 0xea, 0x4e, 0x1e, 0x53, + 0x8b, 0x2e, 0xa9, 0x39, 0xe9, 0xf2, 0x38, 0x88, 0xc9, 0xf0, 0x7d, 0x36, 0x61, 0x4e, 0x9c, 0x9a, + 0x8d, 0x3f, 0x2a, 0x00, 0x52, 0xb8, 0x7d, 0x07, 0xf7, 0x4b, 0xd7, 0xb8, 0x3f, 0xc1, 0xfd, 0x76, + 0x01, 0x31, 0x03, 0x8e, 0xc0, 0xf1, 0x42, 0x4e, 0xd6, 0x15, 0x52, 0xd5, 0x83, 0x59, 0x87, 0xcc, + 0x49, 0x6f, 0xbf, 0xcb, 0x29, 0x6a, 0x38, 0xa3, 0x05, 0xcd, 0x30, 0x67, 0xb0, 0x5f, 0xc3, 0x9c, + 0xa1, 0x1e, 0x6e, 0xab, 0x5f, 0xb5, 0x60, 0x5c, 0x0d, 0xd3, 0x7b, 0xc4, 0xb9, 0x41, 0xf5, 0x27, + 0xe7, 0x5e, 0xa9, 0x6a, 0x5d, 0x66, 0xf7, 0xed, 0x77, 0x31, 0xf7, 0x63, 0xa7, 0xe9, 0xde, 0x26, + 0x2a, 0x6a, 0x6e, 0x59, 0xb8, 0x13, 0x8b, 0xd2, 0xbb, 0xfb, 0xe5, 0x71, 0xf5, 0x8f, 0x47, 0xbd, + 0x8c, 0xab, 0xd8, 0x3f, 0x45, 0x37, 0xbb, 0xb9, 0x14, 0xd1, 0x8b, 0x30, 0xd8, 0xde, 0x76, 0x42, + 0x92, 0x70, 0x02, 0x1b, 0xac, 0xd2, 0xc2, 0xbb, 0xfb, 0xe5, 0x09, 0x55, 0x81, 0x95, 0x60, 0x8e, + 0xdd, 0x7f, 0xc8, 0xc4, 0xf4, 0xe2, 0xec, 0x19, 0x32, 0xf1, 0xaf, 0x2d, 0x18, 0x58, 0xa7, 0xb7, + 0xd7, 0x83, 0x3f, 0x02, 0x5e, 0x37, 0x8e, 0x80, 0x13, 0x79, 0xf9, 0x63, 0x72, 0x77, 0xff, 0x6a, + 0x62, 0xf7, 0x9f, 0xca, 0xa5, 0xd0, 0x7d, 0xe3, 0xb7, 0x60, 0x94, 0x65, 0xa5, 0x11, 0x0e, 0x6f, + 0xcf, 0x1b, 0x1b, 0xbe, 0x9c, 0xd8, 0xf0, 0x93, 0x1a, 0xaa, 0xb6, 0xd3, 0x9f, 0x84, 0x61, 0xe1, + 0x41, 0x95, 0xf4, 0xe2, 0x16, 0xb8, 0x58, 0xc2, 0xed, 0x9f, 0x28, 0x82, 0x91, 0x05, 0x07, 0xfd, + 0x9a, 0x05, 0xf3, 0x01, 0xb7, 0xac, 0x6e, 0x2c, 0x77, 0x02, 0xd7, 0xdb, 0xaa, 0xd5, 0xb7, 0x49, + 0xa3, 0xd3, 0x74, 0xbd, 0xad, 0xca, 0x96, 0xe7, 0xab, 0xe2, 0x95, 0x5b, 0xa4, 0xde, 0x61, 0x5a, + 0xcf, 0x1e, 0x29, 0x77, 0x94, 0x87, 0xc2, 0x73, 0x77, 0xf6, 0xcb, 0xf3, 0xf8, 0x40, 0xb4, 0xf1, + 0x01, 0xfb, 0x82, 0x7e, 0xcf, 0x82, 0x73, 0x3c, 0x1b, 0x4b, 0xff, 0xfd, 0xef, 0x22, 0x44, 0xa8, + 0x4a, 0x52, 0x31, 0x91, 0x0d, 0x12, 0xb4, 0x16, 0x5f, 0x12, 0x03, 0x7a, 0xae, 0x7a, 0xb0, 0xb6, + 0xf0, 0x41, 0x3b, 0x67, 0xff, 0xf3, 0x22, 0x8c, 0x8b, 0xd0, 0x7a, 0xe2, 0x0e, 0x78, 0xd1, 0x58, + 0x12, 0x8f, 0x24, 0x96, 0xc4, 0xb4, 0x81, 0x7c, 0x7f, 0x8e, 0xff, 0x10, 0xa6, 0xe9, 0xe1, 0x7c, + 0x91, 0x38, 0x41, 0x74, 0x83, 0x38, 0xdc, 0xde, 0xae, 0x78, 0xe0, 0xd3, 0x5f, 0x09, 0x7e, 0x2f, + 0x27, 0x89, 0xe1, 0x34, 0xfd, 0xef, 0xa4, 0x3b, 0xc7, 0x83, 0xa9, 0x54, 0x74, 0xc4, 0xb7, 0xa0, + 0xa4, 0xdc, 0x7f, 0xc4, 0xa1, 0xd3, 0x3d, 0xc8, 0x68, 0x92, 0x02, 0x97, 0x2b, 0xc6, 0xae, 0x67, + 0x31, 0x39, 0xfb, 0x1f, 0x17, 0x8c, 0x06, 0xf9, 0x24, 0xae, 0xc3, 0x88, 0x13, 0xb2, 0xc0, 0xc7, + 0x8d, 0x6e, 0xa2, 0xdf, 0x54, 0x33, 0xcc, 0x05, 0x6b, 0x41, 0xd4, 0xc4, 0x8a, 0x06, 0xba, 0xc8, + 0xad, 0x1a, 0x77, 0x49, 0x37, 0xb9, 0x6f, 0x8a, 0x1a, 0x48, 0xbb, 0xc7, 0x5d, 0x82, 0x45, 0x7d, + 0xf4, 0x49, 0x6e, 0x76, 0x7a, 0xc9, 0xf3, 0x6f, 0x7a, 0x17, 0x7c, 0x5f, 0x86, 0x51, 0xe9, 0x8f, + 0xe0, 0xb4, 0x34, 0x36, 0x55, 0xd5, 0xb1, 0x49, 0xad, 0xbf, 0x70, 0xc3, 0x9f, 0x05, 0x96, 0x7d, + 0xc2, 0xf4, 0xb6, 0x0f, 0x11, 0x81, 0x49, 0x11, 0xb7, 0x51, 0x96, 0x89, 0xb1, 0xcb, 0x7c, 0xe1, + 0x9a, 0xb5, 0x63, 0x0d, 0xc5, 0x25, 0x93, 0x04, 0x4e, 0xd2, 0xb4, 0x7f, 0xc6, 0x02, 0xe6, 0x79, + 0x7c, 0x08, 0xfc, 0xc8, 0x47, 0x4c, 0x7e, 0x64, 0x36, 0x6f, 0x90, 0x73, 0x58, 0x91, 0x17, 0xf8, + 0xca, 0xaa, 0x06, 0xfe, 0xad, 0x3d, 0x61, 0x2b, 0xd4, 0xfb, 0x71, 0x65, 0x7f, 0x37, 0xbf, 0x64, + 0x54, 0xc4, 0xd6, 0x16, 0x4c, 0x7b, 0xda, 0x7f, 0x7a, 0xa4, 0xca, 0xb7, 0xe3, 0x63, 0xbd, 0xae, + 0x11, 0x76, 0xfe, 0x6a, 0x6e, 0xbd, 0x09, 0x32, 0x38, 0x4d, 0xd9, 0xfe, 0x49, 0x0b, 0x1e, 0xd2, + 0x11, 0x35, 0xcf, 0xa1, 0x5e, 0xfa, 0x97, 0x65, 0x18, 0xf1, 0xdb, 0x24, 0x70, 0x22, 0x3f, 0x10, + 0xe7, 0xe6, 0x59, 0x39, 0xb8, 0x57, 0x44, 0xf9, 0x5d, 0x91, 0xf3, 0x42, 0x52, 0x97, 0xe5, 0x58, + 0xd5, 0xa4, 0x8f, 0x4b, 0x26, 0xf4, 0x09, 0x85, 0x8f, 0x18, 0xdb, 0x05, 0x4c, 0x95, 0x1f, 0x62, + 0x01, 0xb1, 0xff, 0xc2, 0xe2, 0x43, 0xab, 0x77, 0x1d, 0xbd, 0x03, 0x53, 0x2d, 0x27, 0xaa, 0x6f, + 0xaf, 0xdc, 0x6a, 0x07, 0x5c, 0x9b, 0x25, 0xc7, 0xe9, 0xe9, 0x5e, 0xe3, 0xa4, 0x7d, 0x64, 0x6c, + 0x4b, 0xba, 0x96, 0x20, 0x86, 0x53, 0xe4, 0xd1, 0x0d, 0x18, 0x65, 0x65, 0xcc, 0xfd, 0x31, 0xec, + 0x76, 0x39, 0xe6, 0xb5, 0xa6, 0xac, 0x21, 0xd6, 0x62, 0x3a, 0x58, 0x27, 0x6a, 0x7f, 0xa5, 0xc8, + 0xd7, 0x3b, 0x63, 0x66, 0x9f, 0x84, 0xe1, 0xb6, 0xdf, 0x58, 0xaa, 0x2c, 0x63, 0x31, 0x0b, 0xea, + 0x20, 0xad, 0xf2, 0x62, 0x2c, 0xe1, 0xe8, 0x2c, 0x8c, 0x88, 0x9f, 0x52, 0xfb, 0xc8, 0x4e, 0x27, + 0x81, 0x17, 0x62, 0x05, 0x45, 0xcf, 0x01, 0xb4, 0x03, 0x7f, 0xd7, 0x6d, 0xb0, 0x70, 0x28, 0x45, + 0xd3, 0x90, 0xa9, 0xaa, 0x20, 0x58, 0xc3, 0x42, 0xaf, 0xc2, 0x78, 0xc7, 0x0b, 0xf9, 0x85, 0xac, + 0x05, 0x9d, 0x56, 0x26, 0x36, 0x57, 0x75, 0x20, 0x36, 0x71, 0xd1, 0x02, 0x0c, 0x45, 0x0e, 0x33, + 0xcc, 0x19, 0xcc, 0xb7, 0x37, 0xde, 0xa0, 0x18, 0x7a, 0x42, 0x2a, 0x5a, 0x01, 0x8b, 0x8a, 0xe8, + 0x2d, 0xe9, 0x89, 0xcc, 0x8f, 0x36, 0x61, 0xe8, 0xdf, 0xdf, 0x31, 0xa8, 0xf9, 0x21, 0x0b, 0x07, + 0x02, 0x83, 0x16, 0x7a, 0x05, 0x80, 0xdc, 0x8a, 0x48, 0xe0, 0x39, 0x4d, 0x65, 0x4e, 0xa7, 0x6e, + 0xc6, 0x65, 0x7f, 0xdd, 0x8f, 0xae, 0x86, 0x64, 0x45, 0x61, 0x60, 0x0d, 0xdb, 0xfe, 0xbd, 0x12, + 0x40, 0xcc, 0xb9, 0xa2, 0xdb, 0x30, 0x52, 0x77, 0xda, 0x4e, 0x9d, 0x67, 0x5b, 0x2c, 0xe6, 0x39, + 0x88, 0xc6, 0x35, 0xe6, 0x97, 0x04, 0x3a, 0x17, 0xb8, 0xcb, 0xb8, 0xbd, 0x23, 0xb2, 0xb8, 0xa7, + 0x90, 0x5d, 0xb5, 0x87, 0x3e, 0x6f, 0xc1, 0xa8, 0x88, 0xfa, 0xc2, 0x66, 0xa8, 0x90, 0xaf, 0x23, + 0xd1, 0xda, 0x5f, 0x88, 0x6b, 0xf0, 0x2e, 0x3c, 0x2f, 0x57, 0xa8, 0x06, 0xe9, 0xd9, 0x0b, 0xbd, + 0x61, 0xf4, 0x41, 0xf9, 0x58, 0x2a, 0x1a, 0x43, 0xa9, 0x1e, 0x4b, 0x25, 0x76, 0x4a, 0xea, 0xef, + 0xa4, 0xab, 0xc6, 0x3b, 0x69, 0x20, 0xdf, 0xd5, 0xd2, 0x60, 0xe0, 0x7a, 0x3d, 0x91, 0x50, 0x55, + 0x0f, 0xbb, 0x30, 0x98, 0xef, 0x1f, 0xa8, 0xbd, 0x14, 0x7a, 0x84, 0x5c, 0xf8, 0x0c, 0x4c, 0x36, + 0xcc, 0x6b, 0x50, 0xac, 0xc4, 0x27, 0xf2, 0xe8, 0x26, 0x6e, 0xcd, 0xf8, 0xe2, 0x4b, 0x00, 0x70, + 0x92, 0x30, 0xaa, 0xf2, 0x28, 0x1c, 0x15, 0x6f, 0xd3, 0x17, 0xce, 0x26, 0x76, 0xee, 0x5c, 0xee, + 0x85, 0x11, 0x69, 0x51, 0xcc, 0xf8, 0x7e, 0x5b, 0x17, 0x75, 0xb1, 0xa2, 0x82, 0xde, 0x80, 0x21, + 0xe6, 0x20, 0x16, 0xce, 0x8e, 0xe4, 0x8b, 0xa2, 0xcd, 0x70, 0x84, 0xf1, 0x86, 0x64, 0x7f, 0x43, + 0x2c, 0x28, 0xa0, 0x8b, 0xd2, 0xfd, 0x32, 0xac, 0x78, 0x57, 0x43, 0xc2, 0xdc, 0x2f, 0x4b, 0x8b, + 0x8f, 0xc5, 0x9e, 0x95, 0xbc, 0x3c, 0x33, 0x6d, 0xa5, 0x51, 0x93, 0xf2, 0x11, 0xe2, 0xbf, 0xcc, + 0x86, 0x29, 0x82, 0x27, 0x65, 0x76, 0xcf, 0xcc, 0x98, 0x19, 0x0f, 0xe7, 0x35, 0x93, 0x04, 0x4e, + 0xd2, 0xa4, 0x3c, 0x19, 0xdf, 0xf5, 0xc2, 0x5d, 0xa5, 0xd7, 0xd9, 0xc1, 0x9f, 0xa2, 0xec, 0x36, + 0xe2, 0x25, 0x58, 0xd4, 0x9f, 0xdb, 0x81, 0x71, 0x63, 0xd7, 0x3e, 0x50, 0xfd, 0x8b, 0x07, 0x53, + 0xc9, 0x2d, 0xfa, 0x40, 0xd5, 0x2e, 0x7f, 0x36, 0x00, 0x13, 0xe6, 0x92, 0x42, 0xe7, 0xa0, 0x24, + 0x88, 0xa8, 0x8c, 0x32, 0x6a, 0x97, 0xac, 0x49, 0x00, 0x8e, 0x71, 0x58, 0x22, 0x21, 0x56, 0x5d, + 0xb3, 0x4f, 0x8e, 0x13, 0x09, 0x29, 0x08, 0xd6, 0xb0, 0xe8, 0xd3, 0xe2, 0x86, 0xef, 0x47, 0xea, + 0x42, 0x52, 0xeb, 0x6e, 0x91, 0x95, 0x62, 0x01, 0xa5, 0x17, 0xd1, 0x0e, 0x09, 0x3c, 0xd2, 0x34, + 0x03, 0x94, 0xab, 0x8b, 0xe8, 0x92, 0x0e, 0xc4, 0x26, 0x2e, 0xbd, 0x4e, 0xfd, 0x90, 0x2d, 0x64, + 0xf1, 0x80, 0x89, 0xed, 0xbd, 0x6b, 0xdc, 0x73, 0x5d, 0xc2, 0xd1, 0xc7, 0xe1, 0x21, 0x15, 0x0c, + 0x0c, 0x73, 0x35, 0x87, 0x6c, 0x71, 0xc8, 0x90, 0x37, 0x3c, 0xb4, 0x94, 0x8d, 0x86, 0xf3, 0xea, + 0xa3, 0xd7, 0x61, 0x42, 0x30, 0xb9, 0x92, 0xe2, 0xb0, 0x69, 0xbc, 0x74, 0xc9, 0x80, 0xe2, 0x04, + 0xb6, 0x0c, 0xb1, 0xce, 0xf8, 0x4c, 0x49, 0x61, 0x24, 0x1d, 0x62, 0x5d, 0x87, 0xe3, 0x54, 0x0d, + 0xb4, 0x00, 0x93, 0x9c, 0x07, 0xa3, 0x2f, 0x6d, 0x36, 0x0f, 0xc2, 0x9b, 0x4c, 0x6d, 0xa9, 0x2b, + 0x26, 0x18, 0x27, 0xf1, 0xd1, 0xcb, 0x30, 0xe6, 0x04, 0xf5, 0x6d, 0x37, 0x22, 0xf5, 0xa8, 0x13, + 0x70, 0x37, 0x33, 0xcd, 0xfa, 0x6b, 0x41, 0x83, 0x61, 0x03, 0xd3, 0xbe, 0x0d, 0x33, 0x19, 0x21, + 0x2d, 0xe8, 0xc2, 0x71, 0xda, 0xae, 0xfc, 0xa6, 0x84, 0x89, 0xf5, 0x42, 0xb5, 0x22, 0xbf, 0x46, + 0xc3, 0xa2, 0xab, 0x93, 0x85, 0xbe, 0xd0, 0x92, 0xdf, 0xaa, 0xd5, 0xb9, 0x2a, 0x01, 0x38, 0xc6, + 0xb1, 0xff, 0x4b, 0x01, 0x26, 0x33, 0x54, 0x27, 0x2c, 0x01, 0x6b, 0x82, 0x4d, 0x8f, 0xf3, 0xad, + 0x9a, 0x11, 0xfb, 0x0b, 0x07, 0x88, 0xd8, 0x5f, 0xec, 0x15, 0xb1, 0x7f, 0xe0, 0xdd, 0x44, 0xec, + 0x37, 0x47, 0x6c, 0xb0, 0xaf, 0x11, 0xcb, 0x88, 0xf2, 0x3f, 0x74, 0xc0, 0x28, 0xff, 0xc6, 0xa0, + 0x0f, 0xf7, 0x31, 0xe8, 0x3f, 0x5a, 0x80, 0xa9, 0xa4, 0xd6, 0xe5, 0x10, 0x24, 0x97, 0x6f, 0x18, + 0x92, 0xcb, 0xb3, 0xfd, 0x78, 0xff, 0xe6, 0x4a, 0x31, 0x71, 0x42, 0x8a, 0xf9, 0x54, 0x5f, 0xd4, + 0xba, 0x4b, 0x34, 0xff, 0x5e, 0x01, 0x8e, 0x66, 0x2a, 0xa3, 0x0e, 0x61, 0x6c, 0xae, 0x18, 0x63, + 0xf3, 0x6c, 0xdf, 0x9e, 0xd1, 0xb9, 0x03, 0x74, 0x3d, 0x31, 0x40, 0xe7, 0xfa, 0x27, 0xd9, 0x7d, + 0x94, 0xbe, 0x51, 0x84, 0x53, 0x99, 0xf5, 0x62, 0xc1, 0xdf, 0xaa, 0x21, 0xf8, 0x7b, 0x2e, 0x21, + 0xf8, 0xb3, 0xbb, 0xd7, 0xbe, 0x3f, 0x92, 0x40, 0xe1, 0x21, 0xcc, 0xe2, 0x1c, 0xdc, 0xa3, 0x14, + 0xd0, 0xf0, 0x10, 0x56, 0x84, 0xb0, 0x49, 0xf7, 0x3b, 0x49, 0xfa, 0xf7, 0x3b, 0x16, 0x1c, 0xcf, + 0x9c, 0x9b, 0x43, 0x90, 0xf6, 0xac, 0x9b, 0xd2, 0x9e, 0x27, 0xfb, 0x5e, 0xad, 0x39, 0xe2, 0x9f, + 0x2f, 0x0c, 0xe5, 0x7c, 0x0b, 0x7b, 0xc9, 0x5f, 0x81, 0x51, 0xa7, 0x5e, 0x27, 0x61, 0xb8, 0xe6, + 0x37, 0x54, 0x70, 0xef, 0x67, 0xd9, 0x3b, 0x2b, 0x2e, 0xbe, 0xbb, 0x5f, 0x9e, 0x4b, 0x92, 0x88, + 0xc1, 0x58, 0xa7, 0x80, 0x3e, 0x09, 0x23, 0xa1, 0xcc, 0xcb, 0x36, 0x70, 0xef, 0x79, 0xd9, 0x98, + 0x90, 0x40, 0x49, 0x2a, 0x14, 0x49, 0xf4, 0x7f, 0xe8, 0x11, 0x67, 0xd2, 0x5c, 0x65, 0x22, 0xfe, + 0xc9, 0x3d, 0xc4, 0x9d, 0x79, 0x0e, 0x60, 0x57, 0x3d, 0x09, 0x92, 0x52, 0x08, 0xed, 0xb1, 0xa0, + 0x61, 0xa1, 0x8f, 0xc2, 0x54, 0xc8, 0x83, 0x2d, 0xc6, 0xe6, 0x03, 0x83, 0x71, 0xce, 0xfd, 0x5a, + 0x02, 0x86, 0x53, 0xd8, 0x68, 0x55, 0xb6, 0xca, 0x0c, 0x45, 0xf8, 0xf2, 0x3c, 0x13, 0xb7, 0x28, + 0x8c, 0x45, 0x8e, 0x24, 0x27, 0x81, 0x0d, 0xbf, 0x56, 0x13, 0x7d, 0x12, 0x80, 0x2e, 0x22, 0x21, + 0x8d, 0x18, 0xce, 0x3f, 0x42, 0xe9, 0xd9, 0xd2, 0xc8, 0xb4, 0x9e, 0x66, 0xae, 0xbd, 0xcb, 0x8a, + 0x08, 0xd6, 0x08, 0x22, 0x07, 0xc6, 0xe3, 0x7f, 0x71, 0x8e, 0xe4, 0xb3, 0xb9, 0x2d, 0x24, 0x89, + 0x33, 0xd1, 0xef, 0xb2, 0x4e, 0x02, 0x9b, 0x14, 0xd1, 0x27, 0xe0, 0xf8, 0x6e, 0xae, 0x4d, 0x46, + 0x29, 0x4e, 0x7b, 0x98, 0x6f, 0x89, 0x91, 0x5f, 0xdf, 0xfe, 0x5d, 0x80, 0x87, 0xbb, 0x9c, 0xf4, + 0x68, 0xc1, 0xd4, 0xa7, 0x3e, 0x9d, 0x14, 0x11, 0xcc, 0x65, 0x56, 0x36, 0x64, 0x06, 0x89, 0x0d, + 0x55, 0x78, 0xd7, 0x1b, 0xea, 0x87, 0x2d, 0x4d, 0x78, 0xc3, 0x0d, 0x5a, 0x3f, 0x72, 0xc0, 0x1b, + 0xec, 0x3e, 0x4a, 0x73, 0x36, 0x33, 0x44, 0x22, 0xcf, 0xf5, 0xdd, 0x9d, 0xfe, 0x65, 0x24, 0x5f, + 0xcb, 0x0e, 0x5f, 0xcc, 0xa5, 0x25, 0x17, 0x0e, 0xfa, 0xfd, 0x87, 0x15, 0xca, 0xf8, 0x8f, 0x2c, + 0x38, 0x9e, 0x2a, 0xe6, 0x7d, 0x20, 0xa1, 0x88, 0xb0, 0xb5, 0xfe, 0xae, 0x3b, 0x2f, 0x09, 0xf2, + 0x6f, 0xb8, 0x28, 0xbe, 0xe1, 0x78, 0x2e, 0x5e, 0xb2, 0xeb, 0x5f, 0xfc, 0xd3, 0xf2, 0x0c, 0x6b, + 0xc0, 0x44, 0xc4, 0xf9, 0x5d, 0x47, 0x6d, 0x38, 0x5d, 0xef, 0x04, 0x41, 0xbc, 0x58, 0x33, 0x36, + 0x27, 0x7f, 0xeb, 0x3d, 0x76, 0x67, 0xbf, 0x7c, 0x7a, 0xa9, 0x07, 0x2e, 0xee, 0x49, 0x0d, 0x79, + 0x80, 0x5a, 0x29, 0xcb, 0x27, 0x91, 0x1a, 0x3d, 0xd3, 0x56, 0x21, 0x6d, 0x27, 0xc5, 0x5d, 0x38, + 0x33, 0xec, 0xa7, 0x32, 0x28, 0x1f, 0xae, 0xf4, 0xe4, 0x5b, 0x13, 0x9b, 0x7a, 0xee, 0x32, 0x9c, + 0xea, 0xbe, 0x98, 0x0e, 0xe4, 0x3e, 0xfe, 0x07, 0x16, 0x9c, 0xec, 0x1a, 0xa3, 0xe8, 0xdb, 0xf0, + 0xb1, 0x60, 0x7f, 0xce, 0x82, 0x47, 0x32, 0x6b, 0x18, 0x46, 0x76, 0xe7, 0xa0, 0x54, 0x4f, 0x24, + 0xf6, 0x8d, 0xa3, 0x75, 0xa8, 0xa4, 0xbe, 0x31, 0x8e, 0x61, 0x4b, 0x57, 0xe8, 0x69, 0x4b, 0xf7, + 0x9b, 0x16, 0xa4, 0xae, 0xfa, 0x43, 0xe0, 0x3c, 0x2b, 0x26, 0xe7, 0xf9, 0x58, 0x3f, 0xa3, 0x99, + 0xc3, 0x74, 0xfe, 0xd5, 0x24, 0x1c, 0xcb, 0xf1, 0xfe, 0xdc, 0x85, 0xe9, 0xad, 0x3a, 0x31, 0xdd, + 0xfd, 0xbb, 0x85, 0xc1, 0xea, 0x1a, 0x1b, 0x80, 0xe7, 0x53, 0x4e, 0xa1, 0xe0, 0x74, 0x13, 0xe8, + 0x73, 0x16, 0x1c, 0x71, 0x6e, 0x86, 0x2b, 0xf4, 0x05, 0xe1, 0xd6, 0x17, 0x9b, 0x7e, 0x7d, 0x87, + 0x32, 0x66, 0x72, 0x5b, 0xbd, 0x90, 0x29, 0xd5, 0xbd, 0x5e, 0x4b, 0xe1, 0x1b, 0xcd, 0xb3, 0xec, + 0xf9, 0x59, 0x58, 0x38, 0xb3, 0x2d, 0x84, 0x45, 0xfe, 0x1a, 0x27, 0xda, 0xee, 0x16, 0x90, 0x22, + 0xcb, 0x4d, 0x97, 0xb3, 0xc4, 0x12, 0x82, 0x15, 0x1d, 0xf4, 0x69, 0x28, 0x6d, 0x49, 0xdf, 0xf3, + 0x0c, 0x96, 0x3b, 0x1e, 0xc8, 0xee, 0x1e, 0xf9, 0xdc, 0x38, 0x41, 0x21, 0xe1, 0x98, 0x28, 0x7a, + 0x1d, 0x8a, 0xde, 0x66, 0xd8, 0x2d, 0x01, 0x7d, 0xc2, 0x0a, 0x95, 0x87, 0x7d, 0x59, 0x5f, 0xad, + 0x61, 0x5a, 0x11, 0x5d, 0x84, 0x62, 0x70, 0xa3, 0x21, 0x54, 0x12, 0x99, 0x9b, 0x14, 0x2f, 0x2e, + 0xe7, 0xf4, 0x8a, 0x51, 0xc2, 0x8b, 0xcb, 0x98, 0x92, 0x40, 0x55, 0x18, 0x64, 0x2e, 0x93, 0x82, + 0xb5, 0xcd, 0x7c, 0xca, 0x77, 0x71, 0x3d, 0xe6, 0xee, 0x58, 0x0c, 0x01, 0x73, 0x42, 0x68, 0x03, + 0x86, 0xea, 0x2c, 0x59, 0xb9, 0xe0, 0x65, 0x3f, 0x98, 0xa9, 0x7c, 0xe8, 0x92, 0xc5, 0x5d, 0xc8, + 0xe2, 0x19, 0x06, 0x16, 0xb4, 0x18, 0x55, 0xd2, 0xde, 0xde, 0x94, 0x37, 0x56, 0x36, 0x55, 0x96, + 0x59, 0xbf, 0x2b, 0x55, 0x86, 0x81, 0x05, 0x2d, 0xf4, 0x0a, 0x14, 0x36, 0xeb, 0xc2, 0x1d, 0x32, + 0x53, 0x0b, 0x61, 0x46, 0xee, 0x59, 0x1c, 0xba, 0xb3, 0x5f, 0x2e, 0xac, 0x2e, 0xe1, 0xc2, 0x66, + 0x1d, 0xad, 0xc3, 0xf0, 0x26, 0x8f, 0xf5, 0x21, 0x14, 0x0d, 0x4f, 0x64, 0x87, 0x21, 0x49, 0x85, + 0x03, 0xe1, 0xae, 0x75, 0x02, 0x80, 0x25, 0x11, 0x96, 0x4e, 0x45, 0xc5, 0x2c, 0x11, 0x21, 0x13, + 0xe7, 0x0f, 0x16, 0x67, 0x86, 0x3f, 0x35, 0xe2, 0xc8, 0x27, 0x58, 0xa3, 0x48, 0x57, 0xb5, 0x73, + 0xbb, 0x13, 0xb0, 0x78, 0xfa, 0x22, 0xb6, 0x56, 0xe6, 0xaa, 0x5e, 0x90, 0x48, 0xdd, 0x56, 0xb5, + 0x42, 0xc2, 0x31, 0x51, 0xb4, 0x03, 0xe3, 0xbb, 0x61, 0x7b, 0x9b, 0xc8, 0x2d, 0xcd, 0x42, 0x6d, + 0xe5, 0x70, 0xb3, 0xd7, 0x04, 0xa2, 0x1b, 0x44, 0x1d, 0xa7, 0x99, 0x3a, 0x85, 0xd8, 0xb3, 0xe6, + 0x9a, 0x4e, 0x0c, 0x9b, 0xb4, 0xe9, 0xf0, 0xbf, 0xd3, 0xf1, 0x6f, 0xec, 0x45, 0x44, 0x44, 0x3a, + 0xcc, 0x1c, 0xfe, 0x37, 0x39, 0x4a, 0x7a, 0xf8, 0x05, 0x00, 0x4b, 0x22, 0xe8, 0x9a, 0x18, 0x1e, + 0x76, 0x7a, 0x4e, 0xe5, 0x87, 0x51, 0x5e, 0x90, 0x48, 0x39, 0x83, 0xc2, 0x4e, 0xcb, 0x98, 0x14, + 0x3b, 0x25, 0xdb, 0xdb, 0x7e, 0xe4, 0x7b, 0x89, 0x13, 0x7a, 0x3a, 0xff, 0x94, 0xac, 0x66, 0xe0, + 0xa7, 0x4f, 0xc9, 0x2c, 0x2c, 0x9c, 0xd9, 0x16, 0x6a, 0xc0, 0x44, 0xdb, 0x0f, 0xa2, 0x9b, 0x7e, + 0x20, 0xd7, 0x17, 0xea, 0x22, 0x28, 0x35, 0x30, 0x45, 0x8b, 0x2c, 0x88, 0xa8, 0x09, 0xc1, 0x09, + 0x9a, 0xe8, 0x63, 0x30, 0x1c, 0xd6, 0x9d, 0x26, 0xa9, 0x5c, 0x99, 0x9d, 0xc9, 0xbf, 0x7e, 0x6a, + 0x1c, 0x25, 0x67, 0x75, 0xf1, 0x50, 0x2d, 0x1c, 0x05, 0x4b, 0x72, 0x68, 0x15, 0x06, 0x59, 0x9a, + 0x52, 0x16, 0x96, 0x33, 0x27, 0x1a, 0x74, 0xca, 0xe1, 0x81, 0x9f, 0x4d, 0xac, 0x18, 0xf3, 0xea, + 0x74, 0x0f, 0x08, 0x49, 0x81, 0x1f, 0xce, 0x1e, 0xcd, 0xdf, 0x03, 0x42, 0xc0, 0x70, 0xa5, 0xd6, + 0x6d, 0x0f, 0x28, 0x24, 0x1c, 0x13, 0xa5, 0x27, 0x33, 0x3d, 0x4d, 0x8f, 0x75, 0x31, 0x66, 0xcb, + 0x3d, 0x4b, 0xd9, 0xc9, 0x4c, 0x4f, 0x52, 0x4a, 0xc2, 0xfe, 0xf5, 0x91, 0x34, 0xcf, 0xc2, 0x24, + 0x4c, 0xff, 0x97, 0x95, 0x32, 0x3e, 0xf8, 0x50, 0xbf, 0x02, 0xef, 0xfb, 0xf8, 0x70, 0xfd, 0x9c, + 0x05, 0xc7, 0xda, 0x99, 0x1f, 0x22, 0x18, 0x80, 0xfe, 0xe4, 0xe6, 0xfc, 0xd3, 0x55, 0x08, 0xd7, + 0x6c, 0x38, 0xce, 0x69, 0x29, 0x29, 0x1c, 0x28, 0xbe, 0x6b, 0xe1, 0xc0, 0x1a, 0x8c, 0xd4, 0xf9, + 0x4b, 0x4e, 0x86, 0x1e, 0xef, 0x2b, 0x00, 0x21, 0x63, 0x25, 0xc4, 0x13, 0x70, 0x13, 0x2b, 0x12, + 0xe8, 0x47, 0x2c, 0x38, 0x99, 0xec, 0x3a, 0x26, 0x0c, 0x2c, 0xe2, 0xbe, 0x72, 0xb1, 0xd6, 0xaa, + 0xf8, 0xfe, 0x14, 0xff, 0x6f, 0x20, 0xdf, 0xed, 0x85, 0x80, 0xbb, 0x37, 0x86, 0x96, 0x33, 0xe4, + 0x6a, 0x43, 0xa6, 0x46, 0xb1, 0x0f, 0xd9, 0xda, 0x0b, 0x30, 0xd6, 0xf2, 0x3b, 0x5e, 0x24, 0x6c, + 0xdf, 0x84, 0x15, 0x12, 0xb3, 0xbe, 0x59, 0xd3, 0xca, 0xb1, 0x81, 0x95, 0x90, 0xc8, 0x8d, 0xdc, + 0xb3, 0x44, 0xee, 0x6d, 0x18, 0xf3, 0x34, 0x63, 0xed, 0x6e, 0x2f, 0x58, 0x21, 0x5d, 0xd4, 0xb0, + 0x79, 0x2f, 0xf5, 0x12, 0x6c, 0x50, 0xeb, 0x2e, 0x2d, 0x83, 0x77, 0x27, 0x2d, 0x3b, 0xd4, 0x27, + 0xb1, 0xfd, 0xf3, 0x85, 0x8c, 0x17, 0x03, 0x97, 0xca, 0xbd, 0x66, 0x4a, 0xe5, 0xce, 0x24, 0xa5, + 0x72, 0x29, 0x55, 0x95, 0x21, 0x90, 0xeb, 0x3f, 0x3f, 0x5a, 0xdf, 0x41, 0x65, 0xbf, 0xcf, 0x82, + 0x87, 0x98, 0xee, 0x83, 0x36, 0xf0, 0xae, 0xf5, 0x1d, 0x0f, 0xdf, 0xd9, 0x2f, 0x3f, 0x74, 0x39, + 0x9b, 0x1c, 0xce, 0x6b, 0xc7, 0x6e, 0xc2, 0xe9, 0x5e, 0xf7, 0x2e, 0xb3, 0xf2, 0x6c, 0x28, 0xe3, + 0x88, 0xd8, 0xca, 0xb3, 0x51, 0x59, 0xc6, 0x0c, 0xd2, 0x6f, 0xc8, 0x34, 0xfb, 0x3f, 0x5b, 0x50, + 0xac, 0xfa, 0x8d, 0x43, 0x78, 0xd1, 0x7f, 0xc4, 0x78, 0xd1, 0x3f, 0x9c, 0x7d, 0xe3, 0x37, 0x72, + 0x95, 0x7d, 0x2b, 0x09, 0x65, 0xdf, 0xc9, 0x3c, 0x02, 0xdd, 0x55, 0x7b, 0x3f, 0x55, 0x84, 0xd1, + 0xaa, 0xdf, 0x50, 0xfb, 0xec, 0x5f, 0xde, 0x8b, 0x8b, 0x45, 0x6e, 0xc6, 0x1b, 0x8d, 0x32, 0x33, + 0x8d, 0x95, 0x4e, 0xf7, 0xdf, 0x66, 0x9e, 0x16, 0xd7, 0x89, 0xbb, 0xb5, 0x1d, 0x91, 0x46, 0xf2, + 0x73, 0x0e, 0xcf, 0xd3, 0xe2, 0x9b, 0x45, 0x98, 0x4c, 0xb4, 0x8e, 0x9a, 0x30, 0xde, 0xd4, 0x55, + 0x49, 0x62, 0x9d, 0xde, 0x93, 0x16, 0x4a, 0x58, 0xaa, 0x6b, 0x45, 0xd8, 0x24, 0x8e, 0xe6, 0x01, + 0x94, 0x6d, 0x85, 0x94, 0xf6, 0xb3, 0x67, 0x8d, 0x32, 0xbe, 0x08, 0xb1, 0x86, 0x81, 0x5e, 0x84, + 0xd1, 0xc8, 0x6f, 0xfb, 0x4d, 0x7f, 0x6b, 0xef, 0x12, 0x91, 0xd1, 0xf4, 0x94, 0xf5, 0xed, 0x46, + 0x0c, 0xc2, 0x3a, 0x1e, 0xba, 0x05, 0xd3, 0x8a, 0x48, 0xed, 0x3e, 0xa8, 0xd7, 0x98, 0xd8, 0x64, + 0x3d, 0x49, 0x11, 0xa7, 0x1b, 0x41, 0xaf, 0xc0, 0x04, 0x33, 0x03, 0x66, 0xf5, 0x2f, 0x91, 0x3d, + 0x19, 0x65, 0x95, 0x71, 0xd8, 0x6b, 0x06, 0x04, 0x27, 0x30, 0xd1, 0x12, 0x4c, 0xb7, 0xdc, 0x30, + 0x51, 0x7d, 0x88, 0x55, 0x67, 0x1d, 0x58, 0x4b, 0x02, 0x71, 0x1a, 0xdf, 0xfe, 0x59, 0x31, 0xc7, + 0x5e, 0xe4, 0xbe, 0xbf, 0x1d, 0xdf, 0xdb, 0xdb, 0xf1, 0x1b, 0x16, 0x4c, 0xd1, 0xd6, 0x99, 0x6d, + 0xa3, 0x64, 0xa4, 0x54, 0x1c, 0x7e, 0xab, 0x4b, 0x1c, 0xfe, 0x33, 0xf4, 0xd8, 0x6e, 0xf8, 0x9d, + 0x48, 0x48, 0x47, 0xb5, 0x73, 0x99, 0x96, 0x62, 0x01, 0x15, 0x78, 0x24, 0x08, 0x84, 0x47, 0xb2, + 0x8e, 0x47, 0x82, 0x00, 0x0b, 0xa8, 0x0c, 0xd3, 0x3f, 0x90, 0x1d, 0xa6, 0x9f, 0x47, 0x5b, 0x16, + 0x56, 0x70, 0x82, 0xa5, 0xd5, 0xa2, 0x2d, 0x4b, 0xf3, 0xb8, 0x18, 0xc7, 0xfe, 0x5a, 0x11, 0xc6, + 0xaa, 0x7e, 0x23, 0x36, 0xec, 0x78, 0xc1, 0x30, 0xec, 0x38, 0x9d, 0x30, 0xec, 0x98, 0xd2, 0x71, + 0xdf, 0x37, 0xe3, 0xf8, 0x56, 0x99, 0x71, 0xfc, 0x86, 0xc5, 0x66, 0x6d, 0x79, 0xbd, 0xc6, 0x4d, + 0x65, 0xd1, 0x79, 0x18, 0x65, 0x27, 0x1c, 0x73, 0x81, 0x97, 0xd6, 0x0e, 0x2c, 0x6d, 0xde, 0x7a, + 0x5c, 0x8c, 0x75, 0x1c, 0x74, 0x16, 0x46, 0x42, 0xe2, 0x04, 0xf5, 0x6d, 0x75, 0xbc, 0x0b, 0xd3, + 0x04, 0x5e, 0x86, 0x15, 0x14, 0xbd, 0x19, 0x07, 0xfa, 0x2d, 0xe6, 0xbb, 0xd4, 0xea, 0xfd, 0xe1, + 0x5b, 0x24, 0x3f, 0xba, 0xaf, 0x7d, 0x1d, 0x50, 0x1a, 0xbf, 0x8f, 0x50, 0x94, 0x65, 0x33, 0x14, + 0x65, 0x29, 0x15, 0x86, 0xf2, 0x6f, 0x2c, 0x98, 0xa8, 0xfa, 0x0d, 0xba, 0x75, 0xbf, 0x93, 0xf6, + 0xa9, 0x1e, 0xe5, 0x7c, 0xa8, 0x4b, 0x94, 0xf3, 0x47, 0x61, 0xb0, 0xea, 0x37, 0x7a, 0x84, 0xcb, + 0xfc, 0xfb, 0x16, 0x0c, 0x57, 0xfd, 0xc6, 0x21, 0x28, 0x5e, 0x5e, 0x33, 0x15, 0x2f, 0x0f, 0xe5, + 0xac, 0x9b, 0x1c, 0x5d, 0xcb, 0xdf, 0x1d, 0x80, 0x71, 0xda, 0x4f, 0x7f, 0x4b, 0x4e, 0xa5, 0x31, + 0x6c, 0x56, 0x1f, 0xc3, 0x46, 0x9f, 0x01, 0x7e, 0xb3, 0xe9, 0xdf, 0x4c, 0x4e, 0xeb, 0x2a, 0x2b, + 0xc5, 0x02, 0x8a, 0x9e, 0x81, 0x91, 0x76, 0x40, 0x76, 0x5d, 0x5f, 0xf0, 0xd7, 0x9a, 0x1a, 0xab, + 0x2a, 0xca, 0xb1, 0xc2, 0xa0, 0x0f, 0xef, 0xd0, 0xf5, 0x28, 0x2f, 0x51, 0xf7, 0xbd, 0x06, 0xd7, + 0x4d, 0x14, 0x45, 0x2a, 0x1e, 0xad, 0x1c, 0x1b, 0x58, 0xe8, 0x3a, 0x94, 0xd8, 0x7f, 0x76, 0xec, + 0x1c, 0x3c, 0x09, 0xb8, 0x48, 0x4e, 0x2a, 0x08, 0xe0, 0x98, 0x16, 0x7a, 0x0e, 0x20, 0x92, 0xe9, + 0x2c, 0x42, 0x11, 0x36, 0x51, 0xbd, 0x45, 0x54, 0xa2, 0x8b, 0x10, 0x6b, 0x58, 0xe8, 0x69, 0x28, + 0x45, 0x8e, 0xdb, 0xbc, 0xec, 0x7a, 0x4c, 0x7f, 0x4f, 0xfb, 0x2f, 0x72, 0x84, 0x8a, 0x42, 0x1c, + 0xc3, 0x29, 0x2f, 0xc8, 0x02, 0xe2, 0x2c, 0xee, 0x45, 0x22, 0x1d, 0x56, 0x91, 0xf3, 0x82, 0x97, + 0x55, 0x29, 0xd6, 0x30, 0xd0, 0x36, 0x9c, 0x70, 0x3d, 0x96, 0xb6, 0x86, 0xd4, 0x76, 0xdc, 0xf6, + 0xc6, 0xe5, 0xda, 0x35, 0x12, 0xb8, 0x9b, 0x7b, 0x8b, 0x4e, 0x7d, 0x87, 0x78, 0x32, 0xbd, 0xb3, + 0xcc, 0xfa, 0x7f, 0xa2, 0xd2, 0x05, 0x17, 0x77, 0xa5, 0x64, 0x3f, 0xcf, 0xd6, 0xfb, 0x95, 0x1a, + 0x7a, 0xca, 0x38, 0x3a, 0x8e, 0xe9, 0x47, 0xc7, 0xdd, 0xfd, 0xf2, 0xd0, 0x95, 0x9a, 0x16, 0x95, + 0xe5, 0x65, 0x38, 0x5a, 0xf5, 0x1b, 0x55, 0x3f, 0x88, 0x56, 0xfd, 0xe0, 0xa6, 0x13, 0x34, 0xe4, + 0xf2, 0x2a, 0xcb, 0xb8, 0x34, 0xf4, 0xfc, 0x1c, 0xe4, 0xa7, 0x8b, 0x11, 0x73, 0xe6, 0x79, 0xc6, + 0xb1, 0x1d, 0xd0, 0xe1, 0xb0, 0xce, 0x78, 0x07, 0x95, 0xf8, 0xe9, 0x82, 0x13, 0x11, 0x74, 0x05, + 0xc6, 0xeb, 0xfa, 0x35, 0x2a, 0xaa, 0x3f, 0x29, 0x2f, 0x32, 0xe3, 0x8e, 0xcd, 0xbc, 0x77, 0xcd, + 0xfa, 0xf6, 0x77, 0x8b, 0x46, 0xb8, 0x20, 0x82, 0x9b, 0xb4, 0xf6, 0x93, 0x01, 0x5d, 0x66, 0x86, + 0x29, 0xe4, 0x47, 0xfd, 0xe3, 0x7a, 0xe5, 0xae, 0x99, 0x61, 0xec, 0xef, 0x81, 0x63, 0xc9, 0xe6, + 0xfb, 0x4e, 0xc3, 0xbe, 0x04, 0xd3, 0x81, 0x5e, 0x51, 0x4b, 0xb3, 0x77, 0x94, 0x67, 0xf3, 0x48, + 0x00, 0x71, 0x1a, 0xdf, 0x7e, 0x11, 0xa6, 0xe9, 0xe3, 0x57, 0x31, 0x72, 0x6c, 0x94, 0x7b, 0x07, + 0xe8, 0xf9, 0xc3, 0x21, 0x76, 0x11, 0x25, 0x72, 0x2e, 0xa1, 0x4f, 0xc1, 0x44, 0x48, 0x2e, 0xbb, + 0x5e, 0xe7, 0x96, 0x94, 0xad, 0x75, 0xf1, 0xb4, 0xad, 0xad, 0xe8, 0x98, 0xfc, 0xfd, 0x60, 0x96, + 0xe1, 0x04, 0x35, 0xd4, 0x82, 0x89, 0x9b, 0xae, 0xd7, 0xf0, 0x6f, 0x86, 0x92, 0xfe, 0x48, 0xbe, + 0xa0, 0xfe, 0x3a, 0xc7, 0x4c, 0xf4, 0xd1, 0x68, 0xee, 0xba, 0x41, 0x0c, 0x27, 0x88, 0xd3, 0xcd, + 0x1e, 0x74, 0xbc, 0x85, 0xf0, 0x6a, 0x48, 0xb8, 0xe7, 0xa8, 0xd8, 0xec, 0x58, 0x16, 0xe2, 0x18, + 0x4e, 0x37, 0x3b, 0xfb, 0x73, 0x21, 0xf0, 0x3b, 0x3c, 0xc1, 0x8f, 0xd8, 0xec, 0x58, 0x95, 0x62, + 0x0d, 0x83, 0x1e, 0x86, 0xec, 0xdf, 0xba, 0xef, 0x61, 0xdf, 0x8f, 0xe4, 0xf1, 0xc9, 0x12, 0xd4, + 0x69, 0xe5, 0xd8, 0xc0, 0x42, 0xab, 0x80, 0xc2, 0x4e, 0xbb, 0xdd, 0x64, 0xa6, 0x8b, 0x4e, 0x93, + 0x91, 0xe2, 0x66, 0x57, 0x45, 0x6e, 0xdd, 0x52, 0x4b, 0x41, 0x71, 0x46, 0x0d, 0x7a, 0x2f, 0x6e, + 0x8a, 0xae, 0x0e, 0xb2, 0xae, 0x72, 0xa5, 0x5e, 0x8d, 0xf7, 0x53, 0xc2, 0xd0, 0x0a, 0x0c, 0x87, + 0x7b, 0x61, 0x3d, 0x6a, 0x86, 0xdd, 0xd2, 0x01, 0xd6, 0x18, 0x8a, 0x96, 0x8d, 0x96, 0x57, 0xc1, + 0xb2, 0x2e, 0xaa, 0xc3, 0x8c, 0xa0, 0xb8, 0xb4, 0xed, 0x78, 0x2a, 0x49, 0x19, 0xb7, 0xde, 0x3b, + 0x7f, 0x67, 0xbf, 0x3c, 0x23, 0x5a, 0xd6, 0xc1, 0x77, 0xf7, 0xcb, 0x74, 0x73, 0x64, 0x40, 0x70, + 0x16, 0x35, 0xbe, 0xf8, 0xea, 0x75, 0xbf, 0xd5, 0xae, 0x06, 0xfe, 0xa6, 0xdb, 0x24, 0xdd, 0x14, + 0xa3, 0x35, 0x03, 0x53, 0x2c, 0x3e, 0xa3, 0x0c, 0x27, 0xa8, 0xa1, 0x1b, 0x30, 0xe9, 0xb4, 0xdb, + 0x0b, 0x41, 0xcb, 0x0f, 0x64, 0x03, 0xa3, 0xf9, 0x12, 0xf6, 0x05, 0x13, 0x95, 0xe7, 0x28, 0x4b, + 0x14, 0xe2, 0x24, 0x41, 0xfb, 0xbb, 0x19, 0x7f, 0x5a, 0x73, 0xb7, 0x3c, 0x27, 0xea, 0x04, 0x04, + 0xb5, 0x60, 0xbc, 0xcd, 0x4e, 0x30, 0x91, 0xda, 0x47, 0xec, 0xa7, 0x17, 0xfa, 0x94, 0xb1, 0xdd, + 0x64, 0xc9, 0x09, 0x0d, 0x5b, 0xcb, 0xaa, 0x4e, 0x0e, 0x9b, 0xd4, 0xed, 0x7f, 0x73, 0x9c, 0x71, + 0x38, 0x35, 0x2e, 0x38, 0x1b, 0x16, 0xae, 0x69, 0xe2, 0xa9, 0x3c, 0x97, 0x2f, 0xa2, 0x8e, 0xa7, + 0x5e, 0xb8, 0xb7, 0x61, 0x59, 0x17, 0x7d, 0x12, 0x26, 0xe8, 0xcb, 0x53, 0x71, 0x19, 0xe1, 0xec, + 0x91, 0xfc, 0x20, 0x3a, 0x0a, 0x4b, 0x4f, 0xfb, 0xa5, 0x57, 0xc6, 0x09, 0x62, 0xe8, 0x4d, 0x66, + 0x7e, 0x28, 0x49, 0x17, 0xfa, 0x21, 0xad, 0x5b, 0x1a, 0x4a, 0xb2, 0x1a, 0x11, 0xd4, 0x81, 0x99, + 0x74, 0x72, 0xd3, 0x70, 0xd6, 0xce, 0x67, 0xe1, 0xd3, 0xf9, 0x49, 0xe3, 0xfc, 0x4c, 0x69, 0x58, + 0x88, 0xb3, 0xe8, 0xa3, 0xcb, 0xc9, 0xd4, 0x93, 0x45, 0x43, 0xb8, 0x9d, 0x4a, 0x3f, 0x39, 0xde, + 0x35, 0xeb, 0xe4, 0x16, 0x9c, 0xd4, 0xb2, 0xf7, 0x5d, 0x08, 0x1c, 0x66, 0xfe, 0xe2, 0xb2, 0x23, + 0x5b, 0xe3, 0xbd, 0x1e, 0xb9, 0xb3, 0x5f, 0x3e, 0xb9, 0xd1, 0x0d, 0x11, 0x77, 0xa7, 0x83, 0xae, + 0xc0, 0x51, 0x1e, 0x02, 0x62, 0x99, 0x38, 0x8d, 0xa6, 0xeb, 0x29, 0xe6, 0x8e, 0x1f, 0x2b, 0xc7, + 0xef, 0xec, 0x97, 0x8f, 0x2e, 0x64, 0x21, 0xe0, 0xec, 0x7a, 0xe8, 0x35, 0x28, 0x35, 0xbc, 0x50, + 0x8c, 0xc1, 0x90, 0x91, 0x20, 0xb1, 0xb4, 0xbc, 0x5e, 0x53, 0xdf, 0x1f, 0xff, 0xc1, 0x71, 0x05, + 0xb4, 0xc5, 0xb5, 0x2b, 0x4a, 0x24, 0x36, 0x9c, 0x8a, 0x0c, 0x98, 0x94, 0x1a, 0x1b, 0x2e, 0xf0, + 0x5c, 0xad, 0xa8, 0x3c, 0xc3, 0x0c, 0xef, 0x78, 0x83, 0x30, 0x7a, 0x03, 0x90, 0x48, 0xc4, 0xb1, + 0x50, 0x67, 0x79, 0xa3, 0x34, 0x93, 0x47, 0xf5, 0xd2, 0xad, 0xa5, 0x30, 0x70, 0x46, 0x2d, 0x74, + 0x91, 0x9e, 0x5c, 0x7a, 0xa9, 0x38, 0x19, 0x55, 0x1a, 0xde, 0x65, 0xd2, 0x0e, 0x08, 0xb3, 0xd2, + 0x33, 0x29, 0xe2, 0x44, 0x3d, 0xd4, 0x80, 0x13, 0x4e, 0x27, 0xf2, 0x99, 0xe2, 0xca, 0x44, 0xdd, + 0xf0, 0x77, 0x88, 0xc7, 0x74, 0xc6, 0x23, 0x2c, 0xe2, 0xe0, 0x89, 0x85, 0x2e, 0x78, 0xb8, 0x2b, + 0x15, 0xca, 0xf5, 0xab, 0xbc, 0xfb, 0x60, 0xc6, 0x3b, 0xcc, 0xc8, 0xbd, 0xff, 0x22, 0x8c, 0x6e, + 0xfb, 0x61, 0xb4, 0x4e, 0xa2, 0x9b, 0x7e, 0xb0, 0x23, 0x22, 0x7f, 0xc7, 0xd9, 0x16, 0x62, 0x10, + 0xd6, 0xf1, 0xe8, 0xb3, 0x9e, 0x59, 0x34, 0x55, 0x96, 0x99, 0x31, 0xc9, 0x48, 0x7c, 0xc6, 0x5c, + 0xe4, 0xc5, 0x58, 0xc2, 0x25, 0x6a, 0xa5, 0xba, 0xc4, 0x0c, 0x43, 0x12, 0xa8, 0x95, 0xea, 0x12, + 0x96, 0x70, 0xba, 0x5c, 0xc3, 0x6d, 0x27, 0x20, 0xd5, 0xc0, 0xaf, 0x93, 0x50, 0xcb, 0xf1, 0xf1, + 0x30, 0x8f, 0x6b, 0x4e, 0x97, 0x6b, 0x2d, 0x0b, 0x01, 0x67, 0xd7, 0x43, 0x24, 0x9d, 0xb9, 0x72, + 0x22, 0x5f, 0xa3, 0x97, 0xe6, 0x99, 0xfa, 0x4c, 0x5e, 0xe9, 0xc1, 0x94, 0xca, 0x99, 0xc9, 0x23, + 0x99, 0x87, 0xb3, 0x93, 0x6c, 0x6d, 0xf7, 0x1f, 0x06, 0x5d, 0xe9, 0x48, 0x2b, 0x09, 0x4a, 0x38, + 0x45, 0xdb, 0x08, 0x69, 0x39, 0xd5, 0x33, 0xa4, 0xe5, 0x39, 0x28, 0x85, 0x9d, 0x1b, 0x0d, 0xbf, + 0xe5, 0xb8, 0x1e, 0x33, 0x0c, 0xd1, 0xde, 0x97, 0x35, 0x09, 0xc0, 0x31, 0x0e, 0x5a, 0x85, 0x11, + 0x47, 0x2a, 0x40, 0x51, 0x7e, 0xb4, 0x2e, 0xa5, 0xf6, 0xe4, 0x01, 0x6c, 0xa4, 0xca, 0x53, 0xd5, + 0x45, 0xaf, 0xc2, 0xb8, 0x08, 0xe0, 0x20, 0xd2, 0x4c, 0xcf, 0x98, 0x5e, 0xb6, 0x35, 0x1d, 0x88, + 0x4d, 0x5c, 0x74, 0x15, 0x46, 0x23, 0xbf, 0xc9, 0x5c, 0x45, 0x29, 0x2b, 0x79, 0x2c, 0x3f, 0xa8, + 0xe6, 0x86, 0x42, 0xd3, 0x45, 0xf3, 0xaa, 0x2a, 0xd6, 0xe9, 0xa0, 0x0d, 0xbe, 0xde, 0x59, 0x46, + 0x0f, 0x12, 0x8a, 0x3c, 0xc5, 0x27, 0xf3, 0xac, 0xfa, 0x18, 0x9a, 0xb9, 0x1d, 0x44, 0x4d, 0xac, + 0x93, 0x41, 0x17, 0x60, 0xba, 0x1d, 0xb8, 0x3e, 0x5b, 0x13, 0x4a, 0xa1, 0x3b, 0x6b, 0xe6, 0xef, + 0xab, 0x26, 0x11, 0x70, 0xba, 0x0e, 0x8b, 0xbf, 0x21, 0x0a, 0x67, 0x8f, 0xf3, 0x1c, 0x44, 0xfc, + 0xb9, 0xce, 0xcb, 0xb0, 0x82, 0xa2, 0x35, 0x76, 0x12, 0x73, 0x49, 0xd3, 0xec, 0x5c, 0x7e, 0x80, + 0x30, 0x5d, 0x22, 0xc5, 0x19, 0x64, 0xf5, 0x17, 0xc7, 0x14, 0x50, 0x43, 0x4b, 0xfd, 0x4b, 0x9f, + 0x19, 0xe1, 0xec, 0x89, 0x2e, 0x66, 0xa5, 0x89, 0x97, 0x5f, 0xcc, 0x10, 0x18, 0xc5, 0x21, 0x4e, + 0xd0, 0x44, 0x1f, 0x85, 0x29, 0x11, 0xed, 0x35, 0x1e, 0xa6, 0x93, 0xb1, 0xeb, 0x0d, 0x4e, 0xc0, + 0x70, 0x0a, 0x9b, 0xe7, 0x00, 0x72, 0x6e, 0x34, 0x89, 0x38, 0xfa, 0x2e, 0xbb, 0xde, 0x4e, 0x38, + 0x7b, 0x8a, 0x9d, 0x0f, 0x22, 0x07, 0x50, 0x12, 0x8a, 0x33, 0x6a, 0xa0, 0x0d, 0x98, 0x6a, 0x07, + 0x84, 0xb4, 0xd8, 0x63, 0x42, 0xdc, 0x67, 0x65, 0x1e, 0x7e, 0x86, 0xf6, 0xa4, 0x9a, 0x80, 0xdd, + 0xcd, 0x28, 0xc3, 0x29, 0x0a, 0xe8, 0x26, 0x8c, 0xf8, 0xbb, 0x24, 0xd8, 0x26, 0x4e, 0x63, 0xf6, + 0x74, 0x17, 0x87, 0x30, 0x71, 0xb9, 0x5d, 0x11, 0xb8, 0x09, 0x7b, 0x19, 0x59, 0xdc, 0xdb, 0x5e, + 0x46, 0x36, 0x86, 0xfe, 0x6f, 0x0b, 0x8e, 0x4b, 0x0d, 0x54, 0xad, 0x4d, 0x47, 0x7d, 0xc9, 0xf7, + 0xc2, 0x28, 0xe0, 0x01, 0x53, 0x1e, 0xc9, 0x0f, 0x22, 0xb2, 0x91, 0x53, 0x49, 0x09, 0xbb, 0x8f, + 0xe7, 0x61, 0x84, 0x38, 0xbf, 0x45, 0xfa, 0xfc, 0x0d, 0x49, 0x24, 0x0f, 0xa3, 0x85, 0x70, 0xf5, + 0xcd, 0xe5, 0xf5, 0xd9, 0x47, 0x79, 0xb4, 0x17, 0xba, 0x19, 0x6a, 0x49, 0x20, 0x4e, 0xe3, 0xa3, + 0xf3, 0x50, 0xf0, 0xc3, 0xd9, 0xc7, 0xba, 0x64, 0x8b, 0xf6, 0x1b, 0x57, 0x6a, 0xdc, 0x6e, 0xf2, + 0x4a, 0x0d, 0x17, 0xfc, 0x50, 0xe6, 0xe1, 0xa1, 0x6f, 0xbe, 0x70, 0xf6, 0x71, 0x2e, 0x1a, 0x95, + 0x79, 0x78, 0x58, 0x21, 0x8e, 0xe1, 0x68, 0x1b, 0x26, 0x43, 0xe3, 0x6d, 0x1d, 0xce, 0x9e, 0x61, + 0x23, 0xf5, 0x78, 0xde, 0xa4, 0x19, 0xd8, 0x5a, 0x82, 0x0c, 0x93, 0x0a, 0x4e, 0x92, 0xe5, 0xbb, + 0x4b, 0x7b, 0xdd, 0x87, 0xb3, 0x4f, 0xf4, 0xd8, 0x5d, 0x1a, 0xb2, 0xbe, 0xbb, 0x74, 0x1a, 0x38, + 0x41, 0x73, 0xee, 0xbb, 0x60, 0x3a, 0xc5, 0x2e, 0x1d, 0xc4, 0x47, 0x60, 0x6e, 0x07, 0xc6, 0x8d, + 0x25, 0xf9, 0x40, 0x4d, 0x48, 0x7e, 0xa7, 0x04, 0x25, 0xa5, 0xda, 0x47, 0xe7, 0x4c, 0xab, 0x91, + 0xe3, 0x49, 0xab, 0x91, 0x91, 0xaa, 0xdf, 0x30, 0x0c, 0x45, 0x36, 0x32, 0xa2, 0x62, 0xe6, 0x1d, + 0x80, 0xfd, 0x3b, 0x32, 0x69, 0xea, 0x8a, 0x62, 0xdf, 0xe6, 0x27, 0x03, 0x5d, 0x35, 0x20, 0x17, + 0x60, 0xda, 0xf3, 0x19, 0x8f, 0x4e, 0x1a, 0x92, 0x01, 0x63, 0x7c, 0x56, 0x49, 0x0f, 0xb2, 0x95, + 0x40, 0xc0, 0xe9, 0x3a, 0xb4, 0x41, 0xce, 0x28, 0x25, 0x55, 0x2e, 0x9c, 0x8f, 0xc2, 0x02, 0x4a, + 0xdf, 0x86, 0xfc, 0x57, 0x38, 0x3b, 0x95, 0xff, 0x36, 0xe4, 0x95, 0x92, 0xcc, 0x58, 0x28, 0x99, + 0x31, 0xa6, 0x61, 0x68, 0xfb, 0x8d, 0x4a, 0x55, 0xb0, 0xf9, 0x5a, 0xbc, 0xea, 0x46, 0xa5, 0x8a, + 0x39, 0x0c, 0x2d, 0xc0, 0x10, 0xfb, 0x11, 0xce, 0x8e, 0xe5, 0x07, 0x65, 0x62, 0x35, 0xb4, 0x3c, + 0x80, 0xac, 0x02, 0x16, 0x15, 0x99, 0x04, 0x99, 0xbe, 0x8d, 0x98, 0x04, 0x79, 0xf8, 0x1e, 0x25, + 0xc8, 0x92, 0x00, 0x8e, 0x69, 0xa1, 0x5b, 0x70, 0xd4, 0x78, 0x8f, 0x2a, 0xcf, 0x2e, 0xc8, 0x57, + 0x2e, 0x27, 0x90, 0x17, 0x4f, 0x8a, 0x4e, 0x1f, 0xad, 0x64, 0x51, 0xc2, 0xd9, 0x0d, 0xa0, 0x26, + 0x4c, 0xd7, 0x53, 0xad, 0x8e, 0xf4, 0xdf, 0xaa, 0x5a, 0x17, 0xe9, 0x16, 0xd3, 0x84, 0xd1, 0xab, + 0x30, 0xf2, 0x8e, 0xcf, 0x0d, 0xc1, 0xc4, 0xd3, 0x44, 0x46, 0x15, 0x19, 0x79, 0xf3, 0x4a, 0x8d, + 0x95, 0xdf, 0xdd, 0x2f, 0x8f, 0x56, 0xfd, 0x86, 0xfc, 0x8b, 0x55, 0x05, 0xf4, 0x83, 0x16, 0xcc, + 0xa5, 0x1f, 0xbc, 0xaa, 0xd3, 0xe3, 0xfd, 0x77, 0xda, 0x16, 0x8d, 0xce, 0xad, 0xe4, 0x92, 0xc3, + 0x5d, 0x9a, 0x42, 0x1f, 0xa6, 0xfb, 0x29, 0x74, 0x6f, 0x13, 0x91, 0x44, 0xf9, 0x91, 0x78, 0x3f, + 0xd1, 0xd2, 0xbb, 0xfb, 0xe5, 0x49, 0x7e, 0x32, 0xba, 0xb7, 0x55, 0x64, 0x6d, 0x5e, 0x01, 0x7d, + 0x0f, 0x1c, 0x0d, 0xd2, 0x52, 0x5a, 0x22, 0x99, 0xf0, 0xa7, 0xfa, 0x39, 0x65, 0x93, 0x13, 0x8e, + 0xb3, 0x08, 0xe2, 0xec, 0x76, 0xec, 0x5f, 0xb5, 0x98, 0x0c, 0x5d, 0x74, 0x8b, 0x84, 0x9d, 0xe6, + 0x61, 0xa4, 0x6e, 0x5f, 0x31, 0xf4, 0xd3, 0xf7, 0x6c, 0x3d, 0xf5, 0x2f, 0x2c, 0x66, 0x3d, 0x75, + 0x88, 0x7e, 0x60, 0x6f, 0xc2, 0x48, 0x24, 0x53, 0xea, 0x77, 0xc9, 0x36, 0xaf, 0x75, 0x8a, 0x59, + 0x90, 0xa9, 0x47, 0x8e, 0xca, 0x9e, 0xaf, 0xc8, 0xd8, 0xff, 0x94, 0xcf, 0x80, 0x84, 0x1c, 0x82, + 0x1a, 0x70, 0xd9, 0x54, 0x03, 0x96, 0x7b, 0x7c, 0x41, 0x8e, 0x3a, 0xf0, 0x9f, 0x98, 0xfd, 0x66, + 0xc2, 0xbd, 0xf7, 0xba, 0xd9, 0x9e, 0xfd, 0x05, 0x0b, 0x20, 0x4e, 0x65, 0xd0, 0x47, 0xd2, 0xd4, + 0x97, 0xe9, 0xb3, 0xc6, 0x8f, 0xfc, 0xba, 0xdf, 0x14, 0x4a, 0x90, 0x13, 0xb1, 0x26, 0x92, 0x97, + 0xdf, 0xd5, 0x7e, 0x63, 0x85, 0x8d, 0xca, 0x32, 0xb6, 0x68, 0x31, 0xd6, 0x8d, 0x1b, 0x71, 0x45, + 0xbf, 0x6c, 0xc1, 0x91, 0x2c, 0xa7, 0x02, 0xfa, 0x48, 0xe6, 0x62, 0x4e, 0x65, 0x52, 0xa9, 0x66, + 0xf3, 0x9a, 0x28, 0xc7, 0x0a, 0xa3, 0xef, 0x6c, 0xb4, 0x07, 0x0b, 0xb3, 0x7f, 0x05, 0xc6, 0xab, + 0x01, 0xd1, 0xf8, 0x8b, 0xd7, 0x79, 0xb4, 0x1e, 0xde, 0x9f, 0x67, 0x0e, 0x1c, 0xa9, 0xc7, 0xfe, + 0x4a, 0x01, 0x8e, 0x70, 0xc3, 0xa0, 0x85, 0x5d, 0xdf, 0x6d, 0x54, 0xfd, 0x86, 0x70, 0x05, 0x7d, + 0x0b, 0xc6, 0xda, 0x9a, 0x6c, 0xba, 0x5b, 0xc8, 0x68, 0x5d, 0x86, 0x1d, 0x4b, 0xd3, 0xf4, 0x52, + 0x6c, 0xd0, 0x42, 0x0d, 0x18, 0x23, 0xbb, 0x6e, 0x5d, 0x59, 0x97, 0x14, 0x0e, 0x7c, 0x49, 0xab, + 0x56, 0x56, 0x34, 0x3a, 0xd8, 0xa0, 0xda, 0xb7, 0x39, 0xaf, 0xc6, 0xa2, 0x0d, 0xf4, 0xb0, 0x28, + 0xf9, 0x31, 0x0b, 0x1e, 0xca, 0x09, 0x30, 0x4d, 0x9b, 0xbb, 0xc9, 0x4c, 0xb0, 0xc4, 0xb2, 0x55, + 0xcd, 0x71, 0xc3, 0x2c, 0x2c, 0xa0, 0xe8, 0x63, 0x00, 0xdc, 0xb0, 0x8a, 0x78, 0xf5, 0x9e, 0x91, + 0x78, 0x8d, 0x10, 0xaa, 0x5a, 0x34, 0x4c, 0x59, 0x1f, 0x6b, 0xb4, 0xec, 0x2f, 0x0f, 0xc0, 0x20, + 0x33, 0xe4, 0x41, 0x55, 0x18, 0xde, 0xe6, 0xb9, 0xd8, 0xba, 0xce, 0x1b, 0xc5, 0x95, 0xe9, 0xdd, + 0xe2, 0x79, 0xd3, 0x4a, 0xb1, 0x24, 0x83, 0xd6, 0x60, 0x86, 0xa7, 0xc4, 0x6b, 0x2e, 0x93, 0xa6, + 0xb3, 0x27, 0xc5, 0xbe, 0x3c, 0xcb, 0xbb, 0x12, 0x7f, 0x57, 0xd2, 0x28, 0x38, 0xab, 0x1e, 0x7a, + 0x1d, 0x26, 0xe8, 0x33, 0xdc, 0xef, 0x44, 0x92, 0x12, 0x4f, 0x86, 0xa7, 0x5e, 0x26, 0x1b, 0x06, + 0x14, 0x27, 0xb0, 0xd1, 0xab, 0x30, 0xde, 0x4e, 0x09, 0xb8, 0x07, 0x63, 0x49, 0x90, 0x29, 0xd4, + 0x36, 0x71, 0x99, 0x5f, 0x41, 0x87, 0x79, 0x51, 0x6c, 0x6c, 0x07, 0x24, 0xdc, 0xf6, 0x9b, 0x0d, + 0xc6, 0x01, 0x0f, 0x6a, 0x7e, 0x05, 0x09, 0x38, 0x4e, 0xd5, 0xa0, 0x54, 0x36, 0x1d, 0xb7, 0xd9, + 0x09, 0x48, 0x4c, 0x65, 0xc8, 0xa4, 0xb2, 0x9a, 0x80, 0xe3, 0x54, 0x8d, 0xde, 0x92, 0xfb, 0xe1, + 0xfb, 0x23, 0xb9, 0xb7, 0x7f, 0xba, 0x00, 0xc6, 0xd4, 0x7e, 0x07, 0x27, 0xe9, 0x7b, 0x0d, 0x06, + 0xb6, 0x82, 0x76, 0x5d, 0x18, 0xad, 0x65, 0x7e, 0x59, 0x9c, 0xa1, 0x9b, 0x7f, 0x19, 0xfd, 0x8f, + 0x59, 0x2d, 0xba, 0xc7, 0x8f, 0x56, 0x03, 0x9f, 0x5e, 0x72, 0x32, 0x9e, 0xa3, 0x72, 0xdf, 0x19, + 0x96, 0x81, 0x28, 0xba, 0x44, 0x3e, 0x16, 0x3e, 0x08, 0x9c, 0x82, 0x61, 0xdf, 0x55, 0x13, 0xe1, + 0x66, 0x24, 0x15, 0x74, 0x1e, 0x46, 0x45, 0xde, 0x34, 0xe6, 0x65, 0xc2, 0x37, 0x13, 0xb3, 0x47, + 0x5b, 0x8e, 0x8b, 0xb1, 0x8e, 0x63, 0xff, 0x50, 0x01, 0x66, 0x32, 0xdc, 0x04, 0xf9, 0x35, 0xb2, + 0xe5, 0x86, 0x91, 0x4a, 0x02, 0xae, 0x5d, 0x23, 0xbc, 0x1c, 0x2b, 0x0c, 0x7a, 0x56, 0xf1, 0x8b, + 0x2a, 0x79, 0x39, 0x09, 0x37, 0x1c, 0x01, 0x3d, 0x60, 0x3a, 0xed, 0xd3, 0x30, 0xd0, 0x09, 0x89, + 0x8c, 0xda, 0xad, 0xae, 0x6d, 0xa6, 0x3a, 0x67, 0x10, 0xfa, 0x04, 0xdc, 0x52, 0x5a, 0x68, 0xed, + 0x09, 0xc8, 0xf5, 0xd0, 0x1c, 0x46, 0x3b, 0x17, 0x11, 0xcf, 0xf1, 0x22, 0xf1, 0x50, 0x8c, 0x83, + 0xef, 0xb2, 0x52, 0x2c, 0xa0, 0xf6, 0x97, 0x8a, 0x70, 0x3c, 0xd7, 0x71, 0x98, 0x76, 0xbd, 0xe5, + 0x7b, 0x6e, 0xe4, 0x2b, 0x43, 0x3f, 0x1e, 0x70, 0x97, 0xb4, 0xb7, 0xd7, 0x44, 0x39, 0x56, 0x18, + 0xe8, 0x0c, 0x0c, 0x32, 0xa1, 0x78, 0x2a, 0x1d, 0xfa, 0xe2, 0x32, 0x8f, 0xc0, 0xc8, 0xc1, 0xda, + 0xad, 0x5e, 0xec, 0x7a, 0xab, 0x3f, 0x4a, 0x39, 0x18, 0xbf, 0x99, 0xbc, 0x50, 0x68, 0x77, 0x7d, + 0xbf, 0x89, 0x19, 0x10, 0x3d, 0x2e, 0xc6, 0x2b, 0x61, 0xd9, 0x86, 0x9d, 0x86, 0x1f, 0x6a, 0x83, + 0xf6, 0x24, 0x0c, 0xef, 0x90, 0xbd, 0xc0, 0xf5, 0xb6, 0x92, 0x16, 0x8f, 0x97, 0x78, 0x31, 0x96, + 0x70, 0x33, 0x33, 0xef, 0xf0, 0xfd, 0xc8, 0xcc, 0xab, 0xaf, 0x80, 0x91, 0x9e, 0xec, 0xc9, 0x0f, + 0x17, 0x61, 0x12, 0x2f, 0x2e, 0xbf, 0x3f, 0x11, 0x57, 0xd3, 0x13, 0x71, 0x3f, 0x12, 0xd8, 0x1e, + 0x6c, 0x36, 0x7e, 0xc9, 0x82, 0x49, 0x96, 0xbd, 0x4d, 0x44, 0xfd, 0x70, 0x7d, 0xef, 0x10, 0x9e, + 0x02, 0x8f, 0xc2, 0x60, 0x40, 0x1b, 0x4d, 0xe6, 0x41, 0x67, 0x3d, 0xc1, 0x1c, 0x86, 0x4e, 0xc0, + 0x00, 0xeb, 0x02, 0x9d, 0xbc, 0x31, 0x7e, 0x04, 0x2f, 0x3b, 0x91, 0x83, 0x59, 0x29, 0x8b, 0x3f, + 0x88, 0x49, 0xbb, 0xe9, 0xf2, 0x4e, 0xc7, 0x26, 0x0b, 0xef, 0x8d, 0x90, 0x22, 0x99, 0x5d, 0x7b, + 0x77, 0xf1, 0x07, 0xb3, 0x49, 0x76, 0x7f, 0x66, 0xff, 0x65, 0x01, 0x4e, 0x65, 0xd6, 0xeb, 0x3b, + 0xfe, 0x60, 0xf7, 0xda, 0x0f, 0x32, 0x11, 0x55, 0xf1, 0x10, 0xed, 0xc9, 0x07, 0xfa, 0xe5, 0xfe, + 0x07, 0xfb, 0x08, 0x0b, 0x98, 0x39, 0x64, 0xef, 0x91, 0xb0, 0x80, 0x99, 0x7d, 0xcb, 0x11, 0x13, + 0xfc, 0x6d, 0x21, 0xe7, 0x5b, 0x98, 0xc0, 0xe0, 0x2c, 0x3d, 0x67, 0x18, 0x30, 0x94, 0x8f, 0x70, + 0x7e, 0xc6, 0xf0, 0x32, 0xac, 0xa0, 0x68, 0x01, 0x26, 0x5b, 0xae, 0x47, 0x0f, 0x9f, 0x3d, 0x93, + 0x15, 0x57, 0xba, 0x8c, 0x35, 0x13, 0x8c, 0x93, 0xf8, 0xc8, 0xd5, 0x42, 0x06, 0xf2, 0xaf, 0x7b, + 0xf5, 0x40, 0xbb, 0x6e, 0xde, 0x34, 0xe7, 0x50, 0xa3, 0x98, 0x11, 0x3e, 0x70, 0x4d, 0x93, 0x13, + 0x15, 0xfb, 0x97, 0x13, 0x8d, 0x65, 0xcb, 0x88, 0xe6, 0x5e, 0x85, 0xf1, 0x7b, 0xd6, 0x8d, 0xd8, + 0xdf, 0x28, 0xc2, 0xc3, 0x5d, 0xb6, 0x3d, 0x3f, 0xeb, 0x8d, 0x39, 0xd0, 0xce, 0xfa, 0xd4, 0x3c, + 0x54, 0xe1, 0xc8, 0x66, 0xa7, 0xd9, 0xdc, 0x63, 0x8e, 0x53, 0xa4, 0x21, 0x31, 0x04, 0x4f, 0x29, + 0x85, 0x23, 0x47, 0x56, 0x33, 0x70, 0x70, 0x66, 0x4d, 0xfa, 0xc4, 0xa2, 0x37, 0xc9, 0x9e, 0x22, + 0x95, 0x78, 0x62, 0x61, 0x1d, 0x88, 0x4d, 0x5c, 0x74, 0x01, 0xa6, 0x9d, 0x5d, 0xc7, 0xe5, 0x79, + 0x17, 0x24, 0x01, 0xfe, 0xc6, 0x52, 0xb2, 0xe8, 0x85, 0x24, 0x02, 0x4e, 0xd7, 0x41, 0x6f, 0x00, + 0xf2, 0x6f, 0x30, 0x67, 0x8c, 0xc6, 0x05, 0xe2, 0x09, 0xad, 0x3b, 0x9b, 0xbb, 0x62, 0x7c, 0x24, + 0x5c, 0x49, 0x61, 0xe0, 0x8c, 0x5a, 0x89, 0xe0, 0x75, 0x43, 0xf9, 0xc1, 0xeb, 0xba, 0x9f, 0x8b, + 0x3d, 0x73, 0xa0, 0x9d, 0x87, 0xf1, 0x03, 0x9a, 0x18, 0xdb, 0xff, 0xc1, 0x02, 0x25, 0x20, 0x36, + 0x83, 0x4f, 0xbf, 0xca, 0x6c, 0xa0, 0xb9, 0x68, 0x5b, 0x8b, 0x37, 0x75, 0x54, 0xb3, 0x81, 0x8e, + 0x81, 0xd8, 0xc4, 0xe5, 0x6b, 0x48, 0xb3, 0x5d, 0x36, 0x5e, 0x05, 0x22, 0x36, 0xa6, 0xc2, 0x40, + 0x1f, 0x87, 0xe1, 0x86, 0xbb, 0xeb, 0x86, 0x42, 0x38, 0x76, 0x60, 0x65, 0x5c, 0x7c, 0x74, 0x2e, + 0x73, 0x32, 0x58, 0xd2, 0xb3, 0x7f, 0xb8, 0x10, 0x8f, 0xc9, 0x9b, 0x1d, 0x3f, 0x72, 0x0e, 0xe1, + 0x26, 0xbf, 0x60, 0xdc, 0xe4, 0x8f, 0x67, 0x4f, 0xb4, 0xd6, 0xa5, 0xdc, 0x1b, 0xfc, 0x4a, 0xe2, + 0x06, 0x7f, 0xa2, 0x37, 0xa9, 0xee, 0x37, 0xf7, 0x3f, 0xb3, 0x60, 0xda, 0xc0, 0x3f, 0x84, 0x0b, + 0x64, 0xd5, 0xbc, 0x40, 0x1e, 0xe9, 0xf9, 0x0d, 0x39, 0x17, 0xc7, 0x0f, 0x14, 0x13, 0x7d, 0x67, + 0x17, 0xc6, 0x3b, 0x30, 0xb0, 0xed, 0x04, 0x0d, 0xf1, 0x2e, 0x3e, 0xd7, 0xd7, 0x58, 0xcf, 0x5f, + 0x74, 0x02, 0x61, 0xa9, 0xf0, 0x8c, 0x1c, 0x75, 0x5a, 0xd4, 0xd3, 0x4a, 0x81, 0x35, 0x85, 0x5e, + 0x86, 0xa1, 0xb0, 0xee, 0xb7, 0x95, 0x5f, 0x16, 0x4b, 0xac, 0x5b, 0x63, 0x25, 0x77, 0xf7, 0xcb, + 0xc8, 0x6c, 0x8e, 0x16, 0x63, 0x81, 0x8f, 0xde, 0x82, 0x71, 0xf6, 0x4b, 0x99, 0x0d, 0x16, 0xf3, + 0x25, 0x18, 0x35, 0x1d, 0x91, 0xdb, 0xd4, 0x1a, 0x45, 0xd8, 0x24, 0x35, 0xb7, 0x05, 0x25, 0xf5, + 0x59, 0x0f, 0x54, 0xdb, 0xfd, 0xef, 0x8a, 0x30, 0x93, 0xb1, 0xe6, 0x50, 0x68, 0xcc, 0xc4, 0xf9, + 0x3e, 0x97, 0xea, 0xbb, 0x9c, 0x8b, 0x90, 0x3d, 0xa0, 0x1a, 0x62, 0x6d, 0xf5, 0xdd, 0xe8, 0xd5, + 0x90, 0x24, 0x1b, 0xa5, 0x45, 0xbd, 0x1b, 0xa5, 0x8d, 0x1d, 0xda, 0x50, 0xd3, 0x86, 0x54, 0x4f, + 0x1f, 0xe8, 0x9c, 0xfe, 0xc6, 0x00, 0x1c, 0xc9, 0x8a, 0x59, 0x8c, 0x3e, 0x9b, 0xc8, 0xd6, 0xfd, + 0x42, 0xb7, 0x11, 0xd6, 0x6b, 0xf2, 0x14, 0xde, 0x22, 0x54, 0xe8, 0xbc, 0x99, 0xbf, 0xbb, 0xe7, + 0x30, 0x8b, 0x36, 0x59, 0x08, 0x9f, 0x80, 0x67, 0x59, 0x97, 0xc7, 0xc7, 0x87, 0xfa, 0xee, 0x80, + 0x48, 0xcf, 0x1e, 0x26, 0x4c, 0x92, 0x64, 0x71, 0x6f, 0x93, 0x24, 0xd9, 0x32, 0xaa, 0xc0, 0x50, + 0x9d, 0xdb, 0xba, 0x14, 0x7b, 0x1f, 0x61, 0xdc, 0xd0, 0x45, 0x1d, 0xc0, 0xc2, 0xc0, 0x45, 0x10, + 0x98, 0x73, 0x61, 0x54, 0x1b, 0x98, 0x07, 0xba, 0x78, 0x76, 0xe8, 0xc5, 0xa7, 0x0d, 0xc1, 0x03, + 0x5d, 0x40, 0x3f, 0x66, 0x41, 0xc2, 0xa9, 0x46, 0x09, 0xe5, 0xac, 0x5c, 0xa1, 0xdc, 0x69, 0x18, + 0x08, 0xfc, 0x26, 0x49, 0xa6, 0x82, 0xc6, 0x7e, 0x93, 0x60, 0x06, 0xa1, 0x18, 0x51, 0x2c, 0x6a, + 0x19, 0xd3, 0x9f, 0x91, 0xe2, 0x81, 0xf8, 0x28, 0x0c, 0x36, 0xc9, 0x2e, 0x69, 0x26, 0x33, 0xf6, + 0x5d, 0xa6, 0x85, 0x98, 0xc3, 0xec, 0x5f, 0x1a, 0x80, 0x93, 0x5d, 0xe3, 0x69, 0xd1, 0xc7, 0xd8, + 0x96, 0x13, 0x91, 0x9b, 0xce, 0x5e, 0x32, 0xb1, 0xd8, 0x05, 0x5e, 0x8c, 0x25, 0x9c, 0xb9, 0x98, + 0xf2, 0xfc, 0x20, 0x09, 0x11, 0xa6, 0x48, 0x0b, 0x22, 0xa0, 0xa6, 0x48, 0xac, 0x78, 0x3f, 0x44, + 0x62, 0xcf, 0x01, 0x84, 0x61, 0x93, 0x9b, 0x05, 0x36, 0x84, 0xef, 0x6a, 0x9c, 0x47, 0xa6, 0x76, + 0x59, 0x40, 0xb0, 0x86, 0x85, 0x96, 0x61, 0xaa, 0x1d, 0xf8, 0x11, 0x97, 0x08, 0x2f, 0x73, 0xcb, + 0xd9, 0x41, 0x33, 0x94, 0x51, 0x35, 0x01, 0xc7, 0xa9, 0x1a, 0xe8, 0x45, 0x18, 0x15, 0xe1, 0x8d, + 0xaa, 0xbe, 0xdf, 0x14, 0x42, 0x28, 0x65, 0x4c, 0x5a, 0x8b, 0x41, 0x58, 0xc7, 0xd3, 0xaa, 0x31, + 0x31, 0xf3, 0x70, 0x66, 0x35, 0x2e, 0x6a, 0xd6, 0xf0, 0x12, 0xa1, 0xd0, 0x47, 0xfa, 0x0a, 0x85, + 0x1e, 0x8b, 0xe5, 0x4a, 0x7d, 0x6b, 0x3d, 0xa1, 0xa7, 0x20, 0xeb, 0xab, 0x03, 0x30, 0x23, 0x16, + 0xce, 0x83, 0x5e, 0x2e, 0x57, 0xd3, 0xcb, 0xe5, 0x7e, 0x08, 0xee, 0xde, 0x5f, 0x33, 0x87, 0xbd, + 0x66, 0x7e, 0xc4, 0x02, 0x93, 0x53, 0x43, 0xff, 0x67, 0x6e, 0x66, 0xc6, 0x17, 0x73, 0x39, 0xbf, + 0x38, 0x4e, 0xf2, 0xbb, 0xcb, 0xd1, 0x68, 0xff, 0xa1, 0x05, 0x8f, 0xf4, 0xa4, 0x88, 0x56, 0xa0, + 0xc4, 0xd8, 0x49, 0xed, 0xa1, 0xf7, 0x84, 0xb2, 0xac, 0x97, 0x80, 0x1c, 0xee, 0x36, 0xae, 0x89, + 0x56, 0x52, 0x29, 0x30, 0x9f, 0xcc, 0x48, 0x81, 0x79, 0xd4, 0x18, 0x9e, 0x7b, 0xcc, 0x81, 0xf9, + 0x45, 0x7a, 0xe3, 0x98, 0x9e, 0x73, 0x1f, 0x32, 0x84, 0x8e, 0x76, 0x42, 0xe8, 0x88, 0x4c, 0x6c, + 0xed, 0x0e, 0xf9, 0x28, 0x4c, 0xb1, 0xb8, 0x87, 0xcc, 0xcf, 0x43, 0xb8, 0xdc, 0x15, 0x62, 0x5b, + 0xee, 0xcb, 0x09, 0x18, 0x4e, 0x61, 0xdb, 0x7f, 0x5e, 0x84, 0x21, 0xbe, 0xfd, 0x0e, 0xe1, 0x79, + 0xf9, 0x34, 0x94, 0xdc, 0x56, 0xab, 0xc3, 0xb3, 0x1a, 0x0e, 0xc6, 0x96, 0xc1, 0x15, 0x59, 0x88, + 0x63, 0x38, 0x5a, 0x15, 0xf2, 0xee, 0x2e, 0xa1, 0x95, 0x79, 0xc7, 0xe7, 0x97, 0x9d, 0xc8, 0xe1, + 0xbc, 0x92, 0xba, 0x67, 0x63, 0xc9, 0x38, 0xfa, 0x14, 0x40, 0x18, 0x05, 0xae, 0xb7, 0x45, 0xcb, + 0x44, 0xfc, 0xfd, 0xa7, 0xba, 0x50, 0xab, 0x29, 0x64, 0x4e, 0x33, 0x3e, 0x73, 0x14, 0x00, 0x6b, + 0x14, 0xd1, 0xbc, 0x71, 0xd3, 0xcf, 0x25, 0xe6, 0x0e, 0x38, 0xd5, 0x78, 0xce, 0xe6, 0x5e, 0x82, + 0x92, 0x22, 0xde, 0x4b, 0xfa, 0x35, 0xa6, 0xb3, 0x45, 0x1f, 0x81, 0xc9, 0x44, 0xdf, 0x0e, 0x24, + 0x3c, 0xfb, 0x65, 0x0b, 0x26, 0x79, 0x67, 0x56, 0xbc, 0x5d, 0x71, 0x1b, 0xdc, 0x86, 0x23, 0xcd, + 0x8c, 0x53, 0x59, 0x4c, 0x7f, 0xff, 0xa7, 0xb8, 0x12, 0x96, 0x65, 0x41, 0x71, 0x66, 0x1b, 0xe8, + 0x2c, 0xdd, 0x71, 0xf4, 0xd4, 0x75, 0x9a, 0x22, 0x86, 0xc2, 0x18, 0xdf, 0x6d, 0xbc, 0x0c, 0x2b, + 0xa8, 0xfd, 0xc7, 0x16, 0x4c, 0xf3, 0x9e, 0x5f, 0x22, 0x7b, 0xea, 0x6c, 0xfa, 0x56, 0xf6, 0x5d, + 0xe4, 0xd3, 0x2d, 0xe4, 0xe4, 0xd3, 0xd5, 0x3f, 0xad, 0xd8, 0xf5, 0xd3, 0xbe, 0x62, 0x81, 0x58, + 0x21, 0x87, 0x20, 0xcf, 0xf8, 0x2e, 0x53, 0x9e, 0x31, 0x97, 0xbf, 0x09, 0x72, 0x04, 0x19, 0x7f, + 0x63, 0xc1, 0x14, 0x47, 0x88, 0x75, 0xf5, 0xdf, 0xd2, 0x79, 0x58, 0x34, 0xbf, 0x28, 0xd3, 0xf8, + 0xf2, 0x12, 0xd9, 0xdb, 0xf0, 0xab, 0x4e, 0xb4, 0x9d, 0xfd, 0x51, 0xc6, 0x64, 0x0d, 0x74, 0x9d, + 0xac, 0x86, 0xdc, 0x40, 0x46, 0xba, 0xb9, 0x1e, 0x41, 0x08, 0x0e, 0x9a, 0x6e, 0xce, 0xfe, 0x0b, + 0x0b, 0x10, 0x6f, 0xc6, 0x60, 0xdc, 0x28, 0x3b, 0xc4, 0x4a, 0xb5, 0x8b, 0x2e, 0x3e, 0x9a, 0x14, + 0x04, 0x6b, 0x58, 0xf7, 0x65, 0x78, 0x12, 0x06, 0x17, 0xc5, 0xde, 0x06, 0x17, 0x07, 0x18, 0xd1, + 0xaf, 0x0c, 0x43, 0xd2, 0xb3, 0x0f, 0x5d, 0x83, 0xb1, 0xba, 0xd3, 0x76, 0x6e, 0xb8, 0x4d, 0x37, + 0x72, 0x49, 0xd8, 0xcd, 0x1a, 0x6b, 0x49, 0xc3, 0x13, 0x2a, 0x72, 0xad, 0x04, 0x1b, 0x74, 0xd0, + 0x3c, 0x40, 0x3b, 0x70, 0x77, 0xdd, 0x26, 0xd9, 0x62, 0x62, 0x17, 0x16, 0xb5, 0x85, 0x9b, 0x86, + 0xc9, 0x52, 0xac, 0x61, 0x64, 0x84, 0x6a, 0x28, 0x3e, 0xe0, 0x50, 0x0d, 0x70, 0x68, 0xa1, 0x1a, + 0x06, 0x0e, 0x14, 0xaa, 0x61, 0xe4, 0xc0, 0xa1, 0x1a, 0x06, 0xfb, 0x0a, 0xd5, 0x80, 0xe1, 0x98, + 0xe4, 0x3d, 0xe9, 0xff, 0x55, 0xb7, 0x49, 0xc4, 0x83, 0x83, 0x87, 0x9a, 0x99, 0xbb, 0xb3, 0x5f, + 0x3e, 0x86, 0x33, 0x31, 0x70, 0x4e, 0x4d, 0xf4, 0x31, 0x98, 0x75, 0x9a, 0x4d, 0xff, 0xa6, 0x9a, + 0xd4, 0x95, 0xb0, 0xee, 0x34, 0xb9, 0x0a, 0x64, 0x98, 0x51, 0x3d, 0x71, 0x67, 0xbf, 0x3c, 0xbb, + 0x90, 0x83, 0x83, 0x73, 0x6b, 0xa3, 0xd7, 0xa0, 0xd4, 0x0e, 0xfc, 0xfa, 0x9a, 0xe6, 0x7e, 0x7c, + 0x8a, 0x0e, 0x60, 0x55, 0x16, 0xde, 0xdd, 0x2f, 0x8f, 0xab, 0x3f, 0xec, 0xc2, 0x8f, 0x2b, 0x64, + 0xc4, 0x5e, 0x18, 0x7d, 0xd0, 0xb1, 0x17, 0xc6, 0xee, 0x77, 0xec, 0x85, 0x1d, 0x98, 0xa9, 0x91, + 0xc0, 0x75, 0x9a, 0xee, 0x6d, 0xca, 0x93, 0xcb, 0x33, 0x70, 0x03, 0x4a, 0x41, 0xe2, 0xd4, 0xef, + 0x2b, 0xa4, 0xb2, 0x96, 0x55, 0x4c, 0x9e, 0xf2, 0x31, 0x21, 0xfb, 0x7f, 0x58, 0x30, 0x2c, 0xbc, + 0x05, 0x0f, 0x81, 0x33, 0x5d, 0x30, 0x14, 0x1f, 0xe5, 0xec, 0x49, 0x61, 0x9d, 0xc9, 0x55, 0x79, + 0x54, 0x12, 0x2a, 0x8f, 0x47, 0xba, 0x11, 0xe9, 0xae, 0xec, 0xf8, 0x3b, 0x45, 0xfa, 0x42, 0x30, + 0xfc, 0xd6, 0x1f, 0xfc, 0x10, 0xac, 0xc3, 0x70, 0x28, 0xfc, 0xa6, 0x0b, 0xf9, 0x1e, 0x27, 0xc9, + 0x49, 0x8c, 0x2d, 0xf5, 0x84, 0xa7, 0xb4, 0x24, 0x92, 0xe9, 0x90, 0x5d, 0x7c, 0x80, 0x0e, 0xd9, + 0xbd, 0x3c, 0xfb, 0x07, 0xee, 0x87, 0x67, 0xbf, 0xfd, 0x75, 0x76, 0x3b, 0xeb, 0xe5, 0x87, 0xc0, + 0xb8, 0x5d, 0x30, 0xef, 0x71, 0xbb, 0xcb, 0xca, 0x12, 0x9d, 0xca, 0x61, 0xe0, 0x7e, 0xd1, 0x82, + 0x93, 0x19, 0x5f, 0xa5, 0x71, 0x73, 0xcf, 0xc0, 0x88, 0xd3, 0x69, 0xb8, 0x6a, 0x2f, 0x6b, 0xea, + 0xcf, 0x05, 0x51, 0x8e, 0x15, 0x06, 0x5a, 0x82, 0x69, 0x72, 0xab, 0xed, 0x72, 0x65, 0xb1, 0x6e, + 0xe0, 0x5c, 0xe4, 0x2e, 0xa6, 0x2b, 0x49, 0x20, 0x4e, 0xe3, 0xab, 0x40, 0x57, 0xc5, 0xdc, 0x40, + 0x57, 0x3f, 0x6f, 0xc1, 0xa8, 0xf2, 0x1c, 0x7e, 0xe0, 0xa3, 0xfd, 0x51, 0x73, 0xb4, 0x1f, 0xee, + 0x32, 0xda, 0x39, 0xc3, 0xfc, 0x07, 0x05, 0xd5, 0xdf, 0xaa, 0x1f, 0x44, 0x7d, 0x70, 0x89, 0xf7, + 0xee, 0x9c, 0x71, 0x1e, 0x46, 0x9d, 0x76, 0x5b, 0x02, 0xa4, 0x95, 0x1d, 0x0b, 0x90, 0x1f, 0x17, + 0x63, 0x1d, 0x47, 0xf9, 0x8a, 0x14, 0x73, 0x7d, 0x45, 0x1a, 0x00, 0x91, 0x13, 0x6c, 0x91, 0x88, + 0x96, 0x09, 0xa3, 0xe0, 0xfc, 0xf3, 0xa6, 0x13, 0xb9, 0xcd, 0x79, 0xd7, 0x8b, 0xc2, 0x28, 0x98, + 0xaf, 0x78, 0xd1, 0x95, 0x80, 0x3f, 0x53, 0xb5, 0x50, 0x71, 0x8a, 0x16, 0xd6, 0xe8, 0xca, 0x28, + 0x19, 0xac, 0x8d, 0x41, 0xd3, 0x5c, 0x63, 0x5d, 0x94, 0x63, 0x85, 0x61, 0xbf, 0xc4, 0x6e, 0x1f, + 0x36, 0xa6, 0x07, 0x0b, 0x93, 0xf6, 0x97, 0x63, 0x6a, 0x36, 0x98, 0xe2, 0x75, 0x59, 0x0f, 0xc6, + 0xd6, 0xfd, 0xb0, 0xa7, 0x0d, 0xeb, 0x5e, 0x97, 0x71, 0xc4, 0x36, 0xf4, 0x89, 0x94, 0x09, 0xce, + 0xb3, 0x3d, 0x6e, 0x8d, 0x03, 0x18, 0xdd, 0xb0, 0x6c, 0x59, 0x2c, 0x97, 0x50, 0xa5, 0x2a, 0xf6, + 0x85, 0x96, 0x2d, 0x4b, 0x00, 0x70, 0x8c, 0x43, 0x19, 0x36, 0xf5, 0x27, 0x9c, 0x45, 0x71, 0x50, + 0x65, 0x85, 0x1d, 0x62, 0x0d, 0x03, 0x9d, 0x13, 0x42, 0x0b, 0xae, 0x7b, 0x78, 0x38, 0x21, 0xb4, + 0x90, 0xc3, 0xa5, 0x49, 0x9a, 0xce, 0xc3, 0x28, 0xb9, 0x15, 0x91, 0xc0, 0x73, 0x9a, 0xb4, 0x85, + 0xc1, 0x38, 0x0e, 0xe8, 0x4a, 0x5c, 0x8c, 0x75, 0x1c, 0xb4, 0x01, 0x93, 0x21, 0x97, 0xe5, 0xa9, + 0x50, 0xfe, 0x5c, 0x26, 0xfa, 0x94, 0xf2, 0xd9, 0x36, 0xc1, 0x77, 0x59, 0x11, 0x3f, 0x9d, 0x64, + 0x24, 0x8b, 0x24, 0x09, 0xf4, 0x3a, 0x4c, 0x34, 0x7d, 0xa7, 0xb1, 0xe8, 0x34, 0x1d, 0xaf, 0xce, + 0xc6, 0x67, 0xc4, 0xcc, 0xb9, 0x7e, 0xd9, 0x80, 0xe2, 0x04, 0x36, 0x65, 0x10, 0xf5, 0x12, 0x11, + 0x6e, 0xce, 0xf1, 0xb6, 0x48, 0x38, 0x5b, 0x62, 0x5f, 0xc5, 0x18, 0xc4, 0xcb, 0x39, 0x38, 0x38, + 0xb7, 0x36, 0x7a, 0x19, 0xc6, 0xe4, 0xe7, 0x6b, 0x81, 0x5f, 0x62, 0xb7, 0x1b, 0x0d, 0x86, 0x0d, + 0x4c, 0x14, 0xc2, 0x51, 0xf9, 0x7f, 0x23, 0x70, 0x36, 0x37, 0xdd, 0xba, 0x88, 0x86, 0xc0, 0x5d, + 0x94, 0x3f, 0x22, 0xfd, 0x21, 0x57, 0xb2, 0x90, 0xee, 0xee, 0x97, 0x4f, 0x88, 0x51, 0xcb, 0x84, + 0xe3, 0x6c, 0xda, 0x68, 0x0d, 0x66, 0xb6, 0x89, 0xd3, 0x8c, 0xb6, 0x97, 0xb6, 0x49, 0x7d, 0x47, + 0x6e, 0x38, 0xc6, 0x35, 0x6a, 0xee, 0x29, 0x17, 0xd3, 0x28, 0x38, 0xab, 0x1e, 0x7a, 0x1b, 0x66, + 0xdb, 0x9d, 0x1b, 0x4d, 0x37, 0xdc, 0x5e, 0xf7, 0x23, 0x66, 0xe8, 0xb4, 0xd0, 0x68, 0x04, 0x24, + 0xe4, 0x1e, 0xac, 0xec, 0xea, 0x95, 0xc1, 0x7a, 0xaa, 0x39, 0x78, 0x38, 0x97, 0x02, 0xba, 0x0d, + 0x47, 0x13, 0x0b, 0x41, 0x44, 0xdd, 0x98, 0xc8, 0x4f, 0xe4, 0x53, 0xcb, 0xaa, 0x20, 0x02, 0xd8, + 0x64, 0x81, 0x70, 0x76, 0x13, 0xe8, 0x15, 0x00, 0xb7, 0xbd, 0xea, 0xb4, 0xdc, 0x26, 0x7d, 0x8e, + 0xce, 0xb0, 0x35, 0x42, 0x9f, 0x26, 0x50, 0xa9, 0xca, 0x52, 0x7a, 0x36, 0x8b, 0x7f, 0x7b, 0x58, + 0xc3, 0x46, 0x97, 0x61, 0x42, 0xfc, 0xdb, 0x13, 0x53, 0x3a, 0xad, 0x72, 0x3e, 0x4e, 0xc8, 0x1a, + 0x6a, 0x1e, 0x13, 0x25, 0x38, 0x51, 0x17, 0x6d, 0xc1, 0x49, 0x99, 0x70, 0x52, 0x5f, 0x9f, 0x72, + 0x0e, 0x42, 0x96, 0x3d, 0x67, 0x84, 0x7b, 0xbe, 0x2c, 0x74, 0x43, 0xc4, 0xdd, 0xe9, 0xd0, 0x7b, + 0x5d, 0x5f, 0xe6, 0xdc, 0xaf, 0xf9, 0x68, 0x1c, 0x39, 0xf1, 0x72, 0x12, 0x88, 0xd3, 0xf8, 0xc8, + 0x87, 0xa3, 0xae, 0x97, 0xb5, 0xaa, 0x8f, 0x31, 0x42, 0x1f, 0xe6, 0x2e, 0xdd, 0xdd, 0x57, 0x74, + 0x26, 0x1c, 0x67, 0xd3, 0x45, 0x15, 0x98, 0x89, 0x78, 0xc1, 0xb2, 0x1b, 0xf2, 0xe4, 0x1c, 0xf4, + 0xd9, 0xf7, 0x10, 0x4f, 0x89, 0x4f, 0x57, 0xf3, 0x46, 0x1a, 0x8c, 0xb3, 0xea, 0xbc, 0x3b, 0x33, + 0xc5, 0x3f, 0xb2, 0x68, 0x6d, 0x8d, 0xd1, 0x47, 0x9f, 0x86, 0x31, 0x7d, 0x7c, 0x04, 0xd3, 0x72, + 0x26, 0x9b, 0x0f, 0xd6, 0x8e, 0x17, 0xfe, 0x4c, 0x50, 0x47, 0x88, 0x0e, 0xc3, 0x06, 0x45, 0x54, + 0xcf, 0x08, 0xc5, 0x70, 0xae, 0x3f, 0xa6, 0xa8, 0x7f, 0x2b, 0x3d, 0x02, 0xd9, 0x3b, 0x07, 0x5d, + 0x86, 0x91, 0x7a, 0xd3, 0x25, 0x5e, 0x54, 0xa9, 0x76, 0x0b, 0x68, 0xb9, 0x24, 0x70, 0xc4, 0x56, + 0x14, 0x39, 0x75, 0x78, 0x19, 0x56, 0x14, 0xec, 0x97, 0x61, 0xb4, 0xd6, 0x24, 0xa4, 0xcd, 0xbd, + 0x8d, 0xd0, 0x93, 0xec, 0x61, 0xc2, 0x58, 0x4b, 0x8b, 0xb1, 0x96, 0xfa, 0x9b, 0x83, 0x31, 0x95, + 0x12, 0x6e, 0xff, 0x56, 0x01, 0xca, 0x3d, 0x52, 0x3b, 0x25, 0xf4, 0x6d, 0x56, 0x5f, 0xfa, 0xb6, + 0x05, 0x98, 0x8c, 0xff, 0xe9, 0xa2, 0x3c, 0x65, 0xb2, 0x7b, 0xcd, 0x04, 0xe3, 0x24, 0x7e, 0xdf, + 0xde, 0x17, 0xba, 0xca, 0x6e, 0xa0, 0xa7, 0xff, 0x90, 0xa1, 0xaa, 0x1f, 0xec, 0xff, 0xed, 0x9d, + 0xab, 0x76, 0xb5, 0xbf, 0x5e, 0x80, 0xa3, 0x6a, 0x08, 0xbf, 0x73, 0x07, 0xee, 0x6a, 0x7a, 0xe0, + 0xee, 0x83, 0xd2, 0xda, 0xbe, 0x02, 0x43, 0x3c, 0xb6, 0x67, 0x1f, 0x3c, 0xff, 0xa3, 0x66, 0xc8, + 0x71, 0xc5, 0x66, 0x1a, 0x61, 0xc7, 0x7f, 0xd0, 0x82, 0xc9, 0x84, 0x1b, 0x1f, 0xc2, 0x9a, 0xaf, + 0xf7, 0xbd, 0xf0, 0xe5, 0x59, 0x1c, 0xff, 0x69, 0x18, 0xd8, 0xf6, 0xc3, 0x28, 0x69, 0xd1, 0x72, + 0xd1, 0x0f, 0x23, 0xcc, 0x20, 0xf6, 0x9f, 0x58, 0x30, 0xb8, 0xe1, 0xb8, 0x5e, 0x24, 0xb5, 0x1f, + 0x56, 0x8e, 0xf6, 0xa3, 0x9f, 0xef, 0x42, 0x2f, 0xc2, 0x10, 0xd9, 0xdc, 0x24, 0xf5, 0x48, 0xcc, + 0xaa, 0x8c, 0xf9, 0x30, 0xb4, 0xc2, 0x4a, 0x29, 0x13, 0xca, 0x1a, 0xe3, 0x7f, 0xb1, 0x40, 0x46, + 0xd7, 0xa1, 0x14, 0xb9, 0x2d, 0xb2, 0xd0, 0x68, 0x08, 0x9b, 0x80, 0x7b, 0x08, 0x54, 0xb2, 0x21, + 0x09, 0xe0, 0x98, 0x96, 0xfd, 0xa5, 0x02, 0x40, 0x1c, 0xb0, 0xac, 0xd7, 0x27, 0x2e, 0xa6, 0xb4, + 0xc5, 0x67, 0x32, 0xb4, 0xc5, 0x28, 0x26, 0x98, 0xa1, 0x2a, 0x56, 0xc3, 0x54, 0xec, 0x6b, 0x98, + 0x06, 0x0e, 0x32, 0x4c, 0x4b, 0x30, 0x1d, 0x07, 0x5c, 0x33, 0xe3, 0x4d, 0xb2, 0xfb, 0x7b, 0x23, + 0x09, 0xc4, 0x69, 0x7c, 0x9b, 0xc0, 0x69, 0x15, 0x77, 0x4a, 0xdc, 0x85, 0xcc, 0xe0, 0x5d, 0xd7, + 0xbe, 0xf7, 0x18, 0xa7, 0x58, 0x1d, 0x5e, 0xc8, 0x55, 0x87, 0xff, 0xa4, 0x05, 0x47, 0x92, 0xed, + 0x30, 0xef, 0xf0, 0x2f, 0x58, 0x70, 0x34, 0xce, 0x6c, 0x92, 0x36, 0x41, 0x78, 0xa1, 0x6b, 0x2c, + 0xad, 0x9c, 0x1e, 0xc7, 0xc1, 0x45, 0xd6, 0xb2, 0x48, 0xe3, 0xec, 0x16, 0xed, 0xff, 0x3e, 0x00, + 0xb3, 0x79, 0x41, 0xb8, 0x98, 0x3f, 0x8c, 0x73, 0xab, 0xb6, 0x43, 0x6e, 0x0a, 0xaf, 0x83, 0xd8, + 0x1f, 0x86, 0x17, 0x63, 0x09, 0x4f, 0x26, 0xb3, 0x29, 0xf4, 0x99, 0xcc, 0x66, 0x1b, 0xa6, 0x6f, + 0x6e, 0x13, 0xef, 0xaa, 0x17, 0x3a, 0x91, 0x1b, 0x6e, 0xba, 0x4c, 0x81, 0xce, 0xd7, 0x8d, 0x4c, + 0xc8, 0x3e, 0x7d, 0x3d, 0x89, 0x70, 0x77, 0xbf, 0x7c, 0xd2, 0x28, 0x88, 0xbb, 0xcc, 0x0f, 0x12, + 0x9c, 0x26, 0x9a, 0xce, 0x05, 0x34, 0xf0, 0x80, 0x73, 0x01, 0xb5, 0x5c, 0x61, 0x76, 0x23, 0x9d, + 0x1d, 0xd8, 0xb3, 0x75, 0x4d, 0x95, 0x62, 0x0d, 0x03, 0x7d, 0x12, 0x90, 0x9e, 0xcc, 0xcd, 0x88, + 0x81, 0xfa, 0xec, 0x9d, 0xfd, 0x32, 0x5a, 0x4f, 0x41, 0xef, 0xee, 0x97, 0x67, 0x68, 0x69, 0xc5, + 0xa3, 0xcf, 0xdf, 0x38, 0x70, 0x5c, 0x06, 0x21, 0x74, 0x1d, 0xa6, 0x68, 0x29, 0xdb, 0x51, 0x32, + 0xc0, 0x2a, 0x7f, 0xb2, 0x3e, 0x7d, 0x67, 0xbf, 0x3c, 0xb5, 0x9e, 0x80, 0xe5, 0x91, 0x4e, 0x11, + 0xc9, 0x48, 0x09, 0x34, 0xd2, 0x6f, 0x4a, 0x20, 0xfb, 0x0b, 0x16, 0x1c, 0xa7, 0x17, 0x5c, 0xe3, + 0x72, 0x8e, 0x16, 0xdd, 0x69, 0xbb, 0x5c, 0x4f, 0x23, 0xae, 0x1a, 0x26, 0xab, 0xab, 0x56, 0xb8, + 0x96, 0x46, 0x41, 0xe9, 0x09, 0xbf, 0xe3, 0x7a, 0x8d, 0xe4, 0x09, 0x7f, 0xc9, 0xf5, 0x1a, 0x98, + 0x41, 0xd4, 0x95, 0x55, 0xcc, 0xf5, 0xb9, 0xf8, 0x2a, 0xdd, 0xab, 0xb4, 0x2f, 0xdf, 0xd2, 0x6e, + 0xa0, 0xa7, 0x75, 0x9d, 0xaa, 0x30, 0x9f, 0xcc, 0xd5, 0xa7, 0x7e, 0xde, 0x02, 0xe1, 0xa3, 0xdd, + 0xc7, 0x9d, 0xfc, 0x16, 0x8c, 0xed, 0xa6, 0x13, 0x5d, 0x9e, 0xce, 0x77, 0x5a, 0x17, 0xe1, 0xeb, + 0x15, 0x8b, 0x6e, 0x24, 0xb5, 0x34, 0x68, 0xd9, 0x0d, 0x10, 0xd0, 0x65, 0xc2, 0xb4, 0x1a, 0xbd, + 0x7b, 0xf3, 0x1c, 0x40, 0x83, 0xe1, 0xb2, 0xec, 0xd7, 0x05, 0x93, 0xe3, 0x5a, 0x56, 0x10, 0xac, + 0x61, 0xd9, 0xbf, 0x5b, 0x80, 0x51, 0x99, 0x58, 0xb1, 0xe3, 0xf5, 0x23, 0x7b, 0x3c, 0x50, 0xa6, + 0x75, 0x74, 0x0e, 0x4a, 0x4c, 0x38, 0x5e, 0x8d, 0x45, 0xb6, 0x4a, 0x34, 0xb5, 0x26, 0x01, 0x38, + 0xc6, 0x61, 0xec, 0x7b, 0xe7, 0x06, 0x43, 0x4f, 0x78, 0x14, 0xd7, 0x78, 0x31, 0x96, 0x70, 0xf4, + 0x31, 0x98, 0xe2, 0xf5, 0x02, 0xbf, 0xed, 0x6c, 0x71, 0xa5, 0xdd, 0xa0, 0x0a, 0xd3, 0x32, 0xb5, + 0x96, 0x80, 0xdd, 0xdd, 0x2f, 0x1f, 0x49, 0x96, 0x31, 0x6d, 0x74, 0x8a, 0x0a, 0xb3, 0xcd, 0xe3, + 0x8d, 0xd0, 0x53, 0x3d, 0x65, 0xd2, 0x17, 0x83, 0xb0, 0x8e, 0x67, 0x7f, 0x1a, 0x50, 0x3a, 0xc5, + 0x24, 0x7a, 0x83, 0xdb, 0x76, 0xbb, 0x01, 0x69, 0x74, 0xd3, 0x4e, 0xeb, 0xc1, 0x48, 0xa4, 0x33, + 0x20, 0xaf, 0x85, 0x55, 0x7d, 0xfb, 0x87, 0x06, 0x60, 0x2a, 0x19, 0xfe, 0x00, 0x5d, 0x84, 0x21, + 0xce, 0x52, 0x0a, 0xf2, 0x5d, 0x8c, 0x9f, 0xb4, 0xa0, 0x09, 0xec, 0x72, 0x15, 0x5c, 0xa9, 0xa8, + 0x8f, 0xde, 0x86, 0xd1, 0x86, 0x7f, 0xd3, 0xbb, 0xe9, 0x04, 0x8d, 0x85, 0x6a, 0x45, 0x2c, 0xe7, + 0x4c, 0x69, 0xc9, 0x72, 0x8c, 0xa6, 0x07, 0x62, 0x60, 0x8a, 0xfe, 0x18, 0x84, 0x75, 0x72, 0x68, + 0x83, 0x65, 0x4d, 0xd9, 0x74, 0xb7, 0xd6, 0x9c, 0x76, 0x37, 0x47, 0x9f, 0x25, 0x89, 0xa4, 0x51, + 0x1e, 0x17, 0xa9, 0x55, 0x38, 0x00, 0xc7, 0x84, 0xd0, 0x67, 0x61, 0x26, 0xcc, 0xd1, 0xdf, 0xe4, + 0x65, 0x1c, 0xee, 0xa6, 0xd2, 0xe0, 0x2f, 0xff, 0x2c, 0x4d, 0x4f, 0x56, 0x33, 0xe8, 0x16, 0x20, + 0x21, 0x27, 0xdd, 0x08, 0x3a, 0x61, 0xb4, 0xd8, 0xf1, 0x1a, 0x4d, 0x99, 0x55, 0x25, 0x3b, 0x27, + 0x79, 0x0a, 0x5b, 0x6b, 0x9b, 0x85, 0x43, 0x4d, 0x63, 0xe0, 0x8c, 0x36, 0xec, 0xcf, 0x0f, 0xc0, + 0x9c, 0xcc, 0xe9, 0x9a, 0xe1, 0xd0, 0xf0, 0x39, 0x2b, 0xe1, 0xd1, 0xf0, 0x4a, 0xfe, 0xa9, 0xf4, + 0xc0, 0xfc, 0x1a, 0xbe, 0x98, 0xf6, 0x6b, 0x78, 0xed, 0x80, 0xdd, 0xb8, 0x6f, 0xde, 0x0d, 0xdf, + 0xb1, 0x2e, 0x09, 0x5f, 0x3e, 0x02, 0xc6, 0x3d, 0x82, 0x30, 0x8f, 0x35, 0x5d, 0x95, 0x7a, 0x8e, + 0x9c, 0xb7, 0xea, 0x45, 0x81, 0x63, 0xdc, 0x4c, 0x63, 0x32, 0x22, 0x35, 0x3b, 0x6a, 0x15, 0x1d, + 0x4a, 0x93, 0xb4, 0xda, 0xd1, 0xde, 0xb2, 0x1b, 0x88, 0x1e, 0x67, 0xd2, 0x5c, 0x11, 0x38, 0x69, + 0x9a, 0x12, 0x82, 0x15, 0x1d, 0xb4, 0x0b, 0xd3, 0x5b, 0x75, 0x92, 0x48, 0x83, 0x5e, 0xcc, 0xdf, + 0xb7, 0x17, 0x96, 0x56, 0xba, 0xe4, 0x40, 0x67, 0x2f, 0x95, 0x14, 0x0a, 0x4e, 0x37, 0xc1, 0x52, + 0xb0, 0x3b, 0x37, 0xc3, 0x95, 0xa6, 0x13, 0x46, 0x6e, 0x7d, 0xb1, 0xe9, 0xd7, 0x77, 0x6a, 0x91, + 0x1f, 0xc8, 0x1c, 0x6c, 0x99, 0x0f, 0x85, 0x85, 0xeb, 0xb5, 0x14, 0x7e, 0x3a, 0x05, 0x7b, 0x16, + 0x16, 0xce, 0x6c, 0x0b, 0xad, 0xc3, 0xf0, 0x96, 0x1b, 0x61, 0xd2, 0xf6, 0xc5, 0x69, 0x91, 0x79, + 0x14, 0x5e, 0xe0, 0x28, 0xe9, 0x94, 0xe8, 0x02, 0x80, 0x25, 0x11, 0xf4, 0x86, 0xba, 0x04, 0x86, + 0xf2, 0xa5, 0x85, 0x69, 0x43, 0xb1, 0xcc, 0x6b, 0xe0, 0x75, 0x28, 0x7a, 0x9b, 0x61, 0xb7, 0xf0, + 0x26, 0xeb, 0xab, 0xb5, 0x74, 0xaa, 0xf2, 0xf5, 0xd5, 0x1a, 0xa6, 0x15, 0x99, 0x27, 0x64, 0x58, + 0x0f, 0x5d, 0x91, 0x4d, 0x26, 0xd3, 0x31, 0xb4, 0x52, 0x5b, 0xaa, 0x55, 0xd2, 0xe9, 0xd9, 0x59, + 0x31, 0xe6, 0xd5, 0xd1, 0x35, 0x28, 0x6d, 0xf1, 0x83, 0x6f, 0x33, 0x14, 0x79, 0x9d, 0x33, 0x2f, + 0xa3, 0x0b, 0x12, 0x29, 0x9d, 0x94, 0x5d, 0x81, 0x70, 0x4c, 0x0a, 0x7d, 0xde, 0x82, 0xa3, 0xc9, + 0xc4, 0xd8, 0xcc, 0x7f, 0x49, 0xd8, 0x54, 0xbd, 0xd8, 0x4f, 0xa6, 0x72, 0x56, 0xc1, 0x68, 0x90, + 0xe9, 0x0a, 0x32, 0xd1, 0x70, 0x76, 0x73, 0x74, 0xa0, 0x83, 0x1b, 0x8d, 0x6e, 0x69, 0x4f, 0x12, + 0xb1, 0x5e, 0xf8, 0x40, 0xe3, 0xc5, 0x65, 0x4c, 0x2b, 0xa2, 0x0d, 0x80, 0xcd, 0x26, 0x91, 0x39, + 0xfc, 0xc7, 0xf2, 0x6f, 0xff, 0x55, 0x85, 0x25, 0x13, 0x28, 0x51, 0x9e, 0x30, 0x2e, 0xc5, 0x1a, + 0x1d, 0xba, 0x94, 0xea, 0xae, 0xd7, 0x20, 0x01, 0xd3, 0xc4, 0xe4, 0x2c, 0xa5, 0x25, 0x86, 0x91, + 0x5e, 0x4a, 0xbc, 0x1c, 0x0b, 0x0a, 0x8c, 0x16, 0x69, 0x6f, 0x6f, 0x86, 0xdd, 0xa2, 0xf8, 0x2f, + 0x91, 0xf6, 0x76, 0x62, 0x41, 0x71, 0x5a, 0xac, 0x1c, 0x0b, 0x0a, 0x74, 0xcb, 0x6c, 0xd2, 0x0d, + 0x44, 0x82, 0xd9, 0xc9, 0xfc, 0x2d, 0xb3, 0xca, 0x51, 0xd2, 0x5b, 0x46, 0x00, 0xb0, 0x24, 0x82, + 0x3e, 0x65, 0x72, 0x3b, 0x53, 0x8c, 0xe6, 0xd3, 0x3d, 0xb8, 0x1d, 0x83, 0x6e, 0x77, 0x7e, 0xe7, + 0x15, 0x28, 0x6c, 0xd6, 0x99, 0x06, 0x27, 0x47, 0xc0, 0xbd, 0xba, 0x64, 0x50, 0x63, 0x51, 0xb1, + 0x57, 0x97, 0x70, 0x61, 0xb3, 0x4e, 0x97, 0xbe, 0x73, 0xbb, 0x13, 0x90, 0x55, 0xb7, 0x49, 0x44, + 0x44, 0xff, 0xcc, 0xa5, 0xbf, 0x20, 0x91, 0xd2, 0x4b, 0x5f, 0x81, 0x70, 0x4c, 0x8a, 0xd2, 0x8d, + 0x79, 0xb0, 0x99, 0x7c, 0xba, 0x8a, 0xd5, 0x4a, 0xd3, 0xcd, 0xe4, 0xc2, 0x76, 0x60, 0x7c, 0x37, + 0x6c, 0x6f, 0x13, 0x79, 0x2a, 0x32, 0xdd, 0x52, 0x8e, 0xf3, 0xff, 0x35, 0x81, 0xe8, 0x06, 0x51, + 0xc7, 0x69, 0xa6, 0x0e, 0x72, 0x26, 0x07, 0xb8, 0xa6, 0x13, 0xc3, 0x26, 0x6d, 0xba, 0x10, 0xde, + 0xe1, 0x11, 0xba, 0x98, 0x96, 0x29, 0x67, 0x21, 0x64, 0x04, 0xf1, 0xe2, 0x0b, 0x41, 0x00, 0xb0, + 0x24, 0xa2, 0x06, 0x9b, 0x5d, 0x40, 0xc7, 0x7a, 0x0c, 0x76, 0xaa, 0xbf, 0xf1, 0x60, 0xb3, 0x0b, + 0x27, 0x26, 0xc5, 0x2e, 0x9a, 0x76, 0x46, 0x0e, 0x71, 0xa6, 0x63, 0xca, 0xb9, 0x68, 0x7a, 0xe5, + 0x1c, 0xe7, 0x17, 0x4d, 0x16, 0x16, 0xce, 0x6c, 0x8b, 0x7e, 0x5c, 0x5b, 0x06, 0x5b, 0x13, 0x59, + 0x07, 0x9e, 0xcc, 0x89, 0x55, 0x98, 0x8e, 0xc8, 0xc6, 0x3f, 0x4e, 0x81, 0x70, 0x4c, 0x0a, 0x35, + 0x60, 0xa2, 0x6d, 0x04, 0xf1, 0x64, 0xd9, 0x13, 0x72, 0xf8, 0x82, 0xac, 0x70, 0x9f, 0x5c, 0x9c, + 0x61, 0x42, 0x70, 0x82, 0x26, 0x33, 0x33, 0xe3, 0x7e, 0x69, 0x2c, 0xb9, 0x42, 0xce, 0x54, 0x67, + 0xb8, 0xae, 0xf1, 0xa9, 0x16, 0x00, 0x2c, 0x89, 0xd0, 0xd1, 0x10, 0xde, 0x54, 0x7e, 0xc8, 0x72, + 0x94, 0xe4, 0x69, 0x83, 0xb3, 0x74, 0x1a, 0x32, 0x72, 0xb5, 0x00, 0xe1, 0x98, 0x14, 0x3d, 0xc9, + 0xe9, 0x85, 0x77, 0x22, 0xff, 0x24, 0x4f, 0x5e, 0x77, 0xec, 0x24, 0xa7, 0x97, 0x5d, 0x51, 0x5c, + 0x75, 0x2a, 0xd0, 0x32, 0xcb, 0xaf, 0x90, 0xd3, 0x2f, 0x15, 0xa9, 0x39, 0xdd, 0x2f, 0x05, 0xc2, + 0x31, 0x29, 0xfb, 0x87, 0x0a, 0x70, 0xaa, 0xfb, 0x7e, 0x8b, 0x15, 0x35, 0xd5, 0xd8, 0x30, 0x26, + 0xa1, 0xa8, 0xe1, 0x62, 0x83, 0x18, 0xab, 0xef, 0xd8, 0xab, 0x17, 0x60, 0x5a, 0xf9, 0xbc, 0x35, + 0xdd, 0xfa, 0xde, 0x7a, 0x2c, 0xa9, 0x51, 0x51, 0x4a, 0x6a, 0x49, 0x04, 0x9c, 0xae, 0x83, 0x16, + 0x60, 0xd2, 0x28, 0xac, 0x2c, 0x0b, 0xf1, 0x40, 0x1c, 0xd1, 0xdf, 0x04, 0xe3, 0x24, 0xbe, 0xfd, + 0x73, 0x16, 0x3c, 0x94, 0x93, 0xc2, 0xb9, 0xef, 0xd0, 0xa2, 0x9b, 0x30, 0xd9, 0x36, 0xab, 0xf6, + 0x88, 0x86, 0x6c, 0x24, 0x8a, 0x56, 0x7d, 0x4d, 0x00, 0x70, 0x92, 0xa8, 0xfd, 0x33, 0x05, 0x38, + 0xd9, 0xd5, 0x88, 0x1b, 0x61, 0x38, 0xb6, 0xd5, 0x0a, 0x9d, 0xa5, 0x80, 0x34, 0x88, 0x17, 0xb9, + 0x4e, 0xb3, 0xd6, 0x26, 0x75, 0x4d, 0xd5, 0xc6, 0xac, 0xa1, 0x2f, 0xac, 0xd5, 0x16, 0xd2, 0x18, + 0x38, 0xa7, 0x26, 0x5a, 0x05, 0x94, 0x86, 0x88, 0x19, 0x66, 0x4f, 0xd3, 0x34, 0x3d, 0x9c, 0x51, + 0x03, 0xbd, 0x04, 0xe3, 0xca, 0x38, 0x5c, 0x9b, 0x71, 0x76, 0xb0, 0x63, 0x1d, 0x80, 0x4d, 0x3c, + 0x74, 0x9e, 0xa7, 0x7a, 0x11, 0x49, 0x81, 0x84, 0x5e, 0x6e, 0x52, 0xe6, 0x71, 0x11, 0xc5, 0x58, + 0xc7, 0x59, 0x7c, 0xf9, 0xb7, 0xbf, 0x79, 0xea, 0x03, 0xbf, 0xff, 0xcd, 0x53, 0x1f, 0xf8, 0xe3, + 0x6f, 0x9e, 0xfa, 0xc0, 0xf7, 0xde, 0x39, 0x65, 0xfd, 0xf6, 0x9d, 0x53, 0xd6, 0xef, 0xdf, 0x39, + 0x65, 0xfd, 0xf1, 0x9d, 0x53, 0xd6, 0x7f, 0xbc, 0x73, 0xca, 0xfa, 0xd2, 0x9f, 0x9d, 0xfa, 0xc0, + 0x5b, 0x28, 0x0e, 0xd6, 0x7b, 0x8e, 0xce, 0xce, 0xb9, 0xdd, 0xf3, 0xff, 0x3b, 0x00, 0x00, 0xff, + 0xff, 0xe2, 0xa8, 0x72, 0xcf, 0x7e, 0x1b, 0x01, 0x00, } func (m *AWSElasticBlockStoreVolumeSource) Marshal() (dAtA []byte, err error) { @@ -7569,6 +7603,41 @@ func (m *Affinity) MarshalToSizedBuffer(dAtA []byte) (int, error) { return len(dAtA) - i, nil } +func (m *AppArmorProfile) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *AppArmorProfile) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *AppArmorProfile) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + if m.LocalhostProfile != nil { + i -= len(*m.LocalhostProfile) + copy(dAtA[i:], *m.LocalhostProfile) + i = encodeVarintGenerated(dAtA, i, uint64(len(*m.LocalhostProfile))) + i-- + dAtA[i] = 0x12 + } + i -= len(m.Type) + copy(dAtA[i:], m.Type) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type))) + i-- + dAtA[i] = 0xa + return len(dAtA) - i, nil +} + func (m *AttachedVolume) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) @@ -15735,6 +15804,18 @@ func (m *PodSecurityContext) MarshalToSizedBuffer(dAtA []byte) (int, error) { _ = i var l int _ = l + if m.AppArmorProfile != nil { + { + size, err := m.AppArmorProfile.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x5a + } if m.SeccompProfile != nil { { size, err := m.SeccompProfile.MarshalToSizedBuffer(dAtA[:i]) @@ -18730,6 +18811,18 @@ func (m *SecurityContext) MarshalToSizedBuffer(dAtA []byte) (int, error) { _ = i var l int _ = l + if m.AppArmorProfile != nil { + { + size, err := m.AppArmorProfile.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x62 + } if m.SeccompProfile != nil { { size, err := m.SeccompProfile.MarshalToSizedBuffer(dAtA[:i]) @@ -20950,6 +21043,21 @@ func (m *Affinity) Size() (n int) { return n } +func (m *AppArmorProfile) Size() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + l = len(m.Type) + n += 1 + l + sovGenerated(uint64(l)) + if m.LocalhostProfile != nil { + l = len(*m.LocalhostProfile) + n += 1 + l + sovGenerated(uint64(l)) + } + return n +} + func (m *AttachedVolume) Size() (n int) { if m == nil { return 0 @@ -23996,6 +24104,10 @@ func (m *PodSecurityContext) Size() (n int) { l = m.SeccompProfile.Size() n += 1 + l + sovGenerated(uint64(l)) } + if m.AppArmorProfile != nil { + l = m.AppArmorProfile.Size() + n += 1 + l + sovGenerated(uint64(l)) + } return n } @@ -25080,6 +25192,10 @@ func (m *SecurityContext) Size() (n int) { l = m.SeccompProfile.Size() n += 1 + l + sovGenerated(uint64(l)) } + if m.AppArmorProfile != nil { + l = m.AppArmorProfile.Size() + n += 1 + l + sovGenerated(uint64(l)) + } return n } @@ -25877,6 +25993,17 @@ func (this *Affinity) String() string { }, "") return s } +func (this *AppArmorProfile) String() string { + if this == nil { + return "nil" + } + s := strings.Join([]string{`&AppArmorProfile{`, + `Type:` + fmt.Sprintf("%v", this.Type) + `,`, + `LocalhostProfile:` + valueToStringGenerated(this.LocalhostProfile) + `,`, + `}`, + }, "") + return s +} func (this *AttachedVolume) String() string { if this == nil { return "nil" @@ -28148,6 +28275,7 @@ func (this *PodSecurityContext) String() string { `WindowsOptions:` + strings.Replace(this.WindowsOptions.String(), "WindowsSecurityContextOptions", "WindowsSecurityContextOptions", 1) + `,`, `FSGroupChangePolicy:` + valueToStringGenerated(this.FSGroupChangePolicy) + `,`, `SeccompProfile:` + strings.Replace(this.SeccompProfile.String(), "SeccompProfile", "SeccompProfile", 1) + `,`, + `AppArmorProfile:` + strings.Replace(this.AppArmorProfile.String(), "AppArmorProfile", "AppArmorProfile", 1) + `,`, `}`, }, "") return s @@ -29007,6 +29135,7 @@ func (this *SecurityContext) String() string { `ProcMount:` + valueToStringGenerated(this.ProcMount) + `,`, `WindowsOptions:` + strings.Replace(this.WindowsOptions.String(), "WindowsSecurityContextOptions", "WindowsSecurityContextOptions", 1) + `,`, `SeccompProfile:` + strings.Replace(this.SeccompProfile.String(), "SeccompProfile", "SeccompProfile", 1) + `,`, + `AppArmorProfile:` + strings.Replace(this.AppArmorProfile.String(), "AppArmorProfile", "AppArmorProfile", 1) + `,`, `}`, }, "") return s @@ -29836,6 +29965,121 @@ func (m *Affinity) Unmarshal(dAtA []byte) error { } return nil } +func (m *AppArmorProfile) Unmarshal(dAtA []byte) error { + l := len(dAtA) + iNdEx := 0 + for iNdEx < l { + preIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: AppArmorProfile: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: AppArmorProfile: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + intStringLen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + m.Type = AppArmorProfileType(dAtA[iNdEx:postIndex]) + iNdEx = postIndex + case 2: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field LocalhostProfile", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + intStringLen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + s := string(dAtA[iNdEx:postIndex]) + m.LocalhostProfile = &s + iNdEx = postIndex + default: + iNdEx = preIndex + skippy, err := skipGenerated(dAtA[iNdEx:]) + if err != nil { + return err + } + if (skippy < 0) || (iNdEx+skippy) < 0 { + return ErrInvalidLengthGenerated + } + if (iNdEx + skippy) > l { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + + if iNdEx > l { + return io.ErrUnexpectedEOF + } + return nil +} func (m *AttachedVolume) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 @@ -56119,6 +56363,42 @@ func (m *PodSecurityContext) Unmarshal(dAtA []byte) error { return err } iNdEx = postIndex + case 11: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field AppArmorProfile", wireType) + } + var msglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + msglen |= int(b&0x7F) << shift + if b < 0x80 { + break + } + } + if msglen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + msglen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + if m.AppArmorProfile == nil { + m.AppArmorProfile = &AppArmorProfile{} + } + if err := m.AppArmorProfile.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } + iNdEx = postIndex default: iNdEx = preIndex skippy, err := skipGenerated(dAtA[iNdEx:]) @@ -65788,6 +66068,42 @@ func (m *SecurityContext) Unmarshal(dAtA []byte) error { return err } iNdEx = postIndex + case 12: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field AppArmorProfile", wireType) + } + var msglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + msglen |= int(b&0x7F) << shift + if b < 0x80 { + break + } + } + if msglen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + msglen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + if m.AppArmorProfile == nil { + m.AppArmorProfile = &AppArmorProfile{} + } + if err := m.AppArmorProfile.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } + iNdEx = postIndex default: iNdEx = preIndex skippy, err := skipGenerated(dAtA[iNdEx:]) diff --git a/staging/src/k8s.io/api/core/v1/generated.proto b/staging/src/k8s.io/api/core/v1/generated.proto index cf13ab8d8f7..f96d415cbb1 100644 --- a/staging/src/k8s.io/api/core/v1/generated.proto +++ b/staging/src/k8s.io/api/core/v1/generated.proto @@ -77,6 +77,25 @@ message Affinity { optional PodAntiAffinity podAntiAffinity = 3; } +// AppArmorProfile defines a pod or container's AppArmor settings. +// +union +message AppArmorProfile { + // type indicates which kind of AppArmor profile will be applied. + // Valid options are: + // Localhost - a profile pre-loaded on the node. + // RuntimeDefault - the container runtime's default profile. + // Unconfined - no AppArmor enforcement. + // +unionDiscriminator + optional string type = 1; + + // localhostProfile indicates a profile loaded on the node that should be used. + // The profile must be preconfigured on the node to work. + // Must match the loaded name of the profile. + // Must be set if and only if type is "Localhost". + // +optional + optional string localhostProfile = 2; +} + // AttachedVolume describes a volume attached to a node message AttachedVolume { // Name of the attached volume @@ -3866,6 +3885,11 @@ message PodSecurityContext { // Note that this field cannot be set when spec.os.name is windows. // +optional optional SeccompProfile seccompProfile = 10; + + // appArmorProfile is the AppArmor options to use by the containers in this pod. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + optional AppArmorProfile appArmorProfile = 11; } // Describes the class of pods that should avoid this node. @@ -4154,6 +4178,7 @@ message PodSpec { // - spec.hostPID // - spec.hostIPC // - spec.hostUsers + // - spec.securityContext.appArmorProfile // - spec.securityContext.seLinuxOptions // - spec.securityContext.seccompProfile // - spec.securityContext.fsGroup @@ -4163,6 +4188,7 @@ message PodSpec { // - spec.securityContext.runAsUser // - spec.securityContext.runAsGroup // - spec.securityContext.supplementalGroups + // - spec.containers[*].securityContext.appArmorProfile // - spec.containers[*].securityContext.seLinuxOptions // - spec.containers[*].securityContext.seccompProfile // - spec.containers[*].securityContext.capabilities @@ -5343,6 +5369,12 @@ message SecurityContext { // Note that this field cannot be set when spec.os.name is windows. // +optional optional SeccompProfile seccompProfile = 11; + + // appArmorProfile is the AppArmor options to use by this container. If set, this profile + // overrides the pod's appArmorProfile. + // Note that this field cannot be set when spec.os.name is windows. + // +optional + optional AppArmorProfile appArmorProfile = 12; } // SerializedReference is a reference to serialized object. diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go index aceab6bfce2..8322c78c0f0 100644 --- a/staging/src/k8s.io/api/core/v1/types.go +++ b/staging/src/k8s.io/api/core/v1/types.go @@ -4163,7 +4163,7 @@ type PodSecurityContext struct { // appArmorProfile is the AppArmor options to use by the containers in this pod. // Note that this field cannot be set when spec.os.name is windows. // +optional - AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty"` + AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty" protobuf:"bytes,11,opt,name=appArmorProfile"` } // SeccompProfile defines a pod/container's seccomp profile settings. @@ -4209,14 +4209,14 @@ type AppArmorProfile struct { // RuntimeDefault - the container runtime's default profile. // Unconfined - no AppArmor enforcement. // +unionDiscriminator - Type AppArmorProfileType `json:"type"` + Type AppArmorProfileType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=AppArmorProfileType"` // localhostProfile indicates a profile loaded on the node that should be used. // The profile must be preconfigured on the node to work. // Must match the loaded name of the profile. // Must be set if and only if type is "Localhost". // +optional - LocalhostProfile *string `json:"localhostProfile,omitempty"` + LocalhostProfile *string `json:"localhostProfile,omitempty" protobuf:"bytes,2,opt,name=localhostProfile"` } // +enum @@ -7255,7 +7255,7 @@ type SecurityContext struct { // overrides the pod's appArmorProfile. // Note that this field cannot be set when spec.os.name is windows. // +optional - AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty"` + AppArmorProfile *AppArmorProfile `json:"appArmorProfile,omitempty" protobuf:"bytes,12,opt,name=appArmorProfile"` } // +enum diff --git a/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go b/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go index f4cc6f1bc40..3df7858ba47 100644 --- a/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go +++ b/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go @@ -50,6 +50,16 @@ func (Affinity) SwaggerDoc() map[string]string { return map_Affinity } +var map_AppArmorProfile = map[string]string{ + "": "AppArmorProfile defines a pod or container's AppArmor settings.", + "type": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + "localhostProfile": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".", +} + +func (AppArmorProfile) SwaggerDoc() map[string]string { + return map_AppArmorProfile +} + var map_AttachedVolume = map[string]string{ "": "AttachedVolume describes a volume attached to a node", "name": "Name of the attached volume", @@ -1705,6 +1715,7 @@ var map_PodSecurityContext = map[string]string{ "sysctls": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.", "fsGroupChangePolicy": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used. Note that this field cannot be set when spec.os.name is windows.", "seccompProfile": "The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.", + "appArmorProfile": "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.", } func (PodSecurityContext) SwaggerDoc() map[string]string { @@ -1757,7 +1768,7 @@ var map_PodSpec = map[string]string{ "overhead": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md", "topologySpreadConstraints": "TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.", "setHostnameAsFQDN": "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default). In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to FQDN. If a pod does not have FQDN, this has no effect. Default to false.", - "os": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup", + "os": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.appArmorProfile - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup", "hostUsers": "Use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new userns is created for the pod. Setting false is useful for mitigating container breakout vulnerabilities even allowing users to run their containers as root without actually having root privileges on the host. This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.", "schedulingGates": "SchedulingGates is an opaque list of values that if specified will block scheduling the pod. If schedulingGates is not empty, the pod will stay in the SchedulingGated state and the scheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.", "resourceClaims": "ResourceClaims defines which ResourceClaims must be allocated and reserved before the Pod is allowed to start. The resources will be made available to those containers which consume them by name.\n\nThis is an alpha field and requires enabling the DynamicResourceAllocation feature gate.\n\nThis field is immutable.", @@ -2274,6 +2285,7 @@ var map_SecurityContext = map[string]string{ "allowPrivilegeEscalation": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "procMount": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.", "seccompProfile": "The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.", + "appArmorProfile": "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.", } func (SecurityContext) SwaggerDoc() map[string]string { diff --git a/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go b/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go index 4796d65cf37..4076b8c9c55 100644 --- a/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go +++ b/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go @@ -74,6 +74,27 @@ func (in *Affinity) DeepCopy() *Affinity { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AppArmorProfile) DeepCopyInto(out *AppArmorProfile) { + *out = *in + if in.LocalhostProfile != nil { + in, out := &in.LocalhostProfile, &out.LocalhostProfile + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppArmorProfile. +func (in *AppArmorProfile) DeepCopy() *AppArmorProfile { + if in == nil { + return nil + } + out := new(AppArmorProfile) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AttachedVolume) DeepCopyInto(out *AttachedVolume) { *out = *in @@ -3998,6 +4019,11 @@ func (in *PodSecurityContext) DeepCopyInto(out *PodSecurityContext) { *out = new(SeccompProfile) (*in).DeepCopyInto(*out) } + if in.AppArmorProfile != nil { + in, out := &in.AppArmorProfile, &out.AppArmorProfile + *out = new(AppArmorProfile) + (*in).DeepCopyInto(*out) + } return } @@ -5388,6 +5414,11 @@ func (in *SecurityContext) DeepCopyInto(out *SecurityContext) { *out = new(SeccompProfile) (*in).DeepCopyInto(*out) } + if in.AppArmorProfile != nil { + in, out := &in.AppArmorProfile, &out.AppArmorProfile + *out = new(AppArmorProfile) + (*in).DeepCopyInto(*out) + } return } diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.json b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.json index e8485500253..3a5e67d3a9f 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.json +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.json @@ -777,6 +777,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1067,6 +1071,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1357,6 +1365,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1410,6 +1422,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.pb b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.pb index ba1bf23caf3e75bfa8d53fba6746acd2305bd8dc..dd219ad8dc3af43814c1b9bf88ac8061245b67c5 100644 GIT binary patch delta 128 zcmcZ`^fq{cG}D>jjj}0>Op^m9KNRz4`tJwk&Ggx9#mvve_Gv+< delta 121 zcmaDGd^c!%+3B>lN%*{nT6i_g7{3G-kYtM`MDTRZ;n@zW?{TCSzqqz w=6IpEjLi2Kfhq;{CfACr-y9%%hy`6qG~?!Gg&T}4FL=1nGy`SMYsfJI00#Fe5C8xG diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.yaml b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.yaml index 27e2faf9742..30c3fa8b6da 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.DaemonSet.yaml @@ -345,6 +345,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -556,6 +559,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -769,6 +775,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -856,6 +865,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.json b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.json index a64b6a63033..95fbf3e18cc 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.json +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.json @@ -778,6 +778,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1068,6 +1072,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1358,6 +1366,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1411,6 +1423,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.pb b/staging/src/k8s.io/api/testdata/HEAD/apps.v1.Deployment.pb index eb23bb4e3e515ea21026216616a31de5b4e3e519..8958cb1b426e46ab7c023abe5a676266e7591dbe 100644 GIT binary patch delta 127 zcmaDA^ecFR4AYI^jdCfBtTO{R7=XI4AY6AjdCfBteyTGj6#zqNcb{Kz4rx)Fm-xwwq@q$Vm!UsmsgsF@yg^n swX2)8<)axV?-icJbdPazpvb+=!J>y)&{Y^Sv%KKp!qB$)l76l delta 122 zcmdlLvnqOmEK_^*M)?#**5%qO-x*qx#aXFCyK0}yg*K6vw-L!7EHxq%q%^;Tv*K5?5?51 F2msyGF<1Zq delta 124 zcmZn;`5ZJsk?Bm(<~xijjI6!>9E?Jf*NgcwOTG663o&(iZ+2ql=VCm)Sz1b(h4ISd yJi)7*4dkO4Cm#}?#C(sDYw|oby~(X2>o-S;9%4aPX3Wg;f`tEh=6KB%M%Lxw9E?Jf1+{&drQZ93g_t_MH#;-)b1|OYEF&e&!gytJ yzTnl(wd&D~lMf3|V!p@7HF>_8-sCos^_wF_53yh>+uWmYgOTM04;PvNhu8ood@C3L diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta1.StatefulSet.yaml b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta1.StatefulSet.yaml index 68daa596624..0a706c5e3c8 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta1.StatefulSet.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta1.StatefulSet.yaml @@ -353,6 +353,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -564,6 +567,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -777,6 +783,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -864,6 +873,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.json b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.json index 2a2b93ed764..1c53ba4ae6a 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.json +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.json @@ -777,6 +777,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1067,6 +1071,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1357,6 +1365,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1410,6 +1422,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.pb b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.DaemonSet.pb index 1d535612e4f8e5b3d495d9cdf038322e4be5bfae..29407e2fb8e84a85697d1a90a7562a9d33bb72a1 100644 GIT binary patch delta 127 zcmaD9^eK3P0@In`%{LiS7?~#ra80(8^ko+M?*|rOn(4FIo|&JE@%`otlF}@UKPJDC yy~>!hd7fMy<%eWizknAr?$^VazN&yj)ncZ+6j;V*~&MOfR

+cWcXF`nM+&nwNscx7^f+SSdv t^3jZw_X|&AzQ@Ql*dXrm4)^CmwJ;Z{p%$S+w1rHa7-p$uFG#CM`0V>e| diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.Deployment.yaml b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.Deployment.yaml index 2ef78a88a04..1ac0f8a028e 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.Deployment.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.Deployment.yaml @@ -353,6 +353,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -564,6 +567,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -777,6 +783,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -864,6 +873,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.json b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.json index bbe5b785bd5..6133c03c606 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.json +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.json @@ -779,6 +779,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1069,6 +1073,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1359,6 +1367,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1412,6 +1424,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.pb b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.ReplicaSet.pb index ca57633c70a686f9d0d40998cf7f5fa7fb019580..109e953c93b6cac250b933afa6b945bc20803fd3 100644 GIT binary patch delta 133 zcmbOev?h3hB2#Pd<~xijjI3AuIT(c|J4*U8Oa1o)3o*^~+3dv3&&BwD^KV6I7RDcw z-^*TQOxnCqu8wi?JmE>qO-x*qx#aXFCyK0}yg*K6vw-L!7EHxq%q%^;T-eNT*SHD* Df&MX& delta 123 zcmZ1zJSS*^BGcEv&37167+H__aWD!^UN7d$EcMtEh=6KB%M%Lxw9E?Jf1+{&drQZ93g_t_MH#;-)b1|OYEF&e&!gytJ yzTnl(wd&D~lMf3|V!p@7HF>_8-sCos^_wF_53yh>+uWmYgOTM04;PvNhu8ood@C3L diff --git a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.StatefulSet.yaml b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.StatefulSet.yaml index e9c4430d137..2415a36b520 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.StatefulSet.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/apps.v1beta2.StatefulSet.yaml @@ -353,6 +353,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -564,6 +567,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -777,6 +783,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -864,6 +873,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.json b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.json index 3a303983ac8..6aa9a1f4cd4 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.json +++ b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.json @@ -853,6 +853,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1143,6 +1147,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1433,6 +1441,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1486,6 +1498,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.pb b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.pb index 4e407827b451c1874305bffd9da4376bad8bf3d6..0ad2dc8ecd6392f4b433041f92ba01d7c0e47f97 100644 GIT binary patch delta 164 zcmbObz93?P6jMXQ<_(M~j7+mbCO0waFx?6Ub2+{Qa4-rmNia`-&+Esk!D#f~529?Q z&*rNv{9KIhH}@$^voQXc%qV=7F==vxnDXX&jcCTnhN6?0o0zyJ&z0Ak{6%y64w><|m4vdwZz PHyBx7@Nl6SAjk{=Yh*7l diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.yaml b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.yaml index 93f35eb164b..ca0f8228189 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.CronJob.yaml @@ -401,6 +401,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -612,6 +615,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -825,6 +831,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -912,6 +921,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.json b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.json index de9f8782db9..800352c7c99 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.json +++ b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.json @@ -804,6 +804,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1094,6 +1098,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1384,6 +1392,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1437,6 +1449,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.pb b/staging/src/k8s.io/api/testdata/HEAD/batch.v1.Job.pb index c2c737774a6b7428ccefd1b0f047955c84d809f6..6814c7c1cb6b0c456f6446f4fd9ebef2cc9fb2d0 100644 GIT binary patch delta 123 zcmbOgvMO|f7*k*9Mu`+grY`}L>lnkC{`-M>GkrGOGV^mWzTbRKQksSF$K+SCR~eHw t&ylNRoIF!_5>pe?WL=SalV{7RY~~g{#Db|VjG3i}mkW#b%}yFO7y%3{E^Yt- delta 113 zcmZ1#IxA#?7}LMtjS?x0Oi%nL*D;1Oz4rz4I=wgBGV^mWp5E-sE6u`qWpbU`)y>-S n(TtP#3QuCX$2d7qeY$iI1xrvEuvZAow-&-ZvHR)mXY}$BiCd_VZF(+V(T}55Ie+zt|Xdqv$E0+MwS;mTxgnsGWlBD F7y%*CG$sH5 diff --git a/staging/src/k8s.io/api/testdata/HEAD/batch.v1beta1.CronJob.yaml b/staging/src/k8s.io/api/testdata/HEAD/batch.v1beta1.CronJob.yaml index bf36262f91a..f27b6b198f8 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/batch.v1beta1.CronJob.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/batch.v1beta1.CronJob.yaml @@ -401,6 +401,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -612,6 +615,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -825,6 +831,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -912,6 +921,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.json b/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.json index 0945a9a5d97..577d30d8f8c 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.json +++ b/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.json @@ -719,6 +719,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1009,6 +1013,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1299,6 +1307,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1352,6 +1364,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.pb b/staging/src/k8s.io/api/testdata/HEAD/core.v1.Pod.pb index 6ddc9092029c22ddd3eeb4192752479ebd039e0f..4ce748ba1dcbd0b66d4212f9e48f85a015b8e4f0 100644 GIT binary patch delta 129 zcmewm(GVq+ZBfj?#mU7~W+=oQke?#-DsuBfjub|wnLe8<82Pyv-)}ZlkY-{0G1*t; zDr3^-|0;EildlL)Vs2vMn(QE>H+j0y`pN%PR5rT_A7a6#cyp-S4Mvt8UM>uS3fTc2 C4lRxV delta 120 zcmZpO`Vb+MZBfj?#mU7~W+=oQke?!SD`N9Qjub|wPVdbXjQm`Tr#A;mNV70rnVc(g yb@N<-w~Wm97`Z0z=hvIOTWI~}KH)S>Dg6V1C<_5+TMyCIM5PGK1=4VX&T#WBG&sUUYVf-<9x9U~Kq{$OSls8XM vi)NhcBs__^iHU3SI$6ERtRm|fqc%?zdCG!I`R2p&HyBxZc)73|_m~j?0>&~C delta 113 zcmZn;`W!Gpg6V3&<_5+TMyB_^5W3TQ^D`!XF2>WF_e)B%FkYE_TlVT^1@&mg$!Wrq mnC~%iP1Y6Eo2)6ae)AuZLoAreHtQ?gU}Sm0!-ZzRV@3dOq$=6~ diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.PodTemplate.yaml b/staging/src/k8s.io/api/testdata/HEAD/core.v1.PodTemplate.yaml index 81f34c7c696..7624be3dcf5 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/core.v1.PodTemplate.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/core.v1.PodTemplate.yaml @@ -334,6 +334,9 @@ template: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -545,6 +548,9 @@ template: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -758,6 +764,9 @@ template: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -845,6 +854,9 @@ template: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.json b/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.json index 02e096966e0..d6e263db58a 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.json +++ b/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.json @@ -768,6 +768,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1058,6 +1062,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1348,6 +1356,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1401,6 +1413,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.pb b/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.pb index 980e75f59b08c4c4e0c467c54e337788ce0f4fb3..cdcfc8c66932450c98681912a41023bd23f23058 100644 GIT binary patch delta 130 zcmaDG_%~>R64TY7&1)G`7@3y%Pwrw=Wcu$1;m-8gEX>T$#rS^n8AWLp#vhXp$X;bk z+Wb*afQh+@iEHw0S-r_dBI_p?%BgIAC~}AeQ(+zB<`42W7+HFFxiAc=W1K9ZaTNf+ CVKUDE delta 120 zcmewx^fqvU64TMZ&1)G`7@4N{P3~e;WP0xl;dXj&7G~z>Vm!V1jifXS$^D tsz)V!>3lIY!|IBg+dOE;IuSm;hwzD`fxx diff --git a/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.yaml b/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.yaml index c08e4bda5d2..4318f124e13 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/core.v1.ReplicationController.yaml @@ -339,6 +339,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -550,6 +553,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -763,6 +769,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -850,6 +859,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.json b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.json index eb1af7a37cc..1124bebf9c0 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.json +++ b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.json @@ -777,6 +777,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1067,6 +1071,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1357,6 +1365,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1410,6 +1422,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.pb b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.pb index 59d1c906645a7422b7e86f2cc1b0d38055ca92ce..d04b2848de304def9043d8358b6dad9acaa2aeb2 100644 GIT binary patch delta 142 zcmaDA^ecFR8q>Mp&G#8o7@4OAa7|9&@nshJ?*|rOn(4FIm6@N5@%`q1iqb5MKPDFn zUS&+0{6R!{^Lw>u#>oqXCowlMaZTox)0>Hk|+f delta 120 zcmewr{3>XI8q>a@&G#8o7@1oACp(DwGrjkPa67#>yE5~0F`nKmCne3ocx7^-;ML9b t>d}moj|xv>zQ@Qld7+x#v#s7n%XpOaOpbE9w9M diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.yaml b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.yaml index 4394d18c8e6..d2a36df2123 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.DaemonSet.yaml @@ -345,6 +345,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -556,6 +559,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -769,6 +775,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -856,6 +865,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.json b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.json index 59701d6d3c9..8373202069e 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.json +++ b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.json @@ -778,6 +778,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1068,6 +1072,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1358,6 +1366,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1411,6 +1423,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.pb b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.pb index e7929a39a63ac6ad8ebdc5b04efbc1b058dd4f46..f4a5d4fa2255e2cacc0c37a65855f77c397fd990 100644 GIT binary patch delta 130 zcmewv)EP2Co#{^S=8aq_j7)O_CigQ2GX3|1aA*2#_F(4cVtl`uQAwJG@yBFYwX2Lt zo6oD&F-~40Jc+r9iEFZeoZjSgk@b_$si|xh6FtO&P4Q+`g&T}4J-l2P2CZTO0Nxob AtN;K2 delta 121 zcmeAS`581po#{-_=8aq_j7+`$llvJ1ncn+CxSigcJ(&5q7*B6jl#*s)yfWEV?&{`T vp|_08_ZYb*_Y3Mx?iN|UIZpHt3%ZhM#?2EIZZNXE;Ne2k43xR6p~DCOUh*pM diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.yaml b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.yaml index 71b21158dc9..f9e3e1afc12 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.yaml +++ b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.Deployment.yaml @@ -355,6 +355,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -566,6 +569,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -779,6 +785,9 @@ spec: restartPolicy: restartPolicyValue securityContext: allowPrivilegeEscalation: true + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue capabilities: add: - addValue @@ -866,6 +875,9 @@ spec: schedulingGates: - name: nameValue securityContext: + appArmorProfile: + localhostProfile: localhostProfileValue + type: typeValue fsGroup: 5 fsGroupChangePolicy: fsGroupChangePolicyValue runAsGroup: 6 diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.json b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.json index c7cc3c6fcd8..895386f68e1 100644 --- a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.json +++ b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.json @@ -779,6 +779,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1069,6 +1073,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1359,6 +1367,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "stdin": true, @@ -1412,6 +1424,10 @@ "seccompProfile": { "type": "typeValue", "localhostProfile": "localhostProfileValue" + }, + "appArmorProfile": { + "type": "typeValue", + "localhostProfile": "localhostProfileValue" } }, "imagePullSecrets": [ diff --git a/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.pb b/staging/src/k8s.io/api/testdata/HEAD/extensions.v1beta1.ReplicaSet.pb index af1efe0c688a1b8b66d405596d2b38529887537d..ed7271d1806a0b9c1e45cfa1020a4fa71eefcc6d 100644 GIT binary patch delta 130 zcmZ1!v?+LkI#X-#=8aq_j7(SjC-*Z3GX3|1aA*2#_F(4cVtl`uQAwJG@yBFYwX2Lt zo6oD&F-~40Jc+r9iEFZeoZjSgk@b_$si|xh6FtO&P4Q+`g&T}4J-l2P1_d(#0JF3$ A1poj5 delta 120 zcmdlKyeMdbI@8y{%^SH=7@3avP3~t5WP0xl;dXj&_F(4cVm!TBQA(PH@ycXdxvQIV vh2AnU-(%#O+%Kp%xm#rY<~Y$qEa*z288=T Date: Wed, 21 Feb 2024 00:12:12 -0800 Subject: [PATCH 03/12] Implement version skew strategy --- pkg/apis/core/validation/validation.go | 61 +++ pkg/apis/core/validation/validation_test.go | 68 ++++ pkg/registry/core/pod/strategy.go | 107 +++++ pkg/registry/core/pod/strategy_test.go | 429 ++++++++++++++++++++ 4 files changed, 665 insertions(+) diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 43583928b48..d5479dfaeca 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -4729,6 +4729,66 @@ func ValidateAppArmorProfileFormat(profile string) error { return nil } +// validateAppArmorAnnotationsAndFields validates that AppArmor fields and annotations are consistent. +func validateAppArmorAnnotationsAndFields(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { + if podSpec.OS != nil && podSpec.OS.Name == core.Windows { + // Skip consistency check for windows pods. + return nil + } + + allErrs := field.ErrorList{} + + podshelper.VisitContainersWithPath(podSpec, specPath, func(c *core.Container, cFldPath *field.Path) bool { + var field *core.AppArmorProfile + if c.SecurityContext != nil { + field = c.SecurityContext.AppArmorProfile + } + + if field == nil { + return true + } + + key := core.AppArmorContainerAnnotationKeyPrefix + c.Name + if annotation, found := objectMeta.Annotations[key]; found { + apparmorPath := cFldPath.Child("securityContext").Child("appArmorProfile") + err := validateAppArmorAnnotationsAndFieldsMatch(annotation, field, apparmorPath) + if err != nil { + allErrs = append(allErrs, err) + } + } + return true + }) + + return allErrs +} + +func validateAppArmorAnnotationsAndFieldsMatch(annotationValue string, apparmorField *core.AppArmorProfile, fldPath *field.Path) *field.Error { + if apparmorField == nil { + return nil + } + + switch apparmorField.Type { + case core.AppArmorProfileTypeUnconfined: + if annotationValue != core.AppArmorProfileNameUnconfined { + return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") + } + + case core.AppArmorProfileTypeRuntimeDefault: + if annotationValue != core.AppArmorProfileRuntimeDefault { + return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") + } + + case core.AppArmorProfileTypeLocalhost: + if !strings.HasPrefix(annotationValue, core.AppArmorProfileLocalhostPrefix) { + return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") + } else if apparmorField.LocalhostProfile == nil || strings.TrimPrefix(annotationValue, core.AppArmorProfileLocalhostPrefix) != *apparmorField.LocalhostProfile { + return field.Forbidden(fldPath.Child("localhostProfile"), "apparmor profile in annotation and field must match") + } + } + + return nil +} + func podSpecHasContainer(spec *core.PodSpec, containerName string) bool { var hasContainer bool podshelper.VisitContainersWithPath(spec, field.NewPath("spec"), func(c *core.Container, _ *field.Path) bool { @@ -4883,6 +4943,7 @@ func ValidatePodCreate(pod *core.Pod, opts PodValidationOptions) field.ErrorList allErrs = append(allErrs, field.Forbidden(fldPath.Child("nodeName"), "cannot be set until all schedulingGates have been cleared")) } allErrs = append(allErrs, validateSeccompAnnotationsAndFields(pod.ObjectMeta, &pod.Spec, fldPath)...) + allErrs = append(allErrs, validateAppArmorAnnotationsAndFields(pod.ObjectMeta, &pod.Spec, fldPath)...) return allErrs } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 4c6bd0366f7..d87015678d5 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -10425,6 +10425,27 @@ func TestValidatePod(t *testing.T) { DNSPolicy: core.DNSDefault, }, }, + "matching AppArmor fields and annotations": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + }, + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("foo"), + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, "syntactically valid sysctls": { ObjectMeta: metav1.ObjectMeta{ Name: "123", @@ -12118,6 +12139,53 @@ func TestValidatePod(t *testing.T) { }, }, }, + "mismatched AppArmor field and annotation types": { + expectedError: "Forbidden: apparmor type in annotation and field must match", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileRuntimeDefault, + }, + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeUnconfined, + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + }, + "mismatched AppArmor localhost profiles": { + expectedError: "Forbidden: apparmor profile in annotation and field must match", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + }, + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", + SecurityContext: &core.SecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("bar"), + }, + }, + }}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + }, "invalid extended resource name in container request": { expectedError: "must be a standard resource for containers", spec: core.Pod{ diff --git a/pkg/registry/core/pod/strategy.go b/pkg/registry/core/pod/strategy.go index c72ad557f65..e2c6a204efc 100644 --- a/pkg/registry/core/pod/strategy.go +++ b/pkg/registry/core/pod/strategy.go @@ -91,6 +91,7 @@ func (podStrategy) PrepareForCreate(ctx context.Context, obj runtime.Object) { applySchedulingGatedCondition(pod) mutatePodAffinity(pod) + applyAppArmorVersionSkew(pod) } // PrepareForUpdate clears fields that are not allowed to be set by end users on update. @@ -758,3 +759,109 @@ func applySchedulingGatedCondition(pod *api.Pod) { Message: "Scheduling is blocked due to non-empty scheduling gates", }) } + +// applyAppArmorVersionSkew implements the version skew behavior described in: +// https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/24-apparmor#version-skew-strategy +func applyAppArmorVersionSkew(pod *api.Pod) { + if pod.Spec.OS != nil && pod.Spec.OS.Name == api.Windows { + return + } + + var podProfile *api.AppArmorProfile + if pod.Spec.SecurityContext != nil { + podProfile = pod.Spec.SecurityContext.AppArmorProfile + } + + // Handle the containers of the pod + podutil.VisitContainers(&pod.Spec, podutil.AllFeatureEnabledContainers(), + func(ctr *api.Container, _ podutil.ContainerType) bool { + // get possible annotation and field + key := api.AppArmorContainerAnnotationKeyPrefix + ctr.Name + annotation, hasAnnotation := pod.Annotations[key] + + field, hasField := (*api.AppArmorProfile)(nil), false + if ctr.SecurityContext != nil && ctr.SecurityContext.AppArmorProfile != nil { + field = ctr.SecurityContext.AppArmorProfile + hasField = true + } + + // sync field and annotation + if !hasAnnotation { + newAnnotation := "" + if hasField { + newAnnotation = appArmorAnnotationForField(field) + } else if podProfile != nil { + newAnnotation = appArmorAnnotationForField(podProfile) + } + + if newAnnotation != "" { + if pod.Annotations == nil { + pod.Annotations = map[string]string{} + } + pod.Annotations[key] = newAnnotation + } + } else if !hasField { + newField := apparmorFieldForAnnotation(annotation) + + if newField != nil { + if ctr.SecurityContext == nil { + ctr.SecurityContext = &api.SecurityContext{} + } + ctr.SecurityContext.AppArmorProfile = newField + } + } + + return true + }) +} + +// appArmorFieldForAnnotation takes a pod apparmor profile field and returns the +// converted annotation value +func appArmorAnnotationForField(field *api.AppArmorProfile) string { + // If only apparmor fields are specified, add the corresponding annotations. + // This ensures that the fields are enforced even if the node version + // trails the API version + switch field.Type { + case api.AppArmorProfileTypeUnconfined: + return api.AppArmorProfileNameUnconfined + + case api.AppArmorProfileTypeRuntimeDefault: + return api.AppArmorProfileRuntimeDefault + + case api.AppArmorProfileTypeLocalhost: + if field.LocalhostProfile != nil { + return api.AppArmorProfileLocalhostPrefix + *field.LocalhostProfile + } + } + + // we can only reach this code path if the LocalhostProfile is nil but the + // provided field type is AppArmorProfileTypeLocalhost or if an unrecognized + // type is specified + return "" +} + +// apparmorFieldForAnnotation takes a pod annotation and returns the converted +// apparmor profile field. +func apparmorFieldForAnnotation(annotation string) *api.AppArmorProfile { + if annotation == api.AppArmorProfileNameUnconfined { + return &api.AppArmorProfile{Type: api.AppArmorProfileTypeUnconfined} + } + + if annotation == api.AppArmorProfileRuntimeDefault { + return &api.AppArmorProfile{Type: api.AppArmorProfileTypeRuntimeDefault} + } + + if strings.HasPrefix(annotation, api.AppArmorProfileLocalhostPrefix) { + localhostProfile := strings.TrimPrefix(annotation, api.AppArmorProfileLocalhostPrefix) + if localhostProfile != "" { + return &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeLocalhost, + LocalhostProfile: &localhostProfile, + } + } + } + + // we can only reach this code path if the localhostProfile name has a zero + // length or if the annotation has an unrecognized value + return nil +} diff --git a/pkg/registry/core/pod/strategy_test.go b/pkg/registry/core/pod/strategy_test.go index 89b919cc08d..19c8f6a1739 100644 --- a/pkg/registry/core/pod/strategy_test.go +++ b/pkg/registry/core/pod/strategy_test.go @@ -26,6 +26,7 @@ import ( "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" + "github.com/stretchr/testify/assert" apiv1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource" @@ -2106,3 +2107,431 @@ func TestPodLifecycleSleepActionEnablement(t *testing.T) { }) } } + +func TestApplyAppArmorVersionSkew(t *testing.T) { + testProfile := "test" + + tests := []struct { + description string + pod *api.Pod + validation func(*testing.T, *api.Pod) + }{{ + description: "Security context nil", + pod: &api.Pod{ + Spec: api.PodSpec{ + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Empty(t, pod.Annotations) + assert.Nil(t, pod.Spec.SecurityContext) + }, + }, { + description: "Security context not nil", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{}, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Empty(t, pod.Annotations) + assert.Nil(t, pod.Spec.SecurityContext.AppArmorProfile) + }, + }, { + description: "Field type unconfined and no annotation present", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeUnconfined, + }, + }, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, pod.Annotations) + }, + }, { + description: "Field type default and no annotation present", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileRuntimeDefault, + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + }, + }, { + description: "Field type localhost and no annotation present", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeLocalhost, + LocalhostProfile: &testProfile, + }, + }, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileLocalhostPrefix + testProfile, + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + }, pod.Annotations) + }, + }, { + description: "Field type localhost but profile is nil", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeLocalhost, + }, + }, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Len(t, pod.Annotations, 0) + }, + }, { + description: "Security context not nil (container)", + pod: &api.Pod{ + Spec: api.PodSpec{ + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{}, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Len(t, pod.Annotations, 0) + }, + }, { + description: "Field type RuntimeDefault and no annotation present (container)", + pod: &api.Pod{ + Spec: api.PodSpec{ + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Nil(t, pod.Spec.SecurityContext) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Field type localhost and no annotation present (container)", + pod: &api.Pod{ + Spec: api.PodSpec{ + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeLocalhost, + LocalhostProfile: &testProfile, + }, + }, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + }, pod.Annotations) + assert.Nil(t, pod.Spec.SecurityContext) + assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Container overrides pod profile", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeUnconfined, + }, + }, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Multiple containers with fields (container)", + pod: &api.Pod{ + Spec: api.PodSpec{ + InitContainers: []api.Container{{ + Name: "init", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeLocalhost, + LocalhostProfile: &testProfile, + }, + }, + }}, + Containers: []api.Container{{ + Name: "a", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeUnconfined, + }, + }, + }, { + Name: "b", + }, { + Name: "c", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileLocalhostPrefix + testProfile, + api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Nil(t, pod.Spec.SecurityContext) + assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.InitContainers[0].SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[1].SecurityContext) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[2].SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Annotation 'unconfined' and no field present (container)", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, + }, + Spec: api.PodSpec{ + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) + assert.Nil(t, pod.Spec.SecurityContext) + }, + }, { + description: "Annotation for non-existent container", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "foo-bar": api.AppArmorProfileNameUnconfined, + }, + }, + Spec: api.PodSpec{ + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "foo-bar": api.AppArmorProfileNameUnconfined, + }, pod.Annotations) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + assert.Nil(t, pod.Spec.SecurityContext) + }, + }, { + description: "Annotation 'runtime/default' and no field present (container)", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, + }, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeUnconfined, + }, + }, + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{}, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Multiple containers by annotations (container)", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileLocalhostPrefix + testProfile, + api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + }, + }, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + InitContainers: []api.Container{{Name: "init"}}, + Containers: []api.Container{ + {Name: "a"}, + {Name: "b"}, + {Name: "c"}, + }, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileLocalhostPrefix + testProfile, + api.AppArmorContainerAnnotationKeyPrefix + "b": api.AppArmorProfileRuntimeDefault, + api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.InitContainers[0].SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Equal(t, testProfile, *pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) + assert.Nil(t, pod.Spec.Containers[1].SecurityContext) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[2].SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Conflicting field and annotations", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + }, + }, + Spec: api.PodSpec{ + Containers: []api.Container{{ + Name: "ctr", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) + assert.Nil(t, pod.Spec.SecurityContext) + }, + }, { + description: "Invalid annotation value", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": "not-a-real-type", + }, + }, + Spec: api.PodSpec{ + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": "not-a-real-type", + }, pod.Annotations) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + assert.Nil(t, pod.Spec.SecurityContext) + }, + }, { + description: "Invalid field type", + pod: &api.Pod{ + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: "invalid-type", + }, + }, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Empty(t, pod.Annotations) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + }, + }, { + description: "Ignore annotations on windows", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, + }, + Spec: api.PodSpec{ + OS: &api.PodOS{Name: api.Windows}, + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + }, + }} + + for _, test := range tests { + t.Run(test.description, func(t *testing.T) { + applyAppArmorVersionSkew(test.pod) + test.validation(t, test.pod) + }) + } +} From bf3c8464baebdf9293145c0d028663c10500cc93 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 21 Feb 2024 11:18:44 -0800 Subject: [PATCH 04/12] Implement Kubelet AppArmor field handling --- pkg/kubelet/kuberuntime/helpers.go | 34 ++++++ pkg/kubelet/kuberuntime/helpers_test.go | 73 ++++++++++++ pkg/kubelet/kuberuntime/security_context.go | 6 +- pkg/security/apparmor/helpers.go | 71 +++++++++-- pkg/security/apparmor/helpers_test.go | 124 ++++++++++++++++++++ pkg/security/apparmor/validate.go | 13 +- pkg/security/apparmor/validate_test.go | 1 - 7 files changed, 304 insertions(+), 18 deletions(-) create mode 100644 pkg/security/apparmor/helpers_test.go diff --git a/pkg/kubelet/kuberuntime/helpers.go b/pkg/kubelet/kuberuntime/helpers.go index a87e46ed770..2d82a630f89 100644 --- a/pkg/kubelet/kuberuntime/helpers.go +++ b/pkg/kubelet/kuberuntime/helpers.go @@ -18,6 +18,7 @@ package kuberuntime import ( "context" + "errors" "fmt" "path/filepath" "strconv" @@ -28,6 +29,7 @@ import ( runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1" "k8s.io/klog/v2" kubecontainer "k8s.io/kubernetes/pkg/kubelet/container" + "k8s.io/kubernetes/pkg/security/apparmor" ) type podsByID []*kubecontainer.Pod @@ -285,3 +287,35 @@ func (m *kubeGenericRuntimeManager) getSeccompProfile(annotations map[string]str ProfileType: runtimeapi.SecurityProfile_Unconfined, }, nil } + +func getAppArmorProfile(pod *v1.Pod, container *v1.Container) (*runtimeapi.SecurityProfile, error) { + profile := apparmor.GetProfile(pod, container) + if profile == nil { + return nil, nil + } + + switch profile.Type { + case v1.AppArmorProfileTypeRuntimeDefault: + return &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_RuntimeDefault, + }, nil + + case v1.AppArmorProfileTypeUnconfined: + return &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, nil + + case v1.AppArmorProfileTypeLocalhost: + if profile.LocalhostProfile == nil { + return nil, errors.New("missing localhost apparmor profile name") + } + return &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Localhost, + LocalhostRef: *profile.LocalhostProfile, + }, nil + + default: + // Shouldn't happen. + return nil, fmt.Errorf("unknown apparmor profile type: %q", profile.Type) + } +} diff --git a/pkg/kubelet/kuberuntime/helpers_test.go b/pkg/kubelet/kuberuntime/helpers_test.go index b2032d0d99e..8eb7ded1a70 100644 --- a/pkg/kubelet/kuberuntime/helpers_test.go +++ b/pkg/kubelet/kuberuntime/helpers_test.go @@ -31,6 +31,7 @@ import ( runtimetesting "k8s.io/cri-api/pkg/apis/testing" "k8s.io/kubernetes/pkg/features" kubecontainer "k8s.io/kubernetes/pkg/kubelet/container" + "k8s.io/utils/ptr" ) type podStatusProviderFunc func(uid types.UID, name, namespace string) (*kubecontainer.PodStatus, error) @@ -363,3 +364,75 @@ func TestToKubeContainerState(t *testing.T) { }) } } + +func TestGetAppArmorProfile(t *testing.T) { + tests := []struct { + name string + podProfile *v1.AppArmorProfile + expectedProfile *runtimeapi.SecurityProfile + expectError bool + }{{ + name: "no appArmor", + expectedProfile: nil, + }, { + name: "runtime default", + podProfile: &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeRuntimeDefault}, + expectedProfile: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_RuntimeDefault, + }, + }, { + name: "unconfined", + podProfile: &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeUnconfined}, + expectedProfile: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Unconfined, + }, + }, { + name: "localhost", + podProfile: &v1.AppArmorProfile{ + Type: v1.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("test"), + }, + expectedProfile: &runtimeapi.SecurityProfile{ + ProfileType: runtimeapi.SecurityProfile_Localhost, + LocalhostRef: "test", + }, + }, { + name: "invalid localhost", + podProfile: &v1.AppArmorProfile{ + Type: v1.AppArmorProfileTypeLocalhost, + }, + expectError: true, + }, { + name: "invalid type", + podProfile: &v1.AppArmorProfile{ + Type: "foo", + }, + expectError: true, + }} + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + pod := v1.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "bar", + }, + Spec: v1.PodSpec{ + SecurityContext: &v1.PodSecurityContext{ + AppArmorProfile: test.podProfile, + }, + Containers: []v1.Container{{Name: "foo"}}, + }, + } + + actual, err := getAppArmorProfile(&pod, &pod.Spec.Containers[0]) + + if test.expectError { + assert.Error(t, err) + } else { + assert.NoError(t, err) + } + + assert.Equal(t, test.expectedProfile, actual) + }) + } +} diff --git a/pkg/kubelet/kuberuntime/security_context.go b/pkg/kubelet/kuberuntime/security_context.go index 7db21ed74f0..e7cde1e38a0 100644 --- a/pkg/kubelet/kuberuntime/security_context.go +++ b/pkg/kubelet/kuberuntime/security_context.go @@ -20,7 +20,6 @@ import ( v1 "k8s.io/api/core/v1" runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1" runtimeutil "k8s.io/kubernetes/pkg/kubelet/kuberuntime/util" - "k8s.io/kubernetes/pkg/security/apparmor" "k8s.io/kubernetes/pkg/securitycontext" ) @@ -42,7 +41,10 @@ func (m *kubeGenericRuntimeManager) determineEffectiveSecurityContext(pod *v1.Po } // set ApparmorProfile. - synthesized.ApparmorProfile = apparmor.GetProfileNameFromPodAnnotations(pod.Annotations, container.Name) + synthesized.Apparmor, err = getAppArmorProfile(pod, container) + if err != nil { + return nil, err + } // set RunAsUser. if synthesized.RunAsUser == nil { diff --git a/pkg/security/apparmor/helpers.go b/pkg/security/apparmor/helpers.go index 55203a470db..148a70019ee 100644 --- a/pkg/security/apparmor/helpers.go +++ b/pkg/security/apparmor/helpers.go @@ -19,11 +19,29 @@ package apparmor import ( "strings" - "k8s.io/api/core/v1" + v1 "k8s.io/api/core/v1" + podutil "k8s.io/kubernetes/pkg/api/v1/pod" ) -// Checks whether app armor is required for pod to be run. +// Checks whether app armor is required for the pod to run. AppArmor is considered required if any +// non-unconfined profiles are specified. func isRequired(pod *v1.Pod) bool { + if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.AppArmorProfile != nil && + pod.Spec.SecurityContext.AppArmorProfile.Type != v1.AppArmorProfileTypeUnconfined { + return true + } + + inUse := !podutil.VisitContainers(&pod.Spec, podutil.AllContainers, func(c *v1.Container, _ podutil.ContainerType) bool { + if c.SecurityContext != nil && c.SecurityContext.AppArmorProfile != nil && + c.SecurityContext.AppArmorProfile.Type != v1.AppArmorProfileTypeUnconfined { + return false // is in use; short-circuit + } + return true + }) + if inUse { + return true + } + for key, value := range pod.Annotations { if strings.HasPrefix(key, v1.AppArmorBetaContainerAnnotationKeyPrefix) { return value != v1.AppArmorBetaProfileNameUnconfined @@ -33,12 +51,49 @@ func isRequired(pod *v1.Pod) bool { } // GetProfileName returns the name of the profile to use with the container. -func GetProfileName(pod *v1.Pod, containerName string) string { - return GetProfileNameFromPodAnnotations(pod.Annotations, containerName) +func GetProfile(pod *v1.Pod, container *v1.Container) *v1.AppArmorProfile { + if container.SecurityContext != nil && container.SecurityContext.AppArmorProfile != nil { + return container.SecurityContext.AppArmorProfile + } + + // Static pods may not have had annotations synced to fields, so fallback to annotations before + // the pod profile. + if profile := getProfileFromPodAnnotations(pod.Annotations, container.Name); profile != nil { + return profile + } + + if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.AppArmorProfile != nil { + return pod.Spec.SecurityContext.AppArmorProfile + } + + return nil } -// GetProfileNameFromPodAnnotations gets the name of the profile to use with container from -// pod annotations -func GetProfileNameFromPodAnnotations(annotations map[string]string, containerName string) string { - return annotations[v1.AppArmorBetaContainerAnnotationKeyPrefix+containerName] +// getProfileFromPodAnnotations gets the AppArmor profile to use with container from +// (deprecated) pod annotations. +func getProfileFromPodAnnotations(annotations map[string]string, containerName string) *v1.AppArmorProfile { + val, ok := annotations[v1.AppArmorBetaContainerAnnotationKeyPrefix+containerName] + if !ok { + return nil + } + + switch { + case val == v1.AppArmorBetaProfileRuntimeDefault: + return &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeRuntimeDefault} + + case val == v1.AppArmorBetaProfileNameUnconfined: + return &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeUnconfined} + + case strings.HasPrefix(val, v1.AppArmorBetaProfileNamePrefix): + // Note: an invalid empty localhost profile will be rejected by kubelet admission. + profileName := strings.TrimPrefix(val, v1.AppArmorBetaProfileNamePrefix) + return &v1.AppArmorProfile{ + Type: v1.AppArmorProfileTypeLocalhost, + LocalhostProfile: &profileName, + } + + default: + // Invalid annotation. + return nil + } } diff --git a/pkg/security/apparmor/helpers_test.go b/pkg/security/apparmor/helpers_test.go new file mode 100644 index 00000000000..df9e4ff9b17 --- /dev/null +++ b/pkg/security/apparmor/helpers_test.go @@ -0,0 +1,124 @@ +/* +Copyright 2024 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package apparmor + +import ( + "testing" + + "github.com/stretchr/testify/assert" + v1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func TestGetProfile(t *testing.T) { + runtimeDefault := &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeRuntimeDefault} + unconfined := &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeUnconfined} + localhost := &v1.AppArmorProfile{ + Type: v1.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("test"), + } + + tests := []struct { + name string + annotationProfile string + containerProfile *v1.AppArmorProfile + podProfile *v1.AppArmorProfile + expectedProfile *v1.AppArmorProfile + }{{ + name: "no appArmor", + expectedProfile: nil, + }, { + name: "pod profile", + podProfile: runtimeDefault, + expectedProfile: runtimeDefault, + }, { + name: "container profile", + containerProfile: unconfined, + expectedProfile: unconfined, + }, { + name: "annotation profile", + annotationProfile: v1.AppArmorBetaProfileNamePrefix + "test", + expectedProfile: localhost, + }, { + name: "invalid annotation", + annotationProfile: "invalid", + expectedProfile: nil, + }, { + name: "invalid annotation with pod field", + annotationProfile: "invalid", + podProfile: runtimeDefault, + expectedProfile: runtimeDefault, + }, { + name: "container field before annotation", + annotationProfile: v1.AppArmorBetaProfileNameUnconfined, + containerProfile: runtimeDefault, + expectedProfile: runtimeDefault, + }, { + name: "container field before pod field", + containerProfile: runtimeDefault, + podProfile: unconfined, + expectedProfile: runtimeDefault, + }, { + name: "annotation before pod field", + annotationProfile: v1.AppArmorBetaProfileNameUnconfined, + podProfile: runtimeDefault, + expectedProfile: unconfined, + }, { + name: "all profiles", + annotationProfile: v1.AppArmorBetaProfileRuntimeDefault, + containerProfile: localhost, + podProfile: unconfined, + expectedProfile: localhost, + }} + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + container := v1.Container{ + Name: "foo", + } + if test.containerProfile != nil { + container.SecurityContext = &v1.SecurityContext{ + AppArmorProfile: test.containerProfile.DeepCopy(), + } + } + pod := v1.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "bar", + Annotations: map[string]string{ + "unrelated": "baz", + v1.AppArmorBetaContainerAnnotationKeyPrefix + "other": v1.AppArmorBetaProfileRuntimeDefault, + }, + }, + Spec: v1.PodSpec{ + Containers: []v1.Container{container}, + }, + } + if test.annotationProfile != "" { + pod.Annotations[v1.AppArmorBetaContainerAnnotationKeyPrefix+container.Name] = test.annotationProfile + } + if test.podProfile != nil { + pod.Spec.SecurityContext = &v1.PodSecurityContext{ + AppArmorProfile: test.podProfile.DeepCopy(), + } + } + + actual := GetProfile(&pod, &container) + assert.Equal(t, test.expectedProfile, actual) + }) + } +} diff --git a/pkg/security/apparmor/validate.go b/pkg/security/apparmor/validate.go index 23b637e535e..ef0caaea0c0 100644 --- a/pkg/security/apparmor/validate.go +++ b/pkg/security/apparmor/validate.go @@ -25,7 +25,6 @@ import ( v1 "k8s.io/api/core/v1" utilfeature "k8s.io/apiserver/pkg/util/feature" podutil "k8s.io/kubernetes/pkg/api/v1/pod" - "k8s.io/kubernetes/pkg/apis/core/validation" "k8s.io/kubernetes/pkg/features" ) @@ -62,15 +61,15 @@ func (v *validator) Validate(pod *v1.Pod) error { var retErr error podutil.VisitContainers(&pod.Spec, podutil.AllContainers, func(container *v1.Container, containerType podutil.ContainerType) bool { - profile := GetProfileName(pod, container.Name) - retErr = validation.ValidateAppArmorProfileFormat(profile) - if retErr != nil { - return false + profile := GetProfile(pod, container) + if profile == nil { + return true } + // TODO(#64841): This would ideally be part of validation.ValidateAppArmorProfileFormat, but // that is called for API validation, and this is tightening validation. - if strings.HasPrefix(profile, v1.AppArmorBetaProfileNamePrefix) { - if strings.TrimSpace(strings.TrimPrefix(profile, v1.AppArmorBetaProfileNamePrefix)) == "" { + if profile.Type == v1.AppArmorProfileTypeLocalhost { + if profile.LocalhostProfile == nil || strings.TrimSpace(*profile.LocalhostProfile) == "" { retErr = fmt.Errorf("invalid empty AppArmor profile name: %q", profile) return false } diff --git a/pkg/security/apparmor/validate_test.go b/pkg/security/apparmor/validate_test.go index 1c59e6a59f2..1dee7ff9071 100644 --- a/pkg/security/apparmor/validate_test.go +++ b/pkg/security/apparmor/validate_test.go @@ -64,7 +64,6 @@ func TestValidateValidHost(t *testing.T) { {v1.AppArmorBetaProfileNamePrefix + "docker-default", true}, {v1.AppArmorBetaProfileNamePrefix + "foo-container", true}, {v1.AppArmorBetaProfileNamePrefix + "/usr/sbin/ntpd", true}, - {"docker-default", false}, {v1.AppArmorBetaProfileNamePrefix + "", false}, // Empty profile explicitly forbidden. {v1.AppArmorBetaProfileNamePrefix + " ", false}, } From 207a965b3fffc1f816441588c8e640a587a8e613 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 21 Feb 2024 11:58:54 -0800 Subject: [PATCH 05/12] Update AppArmor e2e tests --- test/e2e/framework/security/apparmor.go | 29 +++++++++++++++------- test/e2e/node/apparmor.go | 33 ++++++++++++++++++++++--- test/e2e/upgrades/node/apparmor.go | 6 +++-- 3 files changed, 54 insertions(+), 14 deletions(-) diff --git a/test/e2e/framework/security/apparmor.go b/test/e2e/framework/security/apparmor.go index 82f093289a5..cb218d239dc 100644 --- a/test/e2e/framework/security/apparmor.go +++ b/test/e2e/framework/security/apparmor.go @@ -48,8 +48,8 @@ func LoadAppArmorProfiles(ctx context.Context, nsName string, clientset clientse // CreateAppArmorTestPod creates a pod that tests apparmor profile enforcement. The pod exits with // an error code if the profile is incorrectly enforced. If runOnce is true the pod will exit after // a single test, otherwise it will repeat the test every 1 second until failure. -func CreateAppArmorTestPod(ctx context.Context, nsName string, clientset clientset.Interface, podClient *e2epod.PodClient, unconfined bool, runOnce bool) *v1.Pod { - profile := "localhost/" + appArmorProfilePrefix + nsName +func AppArmorTestPod(nsName string, unconfined bool, runOnce bool) *v1.Pod { + localhostProfile := appArmorProfilePrefix + nsName testCmd := fmt.Sprintf(` if touch %[1]s; then echo "FAILURE: write to %[1]s should be denied" @@ -64,7 +64,6 @@ elif [[ $(< /proc/self/attr/current) != "%[3]s" ]]; then fi`, appArmorDeniedPath, appArmorAllowedPath, appArmorProfilePrefix+nsName) if unconfined { - profile = v1.AppArmorBetaProfileNameUnconfined testCmd = ` if cat /proc/sysrq-trigger 2>&1 | grep 'Permission denied'; then echo 'FAILURE: reading /proc/sysrq-trigger should be allowed' @@ -94,17 +93,25 @@ done`, testCmd) }, } + profile := &v1.AppArmorProfile{} + if unconfined { + profile.Type = v1.AppArmorProfileTypeUnconfined + } else { + profile.Type = v1.AppArmorProfileTypeLocalhost + profile.LocalhostProfile = &localhostProfile + } + pod := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ GenerateName: "test-apparmor-", - Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "test": profile, - }, Labels: map[string]string{ "test": "apparmor", }, }, Spec: v1.PodSpec{ + SecurityContext: &v1.PodSecurityContext{ + AppArmorProfile: profile, + }, Affinity: loaderAffinity, Containers: []v1.Container{{ Name: "test", @@ -115,20 +122,24 @@ done`, testCmd) }, } + return pod +} + +func RunAppArmorTestPod(ctx context.Context, pod *v1.Pod, clientset clientset.Interface, podClient *e2epod.PodClient, runOnce bool) *v1.Pod { if runOnce { pod = podClient.Create(ctx, pod) framework.ExpectNoError(e2epod.WaitForPodSuccessInNamespace(ctx, - clientset, pod.Name, nsName)) + clientset, pod.Name, pod.Namespace)) var err error pod, err = podClient.Get(ctx, pod.Name, metav1.GetOptions{}) framework.ExpectNoError(err) } else { pod = podClient.CreateSync(ctx, pod) - framework.ExpectNoError(e2epod.WaitTimeoutForPodReadyInNamespace(ctx, clientset, pod.Name, nsName, framework.PodStartTimeout)) + framework.ExpectNoError(e2epod.WaitTimeoutForPodReadyInNamespace(ctx, clientset, pod.Name, pod.Namespace, framework.PodStartTimeout)) } // Verify Pod affinity colocated the Pods. - loader := getRunningLoaderPod(ctx, nsName, clientset) + loader := getRunningLoaderPod(ctx, pod.Namespace, clientset) gomega.Expect(pod.Spec.NodeName).To(gomega.Equal(loader.Spec.NodeName)) return pod diff --git a/test/e2e/node/apparmor.go b/test/e2e/node/apparmor.go index 2d84d7de33a..dc36c256596 100644 --- a/test/e2e/node/apparmor.go +++ b/test/e2e/node/apparmor.go @@ -19,6 +19,7 @@ package node import ( "context" + v1 "k8s.io/api/core/v1" "k8s.io/kubernetes/test/e2e/framework" e2ekubectl "k8s.io/kubernetes/test/e2e/framework/kubectl" e2epod "k8s.io/kubernetes/test/e2e/framework/pod" @@ -45,12 +46,38 @@ var _ = SIGDescribe("AppArmor", func() { e2ekubectl.LogFailedContainers(ctx, f.ClientSet, f.Namespace.Name, framework.Logf) }) - ginkgo.It("should enforce an AppArmor profile", func(ctx context.Context) { - e2esecurity.CreateAppArmorTestPod(ctx, f.Namespace.Name, f.ClientSet, e2epod.NewPodClient(f), false, true) + ginkgo.It("should enforce an AppArmor profile specified on the pod", func(ctx context.Context) { + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, true) + e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), true) + }) + + ginkgo.It("should enforce an AppArmor profile specified on the container", func(ctx context.Context) { + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, true) + // Move AppArmor profile to the container. + pod.Spec.Containers[0].SecurityContext = &v1.SecurityContext{ + AppArmorProfile: pod.Spec.SecurityContext.AppArmorProfile, + } + pod.Spec.SecurityContext = nil + + e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), true) + }) + + ginkgo.It("should enforce an AppArmor profile specified in annotations", func(ctx context.Context) { + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, true) + // Move AppArmor profile to the annotations. + profile := pod.Spec.SecurityContext.AppArmorProfile + key := v1.AppArmorBetaContainerAnnotationKeyPrefix + pod.Spec.Containers[0].Name + pod.Annotations = map[string]string{ + key: v1.AppArmorBetaProfileNamePrefix + *profile.LocalhostProfile, + } + pod.Spec.SecurityContext = nil + + e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), true) }) ginkgo.It("can disable an AppArmor profile, using unconfined", func(ctx context.Context) { - e2esecurity.CreateAppArmorTestPod(ctx, f.Namespace.Name, f.ClientSet, e2epod.NewPodClient(f), true, true) + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, true, true) + e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), true) }) }) }) diff --git a/test/e2e/upgrades/node/apparmor.go b/test/e2e/upgrades/node/apparmor.go index 8470f7ce4bc..6a94c4d65be 100644 --- a/test/e2e/upgrades/node/apparmor.go +++ b/test/e2e/upgrades/node/apparmor.go @@ -63,7 +63,8 @@ func (t *AppArmorUpgradeTest) Setup(ctx context.Context, f *framework.Framework) // Create the initial test pod. ginkgo.By("Creating a long-running AppArmor enabled pod.") - t.pod = e2esecurity.CreateAppArmorTestPod(ctx, f.Namespace.Name, f.ClientSet, e2epod.NewPodClient(f), false, false) + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, false) + t.pod = e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), false) // Verify initial state. t.verifyNodesAppArmorEnabled(ctx, f) @@ -99,7 +100,8 @@ func (t *AppArmorUpgradeTest) verifyPodStillUp(ctx context.Context, f *framework func (t *AppArmorUpgradeTest) verifyNewPodSucceeds(ctx context.Context, f *framework.Framework) { ginkgo.By("Verifying an AppArmor profile is enforced for a new pod") - e2esecurity.CreateAppArmorTestPod(ctx, f.Namespace.Name, f.ClientSet, e2epod.NewPodClient(f), false, true) + pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, true) + t.pod = e2esecurity.RunAppArmorTestPod(ctx, pod, f.ClientSet, e2epod.NewPodClient(f), true) } func (t *AppArmorUpgradeTest) verifyNodesAppArmorEnabled(ctx context.Context, f *framework.Framework) { From 24537a91317f9fd125ee805cd0b781358ac86f35 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 21 Feb 2024 13:11:07 -0800 Subject: [PATCH 06/12] Stop appending AppArmor status to node ready condition --- pkg/kubelet/kubelet_node_status.go | 6 +----- pkg/kubelet/nodestatus/setters.go | 8 -------- pkg/kubelet/nodestatus/setters_test.go | 16 +--------------- .../pkg/util/managedfields/node.yaml | 2 +- .../endpoints/handlers/fieldmanager/node.yaml | 2 +- 5 files changed, 4 insertions(+), 30 deletions(-) diff --git a/pkg/kubelet/kubelet_node_status.go b/pkg/kubelet/kubelet_node_status.go index 7723abc64b2..46bd7c3579f 100644 --- a/pkg/kubelet/kubelet_node_status.go +++ b/pkg/kubelet/kubelet_node_status.go @@ -732,10 +732,6 @@ func (kl *Kubelet) defaultNodeStatusFuncs() []func(context.Context, *v1.Node) er if kl.cloud != nil { nodeAddressesFunc = kl.cloudResourceSyncManager.NodeAddresses } - var validateHostFunc func() error - if kl.appArmorValidator != nil { - validateHostFunc = kl.appArmorValidator.ValidateHost - } var setters []func(ctx context.Context, n *v1.Node) error setters = append(setters, nodestatus.NodeAddress(kl.nodeIPs, kl.nodeIPValidator, kl.hostname, kl.hostnameOverridden, kl.externalCloudProvider, kl.cloud, nodeAddressesFunc), @@ -754,7 +750,7 @@ func (kl *Kubelet) defaultNodeStatusFuncs() []func(context.Context, *v1.Node) er nodestatus.DiskPressureCondition(kl.clock.Now, kl.evictionManager.IsUnderDiskPressure, kl.recordNodeStatusEvent), nodestatus.PIDPressureCondition(kl.clock.Now, kl.evictionManager.IsUnderPIDPressure, kl.recordNodeStatusEvent), nodestatus.ReadyCondition(kl.clock.Now, kl.runtimeState.runtimeErrors, kl.runtimeState.networkErrors, kl.runtimeState.storageErrors, - validateHostFunc, kl.containerManager.Status, kl.shutdownManager.ShutdownStatus, kl.recordNodeStatusEvent, kl.supportLocalStorageCapacityIsolation()), + kl.containerManager.Status, kl.shutdownManager.ShutdownStatus, kl.recordNodeStatusEvent, kl.supportLocalStorageCapacityIsolation()), nodestatus.VolumesInUse(kl.volumeManager.ReconcilerStatesHasBeenSynced, kl.volumeManager.GetVolumesInUse), // TODO(mtaufen): I decided not to move this setter for now, since all it does is send an event // and record state back to the Kubelet runtime object. In the future, I'd like to isolate diff --git a/pkg/kubelet/nodestatus/setters.go b/pkg/kubelet/nodestatus/setters.go index b539cbda86b..58a5eb3c1a8 100644 --- a/pkg/kubelet/nodestatus/setters.go +++ b/pkg/kubelet/nodestatus/setters.go @@ -486,7 +486,6 @@ func ReadyCondition( runtimeErrorsFunc func() error, // typically Kubelet.runtimeState.runtimeErrors networkErrorsFunc func() error, // typically Kubelet.runtimeState.networkErrors storageErrorsFunc func() error, // typically Kubelet.runtimeState.storageErrors - appArmorValidateHostFunc func() error, // typically Kubelet.appArmorValidator.ValidateHost, might be nil depending on whether there was an appArmorValidator cmStatusFunc func() cm.Status, // typically Kubelet.containerManager.Status nodeShutdownManagerErrorsFunc func() error, // typically kubelet.shutdownManager.errors. recordEventFunc func(eventType, event string), // typically Kubelet.recordNodeStatusEvent @@ -527,13 +526,6 @@ func ReadyCondition( LastHeartbeatTime: currentTime, } } - // Append AppArmor status if it's enabled. - // TODO(tallclair): This is a temporary message until node feature reporting is added. - if appArmorValidateHostFunc != nil && newNodeReadyCondition.Status == v1.ConditionTrue { - if err := appArmorValidateHostFunc(); err == nil { - newNodeReadyCondition.Message = fmt.Sprintf("%s. AppArmor enabled", newNodeReadyCondition.Message) - } - } // Record any soft requirements that were not met in the container manager. status := cmStatusFunc() diff --git a/pkg/kubelet/nodestatus/setters_test.go b/pkg/kubelet/nodestatus/setters_test.go index 61a42feaa96..d3874bfee9c 100644 --- a/pkg/kubelet/nodestatus/setters_test.go +++ b/pkg/kubelet/nodestatus/setters_test.go @@ -1509,7 +1509,6 @@ func TestReadyCondition(t *testing.T) { runtimeErrors error networkErrors error storageErrors error - appArmorValidateHostFunc func() error cmStatus cm.Status nodeShutdownManagerErrors error expectConditions []v1.NodeCondition @@ -1524,19 +1523,6 @@ func TestReadyCondition(t *testing.T) { // the reason for this is unclear, so we may want to actually send an event, and change these test cases // to ensure an event is sent. }, - { - desc: "new, ready: apparmor validator passed", - node: withCapacity.DeepCopy(), - appArmorValidateHostFunc: func() error { return nil }, - expectConditions: []v1.NodeCondition{*makeReadyCondition(true, "kubelet is posting ready status. AppArmor enabled", now, now)}, - }, - { - desc: "new, ready: apparmor validator failed", - node: withCapacity.DeepCopy(), - appArmorValidateHostFunc: func() error { return fmt.Errorf("foo") }, - // absence of an additional message is understood to mean that AppArmor is disabled - expectConditions: []v1.NodeCondition{*makeReadyCondition(true, "kubelet is posting ready status", now, now)}, - }, { desc: "new, ready: soft requirement warning", node: withCapacity.DeepCopy(), @@ -1655,7 +1641,7 @@ func TestReadyCondition(t *testing.T) { }) } // construct setter - setter := ReadyCondition(nowFunc, runtimeErrorsFunc, networkErrorsFunc, storageErrorsFunc, tc.appArmorValidateHostFunc, cmStatusFunc, nodeShutdownErrorsFunc, recordEventFunc, !tc.disableLocalStorageCapacityIsolation) + setter := ReadyCondition(nowFunc, runtimeErrorsFunc, networkErrorsFunc, storageErrorsFunc, cmStatusFunc, nodeShutdownErrorsFunc, recordEventFunc, !tc.disableLocalStorageCapacityIsolation) // call setter on node if err := setter(ctx, tc.node); err != nil { t.Fatalf("unexpected error: %v", err) diff --git a/staging/src/k8s.io/apimachinery/pkg/util/managedfields/node.yaml b/staging/src/k8s.io/apimachinery/pkg/util/managedfields/node.yaml index 66e849f23fb..a7f2d54fdf7 100644 --- a/staging/src/k8s.io/apimachinery/pkg/util/managedfields/node.yaml +++ b/staging/src/k8s.io/apimachinery/pkg/util/managedfields/node.yaml @@ -120,7 +120,7 @@ status: type: PIDPressure - lastHeartbeatTime: "2019-09-20T19:32:50Z" lastTransitionTime: "2019-07-09T16:17:49Z" - message: kubelet is posting ready status. AppArmor enabled + message: kubelet is posting ready status reason: KubeletReady status: "True" type: Ready diff --git a/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml b/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml index 66e849f23fb..a7f2d54fdf7 100644 --- a/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml +++ b/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/node.yaml @@ -120,7 +120,7 @@ status: type: PIDPressure - lastHeartbeatTime: "2019-09-20T19:32:50Z" lastTransitionTime: "2019-07-09T16:17:49Z" - message: kubelet is posting ready status. AppArmor enabled + message: kubelet is posting ready status reason: KubeletReady status: "True" type: Ready From d25b1ded761dba71c6d02b5df5ce46612d25c144 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 21 Feb 2024 21:49:50 -0800 Subject: [PATCH 07/12] PodSecurity check for AppArmor fields --- .../policy/check_appArmorProfile.go | 80 ++++++++-- .../policy/check_appArmorProfile_test.go | 140 ++++++++++++++---- 2 files changed, 179 insertions(+), 41 deletions(-) diff --git a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go index b4942a884cf..c4342b81c57 100644 --- a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go +++ b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go @@ -23,6 +23,7 @@ import ( corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/sets" "k8s.io/pod-security-admission/api" ) @@ -35,6 +36,14 @@ profile, or restrict overrides to an allowed set of profiles. metadata.annotations['container.apparmor.security.beta.kubernetes.io/*'] **Allowed Values:** 'runtime/default', 'localhost/*', empty, undefined + +**Restricted Fields:** +spec.securityContext.appArmorProfile.type +spec.containers[*].securityContext.appArmorProfile.type +spec.initContainers[*].securityContext.appArmorProfile.type +spec.ephemeralContainers[*].securityContext.appArmorProfile.type + +**Allowed Values:** 'RuntimeDefault', 'Localhost', undefined */ func init() { addCheck(CheckAppArmorProfile) @@ -55,25 +64,78 @@ func CheckAppArmorProfile() Check { } } -func allowedProfile(profile string) bool { +func allowedAnnotationValue(profile string) bool { return len(profile) == 0 || profile == corev1.AppArmorBetaProfileRuntimeDefault || strings.HasPrefix(profile, corev1.AppArmorBetaProfileNamePrefix) } +func allowedProfileType(profile corev1.AppArmorProfileType) bool { + switch profile { + case corev1.AppArmorProfileTypeRuntimeDefault, + corev1.AppArmorProfileTypeLocalhost: + return true + default: + return false + } +} + func appArmorProfile_1_0(podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSpec) CheckResult { - var forbiddenValues []string - for k, v := range podMetadata.Annotations { - if strings.HasPrefix(k, corev1.AppArmorBetaContainerAnnotationKeyPrefix) && !allowedProfile(v) { - forbiddenValues = append(forbiddenValues, fmt.Sprintf("%s=%q", k, v)) + var badSetters []string // things that explicitly set appArmorProfile.type to a bad value + badValues := sets.NewString() + + if podSpec.SecurityContext != nil && podSpec.SecurityContext.AppArmorProfile != nil { + if !allowedProfileType(podSpec.SecurityContext.AppArmorProfile.Type) { + badSetters = append(badSetters, "pod") + badValues.Insert(string(podSpec.SecurityContext.AppArmorProfile.Type)) } } - if len(forbiddenValues) > 0 { - sort.Strings(forbiddenValues) + + var badContainers []string // containers that set apparmorProfile.type to a bad value + visitContainers(podSpec, func(c *corev1.Container) { + if c.SecurityContext != nil && c.SecurityContext.AppArmorProfile != nil { + if !allowedProfileType(c.SecurityContext.AppArmorProfile.Type) { + badContainers = append(badContainers, c.Name) + badValues.Insert(string(c.SecurityContext.AppArmorProfile.Type)) + } + } + }) + + if len(badContainers) > 0 { + badSetters = append( + badSetters, + fmt.Sprintf( + "%s %s", + pluralize("container", "containers", len(badContainers)), + joinQuote(badContainers), + ), + ) + } + + var forbiddenAnnotations []string + for k, v := range podMetadata.Annotations { + if strings.HasPrefix(k, corev1.AppArmorBetaContainerAnnotationKeyPrefix) && !allowedAnnotationValue(v) { + forbiddenAnnotations = append(forbiddenAnnotations, fmt.Sprintf("%s=%q", k, v)) + } + } + + badValueList := badValues.List() + if len(forbiddenAnnotations) > 0 { + sort.Strings(forbiddenAnnotations) + badValueList = append(badValueList, forbiddenAnnotations...) + badSetters = append(badSetters, pluralize("annotation", "annotations", len(forbiddenAnnotations))) + } + + // pod or containers explicitly set bad apparmorProfiles + if len(badSetters) > 0 { return CheckResult{ Allowed: false, - ForbiddenReason: pluralize("forbidden AppArmor profile", "forbidden AppArmor profiles", len(forbiddenValues)), - ForbiddenDetail: strings.Join(forbiddenValues, ", "), + ForbiddenReason: pluralize("forbidden AppArmor profile", "forbidden AppArmor profiles", len(badValueList)), + ForbiddenDetail: fmt.Sprintf( + "%s must not set AppArmor profile type to %s", + strings.Join(badSetters, " and "), + joinQuote(badValueList), + ), } } diff --git a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go index e16b3312b4d..91295ef913f 100644 --- a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go +++ b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go @@ -24,69 +24,145 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) -func TestCheckAppArmor(t *testing.T) { - +func TestCheckAppArmor_Allowed(t *testing.T) { testCases := []struct { - name string - metaData *metav1.ObjectMeta - podSpec *corev1.PodSpec - expectedResult *CheckResult + name string + metaData *metav1.ObjectMeta + podSpec *corev1.PodSpec }{ { name: "container with default AppArmor + extra annotations", metaData: &metav1.ObjectMeta{Annotations: map[string]string{ corev1.AppArmorBetaProfileNamePrefix + "test": "runtime/default", "env": "prod", - }, - }, - podSpec: &corev1.PodSpec{}, - expectedResult: &CheckResult{Allowed: true}, + }}, + podSpec: &corev1.PodSpec{}, }, { name: "container with local AppArmor + extra annotations", metaData: &metav1.ObjectMeta{Annotations: map[string]string{ corev1.AppArmorBetaProfileNamePrefix + "test": "localhost/sec-profile01", "env": "dev", - }, - }, - podSpec: &corev1.PodSpec{}, - expectedResult: &CheckResult{Allowed: true}, + }}, + podSpec: &corev1.PodSpec{}, }, { name: "container with no AppArmor annotations", metaData: &metav1.ObjectMeta{Annotations: map[string]string{ "env": "dev", - }, - }, - podSpec: &corev1.PodSpec{}, - expectedResult: &CheckResult{Allowed: true}, + }}, + podSpec: &corev1.PodSpec{}, }, { - name: "container with no annotations", - metaData: &metav1.ObjectMeta{}, - podSpec: &corev1.PodSpec{}, - expectedResult: &CheckResult{Allowed: true}, + name: "container with no annotations", + metaData: &metav1.ObjectMeta{}, + podSpec: &corev1.PodSpec{}, + }, + { + name: "pod with runtime default", + metaData: &metav1.ObjectMeta{}, + podSpec: &corev1.PodSpec{ + SecurityContext: &corev1.PodSecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeRuntimeDefault, + }, + }, + }, + }, + { + name: "container with localhost profile", + metaData: &metav1.ObjectMeta{}, + podSpec: &corev1.PodSpec{ + Containers: []corev1.Container{{ + Name: "foo", + SecurityContext: &corev1.SecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeRuntimeDefault, + }, + }, + }}, + }, }, } for _, testCase := range testCases { t.Run(testCase.name, func(t *testing.T) { - result := appArmorProfile_1_0(testCase.metaData, nil) - if result.Allowed != testCase.expectedResult.Allowed { - t.Errorf("Expected result was Allowed=%v for annotations %v", - testCase.expectedResult.Allowed, testCase.metaData.Annotations) + result := appArmorProfile_1_0(testCase.metaData, testCase.podSpec) + if !result.Allowed { + t.Errorf("Should be allowed") } }) } } -func TestAppArmorProfile(t *testing.T) { +func TestCheckAppArmor_Forbidden(t *testing.T) { tests := []struct { name string pod *corev1.Pod expectReason string expectDetail string }{ + { + name: "unconfined pod", + pod: &corev1.Pod{ + Spec: corev1.PodSpec{ + SecurityContext: &corev1.PodSecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeUnconfined, + }, + }, + }, + }, + expectReason: "forbidden AppArmor profile", + expectDetail: `pod must not set AppArmor profile type to "Unconfined"`, + }, + { + name: "unconfined container", + pod: &corev1.Pod{ + Spec: corev1.PodSpec{ + SecurityContext: &corev1.PodSecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []corev1.Container{{ + Name: "foo", + SecurityContext: &corev1.SecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeUnconfined, + }, + }, + }}, + }, + }, + expectReason: "forbidden AppArmor profile", + expectDetail: `container "foo" must not set AppArmor profile type to "Unconfined"`, + }, + { + name: "unconfined init container", + pod: &corev1.Pod{ + Spec: corev1.PodSpec{ + SecurityContext: &corev1.PodSecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []corev1.Container{{ + Name: "foo", + }}, + InitContainers: []corev1.Container{{ + Name: "bar", + SecurityContext: &corev1.SecurityContext{ + AppArmorProfile: &corev1.AppArmorProfile{ + Type: corev1.AppArmorProfileTypeUnconfined, + }, + }, + }}, + }, + }, + expectReason: "forbidden AppArmor profile", + expectDetail: `container "bar" must not set AppArmor profile type to "Unconfined"`, + }, { name: "multiple containers", pod: &corev1.Pod{ @@ -102,11 +178,11 @@ func TestAppArmorProfile(t *testing.T) { }, }, }, - expectReason: `forbidden AppArmor profiles`, - expectDetail: strings.Join([]string{ - `container.apparmor.security.beta.kubernetes.io/="bogus"`, - `container.apparmor.security.beta.kubernetes.io/e="unconfined"`, - `container.apparmor.security.beta.kubernetes.io/f="unknown"`, + expectReason: "forbidden AppArmor profiles", + expectDetail: "annotations must not set AppArmor profile type to " + strings.Join([]string{ + `"container.apparmor.security.beta.kubernetes.io/="bogus""`, + `"container.apparmor.security.beta.kubernetes.io/e="unconfined""`, + `"container.apparmor.security.beta.kubernetes.io/f="unknown""`, }, ", "), }, } From ec325b328db35e1d135b83ce477f89b1810795ab Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Thu, 29 Feb 2024 12:06:04 -0800 Subject: [PATCH 08/12] Match annotations against pod AppArmor field --- pkg/apis/core/validation/validation.go | 66 +++++------- pkg/apis/core/validation/validation_test.go | 42 ++++++++ pkg/registry/core/pod/strategy.go | 17 +-- pkg/registry/core/pod/strategy_test.go | 114 ++++++++++++++++++-- 4 files changed, 183 insertions(+), 56 deletions(-) diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index d5479dfaeca..35d1eb7ddc6 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -4729,8 +4729,8 @@ func ValidateAppArmorProfileFormat(profile string) error { return nil } -// validateAppArmorAnnotationsAndFields validates that AppArmor fields and annotations are consistent. -func validateAppArmorAnnotationsAndFields(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { +// validateAppArmorAnnotationsAndFieldsMatchOnCreate validates that AppArmor fields and annotations are consistent. +func validateAppArmorAnnotationsAndFieldsMatchOnCreate(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { if podSpec.OS != nil && podSpec.OS.Name == core.Windows { // Skip consistency check for windows pods. return nil @@ -4738,22 +4738,41 @@ func validateAppArmorAnnotationsAndFields(objectMeta metav1.ObjectMeta, podSpec allErrs := field.ErrorList{} + var podProfile *core.AppArmorProfile + if podSpec.SecurityContext != nil { + podProfile = podSpec.SecurityContext.AppArmorProfile + } podshelper.VisitContainersWithPath(podSpec, specPath, func(c *core.Container, cFldPath *field.Path) bool { - var field *core.AppArmorProfile - if c.SecurityContext != nil { - field = c.SecurityContext.AppArmorProfile + containerProfile := podProfile + if c.SecurityContext != nil && c.SecurityContext.AppArmorProfile != nil { + containerProfile = c.SecurityContext.AppArmorProfile } - if field == nil { + if containerProfile == nil { return true } key := core.AppArmorContainerAnnotationKeyPrefix + c.Name if annotation, found := objectMeta.Annotations[key]; found { apparmorPath := cFldPath.Child("securityContext").Child("appArmorProfile") - err := validateAppArmorAnnotationsAndFieldsMatch(annotation, field, apparmorPath) - if err != nil { - allErrs = append(allErrs, err) + + switch containerProfile.Type { + case core.AppArmorProfileTypeUnconfined: + if annotation != core.AppArmorProfileNameUnconfined { + allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) + } + + case core.AppArmorProfileTypeRuntimeDefault: + if annotation != core.AppArmorProfileRuntimeDefault { + allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) + } + + case core.AppArmorProfileTypeLocalhost: + if !strings.HasPrefix(annotation, core.AppArmorProfileLocalhostPrefix) { + allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) + } else if containerProfile.LocalhostProfile == nil || strings.TrimPrefix(annotation, core.AppArmorProfileLocalhostPrefix) != *containerProfile.LocalhostProfile { + allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("localhostProfile"), "apparmor profile in annotation and field must match")) + } } } return true @@ -4762,33 +4781,6 @@ func validateAppArmorAnnotationsAndFields(objectMeta metav1.ObjectMeta, podSpec return allErrs } -func validateAppArmorAnnotationsAndFieldsMatch(annotationValue string, apparmorField *core.AppArmorProfile, fldPath *field.Path) *field.Error { - if apparmorField == nil { - return nil - } - - switch apparmorField.Type { - case core.AppArmorProfileTypeUnconfined: - if annotationValue != core.AppArmorProfileNameUnconfined { - return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") - } - - case core.AppArmorProfileTypeRuntimeDefault: - if annotationValue != core.AppArmorProfileRuntimeDefault { - return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") - } - - case core.AppArmorProfileTypeLocalhost: - if !strings.HasPrefix(annotationValue, core.AppArmorProfileLocalhostPrefix) { - return field.Forbidden(fldPath.Child("type"), "apparmor type in annotation and field must match") - } else if apparmorField.LocalhostProfile == nil || strings.TrimPrefix(annotationValue, core.AppArmorProfileLocalhostPrefix) != *apparmorField.LocalhostProfile { - return field.Forbidden(fldPath.Child("localhostProfile"), "apparmor profile in annotation and field must match") - } - } - - return nil -} - func podSpecHasContainer(spec *core.PodSpec, containerName string) bool { var hasContainer bool podshelper.VisitContainersWithPath(spec, field.NewPath("spec"), func(c *core.Container, _ *field.Path) bool { @@ -4943,7 +4935,7 @@ func ValidatePodCreate(pod *core.Pod, opts PodValidationOptions) field.ErrorList allErrs = append(allErrs, field.Forbidden(fldPath.Child("nodeName"), "cannot be set until all schedulingGates have been cleared")) } allErrs = append(allErrs, validateSeccompAnnotationsAndFields(pod.ObjectMeta, &pod.Spec, fldPath)...) - allErrs = append(allErrs, validateAppArmorAnnotationsAndFields(pod.ObjectMeta, &pod.Spec, fldPath)...) + allErrs = append(allErrs, validateAppArmorAnnotationsAndFieldsMatchOnCreate(pod.ObjectMeta, &pod.Spec, fldPath)...) return allErrs } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index d87015678d5..9e722e30aa4 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -10446,6 +10446,26 @@ func TestValidatePod(t *testing.T) { DNSPolicy: core.DNSDefault, }, }, + "matching AppArmor pod field and annotations": { + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + }, + }, + Spec: core.PodSpec{ + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To("foo"), + }, + }, + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, "syntactically valid sysctls": { ObjectMeta: metav1.ObjectMeta{ Name: "123", @@ -12162,6 +12182,28 @@ func TestValidatePod(t *testing.T) { }, }, }, + "mismatched AppArmor pod field and annotation types": { + expectedError: "Forbidden: apparmor type in annotation and field must match", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + Annotations: map[string]string{ + core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileRuntimeDefault, + }, + }, + Spec: core.PodSpec{ + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeUnconfined, + }, + }, + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + }, + }, + }, "mismatched AppArmor localhost profiles": { expectedError: "Forbidden: apparmor profile in annotation and field must match", spec: core.Pod{ diff --git a/pkg/registry/core/pod/strategy.go b/pkg/registry/core/pod/strategy.go index e2c6a204efc..346688387dc 100644 --- a/pkg/registry/core/pod/strategy.go +++ b/pkg/registry/core/pod/strategy.go @@ -27,6 +27,7 @@ import ( "time" apiv1 "k8s.io/api/core/v1" + apiequality "k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/fields" @@ -779,17 +780,16 @@ func applyAppArmorVersionSkew(pod *api.Pod) { key := api.AppArmorContainerAnnotationKeyPrefix + ctr.Name annotation, hasAnnotation := pod.Annotations[key] - field, hasField := (*api.AppArmorProfile)(nil), false - if ctr.SecurityContext != nil && ctr.SecurityContext.AppArmorProfile != nil { - field = ctr.SecurityContext.AppArmorProfile - hasField = true + var containerProfile *api.AppArmorProfile + if ctr.SecurityContext != nil { + containerProfile = ctr.SecurityContext.AppArmorProfile } // sync field and annotation if !hasAnnotation { newAnnotation := "" - if hasField { - newAnnotation = appArmorAnnotationForField(field) + if containerProfile != nil { + newAnnotation = appArmorAnnotationForField(containerProfile) } else if podProfile != nil { newAnnotation = appArmorAnnotationForField(podProfile) } @@ -800,10 +800,11 @@ func applyAppArmorVersionSkew(pod *api.Pod) { } pod.Annotations[key] = newAnnotation } - } else if !hasField { + } else if containerProfile == nil { newField := apparmorFieldForAnnotation(annotation) - if newField != nil { + // Only copy the annotation to the field if it is different from the pod-level profile. + if newField != nil && !apiequality.Semantic.DeepEqual(newField, podProfile) { if ctr.SecurityContext == nil { ctr.SecurityContext = &api.SecurityContext{} } diff --git a/pkg/registry/core/pod/strategy_test.go b/pkg/registry/core/pod/strategy_test.go index 19c8f6a1739..e7ac79a201e 100644 --- a/pkg/registry/core/pod/strategy_test.go +++ b/pkg/registry/core/pod/strategy_test.go @@ -2141,7 +2141,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Nil(t, pod.Spec.SecurityContext.AppArmorProfile) }, }, { - description: "Field type unconfined and no annotation present", + description: "Pod field unconfined and no annotation present", pod: &api.Pod{ Spec: api.PodSpec{ SecurityContext: &api.PodSecurityContext{ @@ -2160,7 +2160,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, pod.Annotations) }, }, { - description: "Field type default and no annotation present", + description: "Pod field default and no annotation present", pod: &api.Pod{ Spec: api.PodSpec{ SecurityContext: &api.PodSecurityContext{ @@ -2179,7 +2179,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, pod.Annotations) }, }, { - description: "Field type localhost and no annotation present", + description: "Pod field localhost and no annotation present", pod: &api.Pod{ Spec: api.PodSpec{ SecurityContext: &api.PodSecurityContext{ @@ -2199,7 +2199,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, pod.Annotations) }, }, { - description: "Field type localhost but profile is nil", + description: "Pod field localhost but profile is nil", pod: &api.Pod{ Spec: api.PodSpec{ SecurityContext: &api.PodSecurityContext{ @@ -2215,7 +2215,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Len(t, pod.Annotations, 0) }, }, { - description: "Security context not nil (container)", + description: "Container security context not nil", pod: &api.Pod{ Spec: api.PodSpec{ Containers: []api.Container{{ @@ -2228,7 +2228,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Len(t, pod.Annotations, 0) }, }, { - description: "Field type RuntimeDefault and no annotation present (container)", + description: "Container field RuntimeDefault and no annotation present", pod: &api.Pod{ Spec: api.PodSpec{ Containers: []api.Container{{ @@ -2249,7 +2249,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) }, }, { - description: "Field type localhost and no annotation present (container)", + description: "Container field localhost and no annotation present", pod: &api.Pod{ Spec: api.PodSpec{ Containers: []api.Container{{ @@ -2341,7 +2341,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[2].SecurityContext.AppArmorProfile.Type) }, }, { - description: "Annotation 'unconfined' and no field present (container)", + description: "Annotation 'unconfined' and no fields present", pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ @@ -2380,7 +2380,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Nil(t, pod.Spec.SecurityContext) }, }, { - description: "Annotation 'runtime/default' and no field present (container)", + description: "Annotation 'runtime/default' and no fields present", pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ @@ -2408,7 +2408,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.SecurityContext.AppArmorProfile.Type) }, }, { - description: "Multiple containers by annotations (container)", + description: "Multiple containers by annotations", pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ @@ -2442,7 +2442,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) assert.Equal(t, testProfile, *pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) assert.Nil(t, pod.Spec.Containers[1].SecurityContext) - assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[2].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[2].SecurityContext) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) }, }, { @@ -2472,6 +2472,98 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) assert.Nil(t, pod.Spec.SecurityContext) }, + }, { + description: "Pod field and matching annotations", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, + }, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []api.Container{{ + Name: "ctr", + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) + // Annotation shouldn't be synced to container security context + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + }, + }, { + description: "Annotation overrides pod field", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, + }, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []api.Container{{ + Name: "ctr", + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + }, + }, { + description: "Mixed annotations and fields", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "unconf-annot": api.AppArmorProfileNameUnconfined, + }, + }, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + Containers: []api.Container{{ + Name: "unconf-annot", + }, { + Name: "unconf-field", + SecurityContext: &api.SecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeUnconfined, + }, + }, + }, { + Name: "default-pod", + }}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Equal(t, map[string]string{ + api.AppArmorContainerAnnotationKeyPrefix + "unconf-annot": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "unconf-field": api.AppArmorProfileNameUnconfined, + api.AppArmorContainerAnnotationKeyPrefix + "default-pod": api.AppArmorProfileRuntimeDefault, + }, pod.Annotations) + assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) + assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[1].SecurityContext.AppArmorProfile.Type) + assert.Nil(t, pod.Spec.Containers[2].SecurityContext) + }, }, { description: "Invalid annotation value", pod: &api.Pod{ From 0eb5f52d06fd6b6d34f1d7f0da74b9873c06afd2 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Mon, 4 Mar 2024 10:06:42 -0800 Subject: [PATCH 09/12] Rename AppArmor annotation constants with Deprecated --- pkg/api/pod/util.go | 4 +- pkg/api/pod/util_test.go | 2 +- pkg/apis/core/annotation_key_constants.go | 16 ++-- pkg/apis/core/validation/validation.go | 22 +++--- pkg/apis/core/validation/validation_test.go | 10 +-- pkg/registry/core/pod/strategy.go | 16 ++-- pkg/registry/core/pod/strategy_test.go | 78 +++++++++---------- pkg/security/apparmor/helpers.go | 14 ++-- pkg/security/apparmor/helpers_test.go | 12 +-- pkg/security/apparmor/validate_test.go | 24 +++--- .../api/core/v1/annotation_key_constants.go | 16 ++-- .../policy/check_appArmorProfile.go | 6 +- .../policy/check_appArmorProfile_test.go | 4 +- .../test/fixtures_appArmorProfile.go | 8 +- test/e2e/node/apparmor.go | 4 +- test/e2e_node/apparmor_test.go | 10 +-- 16 files changed, 123 insertions(+), 123 deletions(-) diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go index dc7d96ddb17..82853271bb4 100644 --- a/pkg/api/pod/util.go +++ b/pkg/api/pod/util.go @@ -541,7 +541,7 @@ func dropDisabledFields( if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorInUse(oldPodAnnotations, oldPodSpec) { for k := range podAnnotations { - if strings.HasPrefix(k, api.AppArmorContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) { delete(podAnnotations, k) } } @@ -954,7 +954,7 @@ func appArmorInUse(podAnnotations map[string]string, podSpec *api.PodSpec) bool } for k := range podAnnotations { - if strings.HasPrefix(k, api.AppArmorContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) { return true } } diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go index 81604556526..8a3139adf15 100644 --- a/pkg/api/pod/util_test.go +++ b/pkg/api/pod/util_test.go @@ -714,7 +714,7 @@ func TestDropAppArmor(t *testing.T) { description: "with AppArmor Annotations", hasAppArmor: true, pod: api.Pod{ - ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.AppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, Spec: api.PodSpec{}, }, }, { diff --git a/pkg/apis/core/annotation_key_constants.go b/pkg/apis/core/annotation_key_constants.go index de7d73fa9d2..c97002e863a 100644 --- a/pkg/apis/core/annotation_key_constants.go +++ b/pkg/apis/core/annotation_key_constants.go @@ -52,18 +52,18 @@ const ( // Deprecated: set a pod or container security context `seccompProfile` of type "RuntimeDefault" instead. DeprecatedSeccompProfileDockerDefault string = "docker/default" - // AppArmorContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. + // DeprecatedAppArmorAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. // Deprecated: use a pod or container security context `appArmorProfile` field instead. - AppArmorContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" + DeprecatedAppArmorAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" - // AppArmorProfileRuntimeDefault is the profile specifying the runtime default. - AppArmorProfileRuntimeDefault = "runtime/default" + // DeprecatedAppArmorAnnotationValueRuntimeDefault is the profile specifying the runtime default. + DeprecatedAppArmorAnnotationValueRuntimeDefault = "runtime/default" - // AppArmorProfileLocalhostPrefix is the prefix for specifying profiles loaded on the node. - AppArmorProfileLocalhostPrefix = "localhost/" + // DeprecatedAppArmorAnnotationValueLocalhostPrefix is the prefix for specifying profiles loaded on the node. + DeprecatedAppArmorAnnotationValueLocalhostPrefix = "localhost/" - // AppArmorProfileNameUnconfined is the Unconfined AppArmor profile - AppArmorProfileNameUnconfined = "unconfined" + // DeprecatedAppArmorAnnotationValueUnconfined is the Unconfined AppArmor profile + DeprecatedAppArmorAnnotationValueUnconfined = "unconfined" // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized) // in the Annotations of a Node. diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 35d1eb7ddc6..003746c3185 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -204,7 +204,7 @@ func ValidatePodSpecificAnnotationUpdates(newPod, oldPod *core.Pod, fldPath *fie if newVal, exists := newAnnotations[k]; exists && newVal == oldVal { continue // No change. } - if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) { allErrs = append(allErrs, field.Forbidden(fldPath.Key(k), "may not remove or update AppArmor annotations")) } if k == core.MirrorPodAnnotationKey { @@ -216,7 +216,7 @@ func ValidatePodSpecificAnnotationUpdates(newPod, oldPod *core.Pod, fldPath *fie if _, ok := oldAnnotations[k]; ok { continue // No change. } - if strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) { + if strings.HasPrefix(k, v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) { allErrs = append(allErrs, field.Forbidden(fldPath.Key(k), "may not add AppArmor annotations")) } if k == core.MirrorPodAnnotationKey { @@ -4703,10 +4703,10 @@ func validateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field. func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *core.PodSpec, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} for k, p := range annotations { - if !strings.HasPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) { + if !strings.HasPrefix(k, v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) { continue } - containerName := strings.TrimPrefix(k, v1.AppArmorBetaContainerAnnotationKeyPrefix) + containerName := strings.TrimPrefix(k, v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) if !podSpecHasContainer(spec, containerName) { allErrs = append(allErrs, field.Invalid(fldPath.Key(k), containerName, "container not found")) } @@ -4720,10 +4720,10 @@ func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *core.Po } func ValidateAppArmorProfileFormat(profile string) error { - if profile == "" || profile == v1.AppArmorBetaProfileRuntimeDefault || profile == v1.AppArmorBetaProfileNameUnconfined { + if profile == "" || profile == v1.DeprecatedAppArmorBetaProfileRuntimeDefault || profile == v1.DeprecatedAppArmorBetaProfileNameUnconfined { return nil } - if !strings.HasPrefix(profile, v1.AppArmorBetaProfileNamePrefix) { + if !strings.HasPrefix(profile, v1.DeprecatedAppArmorBetaProfileNamePrefix) { return fmt.Errorf("invalid AppArmor profile name: %q", profile) } return nil @@ -4752,25 +4752,25 @@ func validateAppArmorAnnotationsAndFieldsMatchOnCreate(objectMeta metav1.ObjectM return true } - key := core.AppArmorContainerAnnotationKeyPrefix + c.Name + key := core.DeprecatedAppArmorAnnotationKeyPrefix + c.Name if annotation, found := objectMeta.Annotations[key]; found { apparmorPath := cFldPath.Child("securityContext").Child("appArmorProfile") switch containerProfile.Type { case core.AppArmorProfileTypeUnconfined: - if annotation != core.AppArmorProfileNameUnconfined { + if annotation != core.DeprecatedAppArmorAnnotationValueUnconfined { allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) } case core.AppArmorProfileTypeRuntimeDefault: - if annotation != core.AppArmorProfileRuntimeDefault { + if annotation != core.DeprecatedAppArmorAnnotationValueRuntimeDefault { allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) } case core.AppArmorProfileTypeLocalhost: - if !strings.HasPrefix(annotation, core.AppArmorProfileLocalhostPrefix) { + if !strings.HasPrefix(annotation, core.DeprecatedAppArmorAnnotationValueLocalhostPrefix) { allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("type"), "apparmor type in annotation and field must match")) - } else if containerProfile.LocalhostProfile == nil || strings.TrimPrefix(annotation, core.AppArmorProfileLocalhostPrefix) != *containerProfile.LocalhostProfile { + } else if containerProfile.LocalhostProfile == nil || strings.TrimPrefix(annotation, core.DeprecatedAppArmorAnnotationValueLocalhostPrefix) != *containerProfile.LocalhostProfile { allErrs = append(allErrs, field.Forbidden(apparmorPath.Child("localhostProfile"), "apparmor profile in annotation and field must match")) } } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 9e722e30aa4..e96dc5291e3 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -10430,7 +10430,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + core.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": core.DeprecatedAppArmorAnnotationValueLocalhostPrefix + "foo", }, }, Spec: core.PodSpec{ @@ -10451,7 +10451,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + core.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": core.DeprecatedAppArmorAnnotationValueLocalhostPrefix + "foo", }, }, Spec: core.PodSpec{ @@ -12166,7 +12166,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileRuntimeDefault, + core.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": core.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: core.PodSpec{ @@ -12189,7 +12189,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileRuntimeDefault, + core.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": core.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: core.PodSpec{ @@ -12211,7 +12211,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - core.AppArmorContainerAnnotationKeyPrefix + "ctr": core.AppArmorProfileLocalhostPrefix + "foo", + core.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": core.DeprecatedAppArmorAnnotationValueLocalhostPrefix + "foo", }, }, Spec: core.PodSpec{ diff --git a/pkg/registry/core/pod/strategy.go b/pkg/registry/core/pod/strategy.go index 346688387dc..76c572f9912 100644 --- a/pkg/registry/core/pod/strategy.go +++ b/pkg/registry/core/pod/strategy.go @@ -777,7 +777,7 @@ func applyAppArmorVersionSkew(pod *api.Pod) { podutil.VisitContainers(&pod.Spec, podutil.AllFeatureEnabledContainers(), func(ctr *api.Container, _ podutil.ContainerType) bool { // get possible annotation and field - key := api.AppArmorContainerAnnotationKeyPrefix + ctr.Name + key := api.DeprecatedAppArmorAnnotationKeyPrefix + ctr.Name annotation, hasAnnotation := pod.Annotations[key] var containerProfile *api.AppArmorProfile @@ -824,14 +824,14 @@ func appArmorAnnotationForField(field *api.AppArmorProfile) string { // trails the API version switch field.Type { case api.AppArmorProfileTypeUnconfined: - return api.AppArmorProfileNameUnconfined + return api.DeprecatedAppArmorAnnotationValueUnconfined case api.AppArmorProfileTypeRuntimeDefault: - return api.AppArmorProfileRuntimeDefault + return api.DeprecatedAppArmorAnnotationValueRuntimeDefault case api.AppArmorProfileTypeLocalhost: if field.LocalhostProfile != nil { - return api.AppArmorProfileLocalhostPrefix + *field.LocalhostProfile + return api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + *field.LocalhostProfile } } @@ -844,16 +844,16 @@ func appArmorAnnotationForField(field *api.AppArmorProfile) string { // apparmorFieldForAnnotation takes a pod annotation and returns the converted // apparmor profile field. func apparmorFieldForAnnotation(annotation string) *api.AppArmorProfile { - if annotation == api.AppArmorProfileNameUnconfined { + if annotation == api.DeprecatedAppArmorAnnotationValueUnconfined { return &api.AppArmorProfile{Type: api.AppArmorProfileTypeUnconfined} } - if annotation == api.AppArmorProfileRuntimeDefault { + if annotation == api.DeprecatedAppArmorAnnotationValueRuntimeDefault { return &api.AppArmorProfile{Type: api.AppArmorProfileTypeRuntimeDefault} } - if strings.HasPrefix(annotation, api.AppArmorProfileLocalhostPrefix) { - localhostProfile := strings.TrimPrefix(annotation, api.AppArmorProfileLocalhostPrefix) + if strings.HasPrefix(annotation, api.DeprecatedAppArmorAnnotationValueLocalhostPrefix) { + localhostProfile := strings.TrimPrefix(annotation, api.DeprecatedAppArmorAnnotationValueLocalhostPrefix) if localhostProfile != "" { return &api.AppArmorProfile{ Type: api.AppArmorProfileTypeLocalhost, diff --git a/pkg/registry/core/pod/strategy_test.go b/pkg/registry/core/pod/strategy_test.go index e7ac79a201e..064955ddd08 100644 --- a/pkg/registry/core/pod/strategy_test.go +++ b/pkg/registry/core/pod/strategy_test.go @@ -2155,8 +2155,8 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, pod.Annotations) }, }, { @@ -2174,8 +2174,8 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileRuntimeDefault, - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) }, }, { @@ -2194,8 +2194,8 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileLocalhostPrefix + testProfile, - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, }, pod.Annotations) }, }, { @@ -2243,7 +2243,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Nil(t, pod.Spec.SecurityContext) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2265,7 +2265,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, }, pod.Annotations) assert.Nil(t, pod.Spec.SecurityContext) assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2291,7 +2291,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2330,9 +2330,9 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileLocalhostPrefix + testProfile, - api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "a": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "c": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Nil(t, pod.Spec.SecurityContext) assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.InitContainers[0].SecurityContext.AppArmorProfile.Type) @@ -2345,7 +2345,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, }, Spec: api.PodSpec{ @@ -2354,7 +2354,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) @@ -2365,7 +2365,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "foo-bar": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "foo-bar": api.DeprecatedAppArmorAnnotationValueUnconfined, }, }, Spec: api.PodSpec{ @@ -2374,7 +2374,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "foo-bar": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "foo-bar": api.DeprecatedAppArmorAnnotationValueUnconfined, }, pod.Annotations) assert.Nil(t, pod.Spec.Containers[0].SecurityContext) assert.Nil(t, pod.Spec.SecurityContext) @@ -2384,7 +2384,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: api.PodSpec{ @@ -2401,7 +2401,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) @@ -2412,9 +2412,9 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileLocalhostPrefix + testProfile, - api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "a": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "c": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: api.PodSpec{ @@ -2433,10 +2433,10 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "init": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "a": api.AppArmorProfileLocalhostPrefix + testProfile, - api.AppArmorContainerAnnotationKeyPrefix + "b": api.AppArmorProfileRuntimeDefault, - api.AppArmorContainerAnnotationKeyPrefix + "c": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "init": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "a": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "b": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "c": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.InitContainers[0].SecurityContext.AppArmorProfile.Type) assert.Equal(t, api.AppArmorProfileTypeLocalhost, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2450,7 +2450,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, }, }, Spec: api.PodSpec{ @@ -2466,7 +2466,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileLocalhostPrefix + testProfile, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) assert.Nil(t, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.LocalhostProfile) @@ -2477,7 +2477,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: api.PodSpec{ @@ -2493,7 +2493,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) // Annotation shouldn't be synced to container security context @@ -2504,7 +2504,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, }, Spec: api.PodSpec{ @@ -2520,7 +2520,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueUnconfined, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2530,7 +2530,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "unconf-annot": api.AppArmorProfileNameUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "unconf-annot": api.DeprecatedAppArmorAnnotationValueUnconfined, }, }, Spec: api.PodSpec{ @@ -2555,9 +2555,9 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "unconf-annot": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "unconf-field": api.AppArmorProfileNameUnconfined, - api.AppArmorContainerAnnotationKeyPrefix + "default-pod": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "unconf-annot": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "unconf-field": api.DeprecatedAppArmorAnnotationValueUnconfined, + api.DeprecatedAppArmorAnnotationKeyPrefix + "default-pod": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Equal(t, api.AppArmorProfileTypeRuntimeDefault, pod.Spec.SecurityContext.AppArmorProfile.Type) assert.Equal(t, api.AppArmorProfileTypeUnconfined, pod.Spec.Containers[0].SecurityContext.AppArmorProfile.Type) @@ -2569,7 +2569,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": "not-a-real-type", + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": "not-a-real-type", }, }, Spec: api.PodSpec{ @@ -2578,7 +2578,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": "not-a-real-type", + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": "not-a-real-type", }, pod.Annotations) assert.Nil(t, pod.Spec.Containers[0].SecurityContext) assert.Nil(t, pod.Spec.SecurityContext) @@ -2604,7 +2604,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { pod: &api.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, }, Spec: api.PodSpec{ @@ -2614,7 +2614,7 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { }, validation: func(t *testing.T, pod *api.Pod) { assert.Equal(t, map[string]string{ - api.AppArmorContainerAnnotationKeyPrefix + "ctr": api.AppArmorProfileRuntimeDefault, + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueRuntimeDefault, }, pod.Annotations) assert.Nil(t, pod.Spec.Containers[0].SecurityContext) }, diff --git a/pkg/security/apparmor/helpers.go b/pkg/security/apparmor/helpers.go index 148a70019ee..eeaa3955dd3 100644 --- a/pkg/security/apparmor/helpers.go +++ b/pkg/security/apparmor/helpers.go @@ -43,8 +43,8 @@ func isRequired(pod *v1.Pod) bool { } for key, value := range pod.Annotations { - if strings.HasPrefix(key, v1.AppArmorBetaContainerAnnotationKeyPrefix) { - return value != v1.AppArmorBetaProfileNameUnconfined + if strings.HasPrefix(key, v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) { + return value != v1.DeprecatedAppArmorBetaProfileNameUnconfined } } return false @@ -72,21 +72,21 @@ func GetProfile(pod *v1.Pod, container *v1.Container) *v1.AppArmorProfile { // getProfileFromPodAnnotations gets the AppArmor profile to use with container from // (deprecated) pod annotations. func getProfileFromPodAnnotations(annotations map[string]string, containerName string) *v1.AppArmorProfile { - val, ok := annotations[v1.AppArmorBetaContainerAnnotationKeyPrefix+containerName] + val, ok := annotations[v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+containerName] if !ok { return nil } switch { - case val == v1.AppArmorBetaProfileRuntimeDefault: + case val == v1.DeprecatedAppArmorBetaProfileRuntimeDefault: return &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeRuntimeDefault} - case val == v1.AppArmorBetaProfileNameUnconfined: + case val == v1.DeprecatedAppArmorBetaProfileNameUnconfined: return &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeUnconfined} - case strings.HasPrefix(val, v1.AppArmorBetaProfileNamePrefix): + case strings.HasPrefix(val, v1.DeprecatedAppArmorBetaProfileNamePrefix): // Note: an invalid empty localhost profile will be rejected by kubelet admission. - profileName := strings.TrimPrefix(val, v1.AppArmorBetaProfileNamePrefix) + profileName := strings.TrimPrefix(val, v1.DeprecatedAppArmorBetaProfileNamePrefix) return &v1.AppArmorProfile{ Type: v1.AppArmorProfileTypeLocalhost, LocalhostProfile: &profileName, diff --git a/pkg/security/apparmor/helpers_test.go b/pkg/security/apparmor/helpers_test.go index df9e4ff9b17..5c4ff98d08d 100644 --- a/pkg/security/apparmor/helpers_test.go +++ b/pkg/security/apparmor/helpers_test.go @@ -52,7 +52,7 @@ func TestGetProfile(t *testing.T) { expectedProfile: unconfined, }, { name: "annotation profile", - annotationProfile: v1.AppArmorBetaProfileNamePrefix + "test", + annotationProfile: v1.DeprecatedAppArmorBetaProfileNamePrefix + "test", expectedProfile: localhost, }, { name: "invalid annotation", @@ -65,7 +65,7 @@ func TestGetProfile(t *testing.T) { expectedProfile: runtimeDefault, }, { name: "container field before annotation", - annotationProfile: v1.AppArmorBetaProfileNameUnconfined, + annotationProfile: v1.DeprecatedAppArmorBetaProfileNameUnconfined, containerProfile: runtimeDefault, expectedProfile: runtimeDefault, }, { @@ -75,12 +75,12 @@ func TestGetProfile(t *testing.T) { expectedProfile: runtimeDefault, }, { name: "annotation before pod field", - annotationProfile: v1.AppArmorBetaProfileNameUnconfined, + annotationProfile: v1.DeprecatedAppArmorBetaProfileNameUnconfined, podProfile: runtimeDefault, expectedProfile: unconfined, }, { name: "all profiles", - annotationProfile: v1.AppArmorBetaProfileRuntimeDefault, + annotationProfile: v1.DeprecatedAppArmorBetaProfileRuntimeDefault, containerProfile: localhost, podProfile: unconfined, expectedProfile: localhost, @@ -101,7 +101,7 @@ func TestGetProfile(t *testing.T) { Name: "bar", Annotations: map[string]string{ "unrelated": "baz", - v1.AppArmorBetaContainerAnnotationKeyPrefix + "other": v1.AppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "other": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, }, }, Spec: v1.PodSpec{ @@ -109,7 +109,7 @@ func TestGetProfile(t *testing.T) { }, } if test.annotationProfile != "" { - pod.Annotations[v1.AppArmorBetaContainerAnnotationKeyPrefix+container.Name] = test.annotationProfile + pod.Annotations[v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+container.Name] = test.annotationProfile } if test.podProfile != nil { pod.Spec.SecurityContext = &v1.PodSecurityContext{ diff --git a/pkg/security/apparmor/validate_test.go b/pkg/security/apparmor/validate_test.go index 1dee7ff9071..58cf7d93fd8 100644 --- a/pkg/security/apparmor/validate_test.go +++ b/pkg/security/apparmor/validate_test.go @@ -38,8 +38,8 @@ func TestValidateBadHost(t *testing.T) { expectValid bool }{ {"", true}, - {v1.AppArmorBetaProfileRuntimeDefault, false}, - {v1.AppArmorBetaProfileNamePrefix + "docker-default", false}, + {v1.DeprecatedAppArmorBetaProfileRuntimeDefault, false}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "docker-default", false}, } for _, test := range tests { @@ -60,12 +60,12 @@ func TestValidateValidHost(t *testing.T) { expectValid bool }{ {"", true}, - {v1.AppArmorBetaProfileRuntimeDefault, true}, - {v1.AppArmorBetaProfileNamePrefix + "docker-default", true}, - {v1.AppArmorBetaProfileNamePrefix + "foo-container", true}, - {v1.AppArmorBetaProfileNamePrefix + "/usr/sbin/ntpd", true}, - {v1.AppArmorBetaProfileNamePrefix + "", false}, // Empty profile explicitly forbidden. - {v1.AppArmorBetaProfileNamePrefix + " ", false}, + {v1.DeprecatedAppArmorBetaProfileRuntimeDefault, true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "docker-default", true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "foo-container", true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "/usr/sbin/ntpd", true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "", false}, // Empty profile explicitly forbidden. + {v1.DeprecatedAppArmorBetaProfileNamePrefix + " ", false}, } for _, test := range tests { @@ -81,9 +81,9 @@ func TestValidateValidHost(t *testing.T) { pod := &v1.Pod{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "init": v1.AppArmorBetaProfileNamePrefix + "foo-container", - v1.AppArmorBetaContainerAnnotationKeyPrefix + "test1": v1.AppArmorBetaProfileRuntimeDefault, - v1.AppArmorBetaContainerAnnotationKeyPrefix + "test2": v1.AppArmorBetaProfileNamePrefix + "docker-default", + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "init": v1.DeprecatedAppArmorBetaProfileNamePrefix + "foo-container", + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test1": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test2": v1.DeprecatedAppArmorBetaProfileNamePrefix + "docker-default", }, }, Spec: v1.PodSpec{ @@ -102,7 +102,7 @@ func TestValidateValidHost(t *testing.T) { func getPodWithProfile(profile string) *v1.Pod { annotations := map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "test": profile, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test": profile, } if profile == "" { annotations = map[string]string{ diff --git a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go index 4c6969e9fbb..5cf6f329f13 100644 --- a/staging/src/k8s.io/api/core/v1/annotation_key_constants.go +++ b/staging/src/k8s.io/api/core/v1/annotation_key_constants.go @@ -54,18 +54,18 @@ const ( // SeccompLocalhostProfileNamePrefix is the prefix for specifying profiles loaded from the node's disk. SeccompLocalhostProfileNamePrefix = "localhost/" - // AppArmorBetaContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. + // DeprecatedAppArmorBetaContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile. // Deprecated: use a pod or container security context `appArmorProfile` field instead. - AppArmorBetaContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" + DeprecatedAppArmorBetaContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/" - // AppArmorBetaProfileRuntimeDefault is the profile specifying the runtime default. - AppArmorBetaProfileRuntimeDefault = "runtime/default" + // DeprecatedAppArmorBetaProfileRuntimeDefault is the profile specifying the runtime default. + DeprecatedAppArmorBetaProfileRuntimeDefault = "runtime/default" - // AppArmorBetaProfileNamePrefix is the prefix for specifying profiles loaded on the node. - AppArmorBetaProfileNamePrefix = "localhost/" + // DeprecatedAppArmorBetaProfileNamePrefix is the prefix for specifying profiles loaded on the node. + DeprecatedAppArmorBetaProfileNamePrefix = "localhost/" - // AppArmorBetaProfileNameUnconfined is the Unconfined AppArmor profile - AppArmorBetaProfileNameUnconfined = "unconfined" + // DeprecatedAppArmorBetaProfileNameUnconfined is the Unconfined AppArmor profile + DeprecatedAppArmorBetaProfileNameUnconfined = "unconfined" // DeprecatedSeccompProfileDockerDefault represents the default seccomp profile used by docker. // Deprecated: set a pod or container security context `seccompProfile` of type "RuntimeDefault" instead. diff --git a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go index c4342b81c57..12794031161 100644 --- a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go +++ b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile.go @@ -66,8 +66,8 @@ func CheckAppArmorProfile() Check { func allowedAnnotationValue(profile string) bool { return len(profile) == 0 || - profile == corev1.AppArmorBetaProfileRuntimeDefault || - strings.HasPrefix(profile, corev1.AppArmorBetaProfileNamePrefix) + profile == corev1.DeprecatedAppArmorBetaProfileRuntimeDefault || + strings.HasPrefix(profile, corev1.DeprecatedAppArmorBetaProfileNamePrefix) } func allowedProfileType(profile corev1.AppArmorProfileType) bool { @@ -114,7 +114,7 @@ func appArmorProfile_1_0(podMetadata *metav1.ObjectMeta, podSpec *corev1.PodSpec var forbiddenAnnotations []string for k, v := range podMetadata.Annotations { - if strings.HasPrefix(k, corev1.AppArmorBetaContainerAnnotationKeyPrefix) && !allowedAnnotationValue(v) { + if strings.HasPrefix(k, corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix) && !allowedAnnotationValue(v) { forbiddenAnnotations = append(forbiddenAnnotations, fmt.Sprintf("%s=%q", k, v)) } } diff --git a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go index 91295ef913f..e07b7cd584f 100644 --- a/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go +++ b/staging/src/k8s.io/pod-security-admission/policy/check_appArmorProfile_test.go @@ -33,7 +33,7 @@ func TestCheckAppArmor_Allowed(t *testing.T) { { name: "container with default AppArmor + extra annotations", metaData: &metav1.ObjectMeta{Annotations: map[string]string{ - corev1.AppArmorBetaProfileNamePrefix + "test": "runtime/default", + corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test": "runtime/default", "env": "prod", }}, podSpec: &corev1.PodSpec{}, @@ -41,7 +41,7 @@ func TestCheckAppArmor_Allowed(t *testing.T) { { name: "container with local AppArmor + extra annotations", metaData: &metav1.ObjectMeta{Annotations: map[string]string{ - corev1.AppArmorBetaProfileNamePrefix + "test": "localhost/sec-profile01", + corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test": "localhost/sec-profile01", "env": "dev", }}, podSpec: &corev1.PodSpec{}, diff --git a/staging/src/k8s.io/pod-security-admission/test/fixtures_appArmorProfile.go b/staging/src/k8s.io/pod-security-admission/test/fixtures_appArmorProfile.go index 9b2a8199fff..1c9559609a4 100644 --- a/staging/src/k8s.io/pod-security-admission/test/fixtures_appArmorProfile.go +++ b/staging/src/k8s.io/pod-security-admission/test/fixtures_appArmorProfile.go @@ -32,10 +32,10 @@ func init() { // container with localhost/foo annotation tweak(pod, func(copy *corev1.Pod) { containerName := copy.Spec.Containers[0].Name - copy.Annotations[corev1.AppArmorBetaContainerAnnotationKeyPrefix+containerName] = "runtime/default" + copy.Annotations[corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+containerName] = "runtime/default" initContainerName := copy.Spec.Containers[0].Name - copy.Annotations[corev1.AppArmorBetaContainerAnnotationKeyPrefix+initContainerName] = "localhost/foo" + copy.Annotations[corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+initContainerName] = "localhost/foo" }), } }, @@ -45,13 +45,13 @@ func init() { // container with unconfined annotation tweak(pod, func(copy *corev1.Pod) { name := copy.Spec.Containers[0].Name - copy.Annotations[corev1.AppArmorBetaContainerAnnotationKeyPrefix+name] = "unconfined" + copy.Annotations[corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+name] = "unconfined" }), // initContainer with unconfined annotation tweak(pod, func(copy *corev1.Pod) { name := copy.Spec.InitContainers[0].Name - copy.Annotations[corev1.AppArmorBetaContainerAnnotationKeyPrefix+name] = "unconfined" + copy.Annotations[corev1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix+name] = "unconfined" }), } }, diff --git a/test/e2e/node/apparmor.go b/test/e2e/node/apparmor.go index dc36c256596..d77cbe2177c 100644 --- a/test/e2e/node/apparmor.go +++ b/test/e2e/node/apparmor.go @@ -66,9 +66,9 @@ var _ = SIGDescribe("AppArmor", func() { pod := e2esecurity.AppArmorTestPod(f.Namespace.Name, false, true) // Move AppArmor profile to the annotations. profile := pod.Spec.SecurityContext.AppArmorProfile - key := v1.AppArmorBetaContainerAnnotationKeyPrefix + pod.Spec.Containers[0].Name + key := v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + pod.Spec.Containers[0].Name pod.Annotations = map[string]string{ - key: v1.AppArmorBetaProfileNamePrefix + *profile.LocalhostProfile, + key: v1.DeprecatedAppArmorBetaProfileNamePrefix + *profile.LocalhostProfile, } pod.Spec.SecurityContext = nil diff --git a/test/e2e_node/apparmor_test.go b/test/e2e_node/apparmor_test.go index 8340a35e5e3..8e790098537 100644 --- a/test/e2e_node/apparmor_test.go +++ b/test/e2e_node/apparmor_test.go @@ -60,11 +60,11 @@ var _ = SIGDescribe("AppArmor", feature.AppArmor, nodefeature.AppArmor, func() { f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged ginkgo.It("should reject an unloaded profile", func(ctx context.Context) { - status := runAppArmorTest(ctx, f, false, v1.AppArmorBetaProfileNamePrefix+"non-existent-profile") + status := runAppArmorTest(ctx, f, false, v1.DeprecatedAppArmorBetaProfileNamePrefix+"non-existent-profile") gomega.Expect(status.ContainerStatuses[0].State.Waiting.Message).To(gomega.ContainSubstring("apparmor")) }) ginkgo.It("should enforce a profile blocking writes", func(ctx context.Context) { - status := runAppArmorTest(ctx, f, true, v1.AppArmorBetaProfileNamePrefix+apparmorProfilePrefix+"deny-write") + status := runAppArmorTest(ctx, f, true, v1.DeprecatedAppArmorBetaProfileNamePrefix+apparmorProfilePrefix+"deny-write") if len(status.ContainerStatuses) == 0 { framework.Failf("Unexpected pod status: %s", dump.Pretty(status)) return @@ -75,7 +75,7 @@ var _ = SIGDescribe("AppArmor", feature.AppArmor, nodefeature.AppArmor, func() { }) ginkgo.It("should enforce a permissive profile", func(ctx context.Context) { - status := runAppArmorTest(ctx, f, true, v1.AppArmorBetaProfileNamePrefix+apparmorProfilePrefix+"audit-write") + status := runAppArmorTest(ctx, f, true, v1.DeprecatedAppArmorBetaProfileNamePrefix+apparmorProfilePrefix+"audit-write") if len(status.ContainerStatuses) == 0 { framework.Failf("Unexpected pod status: %s", dump.Pretty(status)) return @@ -91,7 +91,7 @@ var _ = SIGDescribe("AppArmor", feature.AppArmor, nodefeature.AppArmor, func() { f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged ginkgo.It("should reject a pod with an AppArmor profile", func(ctx context.Context) { - status := runAppArmorTest(ctx, f, false, v1.AppArmorBetaProfileRuntimeDefault) + status := runAppArmorTest(ctx, f, false, v1.DeprecatedAppArmorBetaProfileRuntimeDefault) expectSoftRejection(status) }) }) @@ -214,7 +214,7 @@ func createPodWithAppArmor(ctx context.Context, f *framework.Framework, profile ObjectMeta: metav1.ObjectMeta{ Name: fmt.Sprintf("test-apparmor-%s", strings.Replace(profile, "/", "-", -1)), Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "test": profile, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "test": profile, }, }, Spec: v1.PodSpec{ From 06caf32ecd70df0f3b1a04946e76ce160a64626f Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Mon, 4 Mar 2024 10:41:20 -0800 Subject: [PATCH 10/12] Validate localhost profile max length --- pkg/apis/core/types.go | 1 + pkg/apis/core/validation/validation.go | 11 ++++-- pkg/apis/core/validation/validation_test.go | 44 +++++++++++++++------ pkg/registry/core/pod/strategy.go | 4 ++ pkg/registry/core/pod/strategy_test.go | 18 +++++++++ 5 files changed, 63 insertions(+), 15 deletions(-) diff --git a/pkg/apis/core/types.go b/pkg/apis/core/types.go index 2330cac7a6c..6057a04666e 100644 --- a/pkg/apis/core/types.go +++ b/pkg/apis/core/types.go @@ -3650,6 +3650,7 @@ type AppArmorProfile struct { LocalhostProfile *string } +// +enum type AppArmorProfileType string const ( diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 003746c3185..76c14dbeb84 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -4663,7 +4663,7 @@ func validateSeccompProfileType(fldPath *field.Path, seccompProfileType core.Sec } } -func validateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field.Path) field.ErrorList { +func ValidateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field.Path) field.ErrorList { if profile == nil { return nil } @@ -4681,6 +4681,11 @@ func validateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field. } else if localhostProfile == "" { allErrs = append(allErrs, field.Required(fldPath.Child("localhostProfile"), "must be set when AppArmor type is Localhost")) } + + const maxLocalhostProfileLength = 4095 // PATH_MAX - 1 + if len(*profile.LocalhostProfile) > maxLocalhostProfileLength { + allErrs = append(allErrs, field.TooLongMaxLength(fldPath.Child("localhostProfile"), *profile.LocalhostProfile, maxLocalhostProfileLength)) + } } case core.AppArmorProfileTypeRuntimeDefault, core.AppArmorProfileTypeUnconfined: @@ -4894,7 +4899,7 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp allErrs = append(allErrs, validateSeccompProfileField(securityContext.SeccompProfile, fldPath.Child("seccompProfile"))...) allErrs = append(allErrs, validateWindowsSecurityContextOptions(securityContext.WindowsOptions, fldPath.Child("windowsOptions"))...) - allErrs = append(allErrs, validateAppArmorProfileField(securityContext.AppArmorProfile, fldPath.Child("appArmorProfile"))...) + allErrs = append(allErrs, ValidateAppArmorProfileField(securityContext.AppArmorProfile, fldPath.Child("appArmorProfile"))...) } return allErrs @@ -7181,7 +7186,7 @@ func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path) fiel } allErrs = append(allErrs, validateWindowsSecurityContextOptions(sc.WindowsOptions, fldPath.Child("windowsOptions"))...) - allErrs = append(allErrs, validateAppArmorProfileField(sc.AppArmorProfile, fldPath.Child("appArmorProfile"))...) + allErrs = append(allErrs, ValidateAppArmorProfileField(sc.AppArmorProfile, fldPath.Child("appArmorProfile"))...) return allErrs } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index e96dc5291e3..abd0046b5ea 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -10294,7 +10294,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, }, }, Spec: validPodSpec(nil), @@ -10304,7 +10304,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.AppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, }, }, Spec: core.PodSpec{ @@ -10319,7 +10319,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileNamePrefix + "foo", + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.DeprecatedAppArmorBetaProfileNamePrefix + "foo", }, }, Spec: validPodSpec(nil), @@ -11983,9 +11983,9 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.AppArmorBetaProfileRuntimeDefault, - v1.AppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.AppArmorBetaProfileRuntimeDefault, - v1.AppArmorBetaContainerAnnotationKeyPrefix + "fake-ctr": v1.AppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "ctr": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "init-ctr": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "fake-ctr": v1.DeprecatedAppArmorBetaProfileRuntimeDefault, }, }, Spec: core.PodSpec{ @@ -12003,7 +12003,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": "bad-name", + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "ctr": "bad-name", }, }, Spec: validPodSpec(nil), @@ -12016,7 +12016,7 @@ func TestValidatePod(t *testing.T) { Name: "123", Namespace: "ns", Annotations: map[string]string{ - v1.AppArmorBetaContainerAnnotationKeyPrefix + "ctr": "runtime/foo", + v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "ctr": "runtime/foo", }, }, Spec: validPodSpec(nil), @@ -12159,6 +12159,26 @@ func TestValidatePod(t *testing.T) { }, }, }, + "too long AppArmor localhost profile": { + expectedError: "Too long: may not be longer than 4095", + spec: core.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Name: "123", + Namespace: "ns", + }, + Spec: core.PodSpec{ + Containers: []core.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: core.RestartPolicyAlways, + DNSPolicy: core.DNSDefault, + SecurityContext: &core.PodSecurityContext{ + AppArmorProfile: &core.AppArmorProfile{ + Type: core.AppArmorProfileTypeLocalhost, + LocalhostProfile: ptr.To(strings.Repeat("a", 4096)), + }, + }, + }, + }, + }, "mismatched AppArmor field and annotation types": { expectedError: "Forbidden: apparmor type in annotation and field must match", spec: core.Pod{ @@ -25186,11 +25206,11 @@ func TestValidateAppArmorProfileFormat(t *testing.T) { expectValid bool }{ {"", true}, - {v1.AppArmorBetaProfileRuntimeDefault, true}, - {v1.AppArmorBetaProfileNameUnconfined, true}, + {v1.DeprecatedAppArmorBetaProfileRuntimeDefault, true}, + {v1.DeprecatedAppArmorBetaProfileNameUnconfined, true}, {"baz", false}, // Missing local prefix. - {v1.AppArmorBetaProfileNamePrefix + "/usr/sbin/ntpd", true}, - {v1.AppArmorBetaProfileNamePrefix + "foo-bar", true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "/usr/sbin/ntpd", true}, + {v1.DeprecatedAppArmorBetaProfileNamePrefix + "foo-bar", true}, } for _, test := range tests { diff --git a/pkg/registry/core/pod/strategy.go b/pkg/registry/core/pod/strategy.go index 76c572f9912..927d15f69b0 100644 --- a/pkg/registry/core/pod/strategy.go +++ b/pkg/registry/core/pod/strategy.go @@ -802,6 +802,10 @@ func applyAppArmorVersionSkew(pod *api.Pod) { } } else if containerProfile == nil { newField := apparmorFieldForAnnotation(annotation) + if errs := corevalidation.ValidateAppArmorProfileField(newField, &field.Path{}); len(errs) > 0 { + // Skip copying invalid value. + newField = nil + } // Only copy the annotation to the field if it is different from the pod-level profile. if newField != nil && !apiequality.Semantic.DeepEqual(newField, podProfile) { diff --git a/pkg/registry/core/pod/strategy_test.go b/pkg/registry/core/pod/strategy_test.go index 064955ddd08..9b28597b107 100644 --- a/pkg/registry/core/pod/strategy_test.go +++ b/pkg/registry/core/pod/strategy_test.go @@ -22,6 +22,7 @@ import ( "net/http" "net/url" "reflect" + "strings" "testing" "github.com/google/go-cmp/cmp" @@ -2583,6 +2584,23 @@ func TestApplyAppArmorVersionSkew(t *testing.T) { assert.Nil(t, pod.Spec.Containers[0].SecurityContext) assert.Nil(t, pod.Spec.SecurityContext) }, + }, { + description: "Invalid localhost annotation", + pod: &api.Pod{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: map[string]string{ + api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr": api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + strings.Repeat("a", 4096), + }, + }, + Spec: api.PodSpec{ + Containers: []api.Container{{Name: "ctr"}}, + }, + }, + validation: func(t *testing.T, pod *api.Pod) { + assert.Contains(t, pod.Annotations, api.DeprecatedAppArmorAnnotationKeyPrefix+"ctr") + assert.Nil(t, pod.Spec.Containers[0].SecurityContext) + assert.Nil(t, pod.Spec.SecurityContext) + }, }, { description: "Invalid field type", pod: &api.Pod{ From 22068e0cc7bfbef40810fc9c64f9140ac2f0a594 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Mon, 4 Mar 2024 11:59:01 -0800 Subject: [PATCH 11/12] Validate annotation & field match in PodTemplate --- pkg/apis/core/validation/validation.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 76c14dbeb84..762735a75d6 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -5918,6 +5918,7 @@ func ValidatePodTemplateSpec(spec *core.PodTemplateSpec, fldPath *field.Path, op allErrs = append(allErrs, ValidatePodSpecificAnnotations(spec.Annotations, &spec.Spec, fldPath.Child("annotations"), opts)...) allErrs = append(allErrs, ValidatePodSpec(&spec.Spec, nil, fldPath.Child("spec"), opts)...) allErrs = append(allErrs, validateSeccompAnnotationsAndFields(spec.ObjectMeta, &spec.Spec, fldPath.Child("spec"))...) + allErrs = append(allErrs, validateAppArmorAnnotationsAndFieldsMatchOnCreate(spec.ObjectMeta, &spec.Spec, fldPath.Child("spec"))...) if len(spec.Spec.EphemeralContainers) > 0 { allErrs = append(allErrs, field.Forbidden(fldPath.Child("spec", "ephemeralContainers"), "ephemeral containers not allowed in pod template")) From 2d86cbf26168bca704689098eb6d5d03c2bdc45d Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Tue, 5 Mar 2024 17:04:36 -0800 Subject: [PATCH 12/12] Separate feature-gate for AppArmor fields --- pkg/api/pod/util.go | 20 +++--- pkg/api/pod/util_test.go | 85 ++++++++++++++++---------- pkg/apis/core/validation/validation.go | 3 + pkg/features/kube_features.go | 6 ++ pkg/registry/core/pod/strategy.go | 4 ++ pkg/security/apparmor/helpers.go | 6 ++ 6 files changed, 86 insertions(+), 38 deletions(-) diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go index 82853271bb4..2a26008588b 100644 --- a/pkg/api/pod/util.go +++ b/pkg/api/pod/util.go @@ -539,12 +539,14 @@ func dropDisabledFields( podSpec = &api.PodSpec{} } - if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorInUse(oldPodAnnotations, oldPodSpec) { + if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorAnnotationsInUse(oldPodAnnotations) { for k := range podAnnotations { if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) { delete(podAnnotations, k) } } + } + if (!utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) || !utilfeature.DefaultFeatureGate.Enabled(features.AppArmorFields)) && !appArmorFieldsInUse(oldPodSpec) { if podSpec.SecurityContext != nil { podSpec.SecurityContext.AppArmorProfile = nil } @@ -947,17 +949,21 @@ func procMountInUse(podSpec *api.PodSpec) bool { return inUse } -// appArmorInUse returns true if the pod has apparmor related information -func appArmorInUse(podAnnotations map[string]string, podSpec *api.PodSpec) bool { - if podSpec == nil { - return false - } - +// appArmorAnnotationsInUse returns true if the pod has apparmor annotations +func appArmorAnnotationsInUse(podAnnotations map[string]string) bool { for k := range podAnnotations { if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) { return true } } + return false +} + +// appArmorFieldsInUse returns true if the pod has apparmor fields set +func appArmorFieldsInUse(podSpec *api.PodSpec) bool { + if podSpec == nil { + return false + } if podSpec.SecurityContext != nil && podSpec.SecurityContext.AppArmorProfile != nil { return true } diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go index 8a3139adf15..e8025b2fe80 100644 --- a/pkg/api/pod/util_test.go +++ b/pkg/api/pod/util_test.go @@ -707,19 +707,34 @@ func TestDropProcMount(t *testing.T) { func TestDropAppArmor(t *testing.T) { tests := []struct { - description string - hasAppArmor bool - pod api.Pod + description string + hasAnnotations bool + hasFields bool + pod api.Pod }{{ - description: "with AppArmor Annotations", - hasAppArmor: true, + description: "with AppArmor Annotations", + hasAnnotations: true, pod: api.Pod{ ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, Spec: api.PodSpec{}, }, + }, { + description: "with AppArmor Annotations & fields", + hasAnnotations: true, + hasFields: true, + pod: api.Pod{ + ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}}, + Spec: api.PodSpec{ + SecurityContext: &api.PodSecurityContext{ + AppArmorProfile: &api.AppArmorProfile{ + Type: api.AppArmorProfileTypeRuntimeDefault, + }, + }, + }, + }, }, { description: "with pod AppArmor profile", - hasAppArmor: true, + hasFields: true, pod: api.Pod{ ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, Spec: api.PodSpec{ @@ -732,7 +747,7 @@ func TestDropAppArmor(t *testing.T) { }, }, { description: "with container AppArmor profile", - hasAppArmor: true, + hasFields: true, pod: api.Pod{ ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, Spec: api.PodSpec{ @@ -747,7 +762,6 @@ func TestDropAppArmor(t *testing.T) { }, }, { description: "without AppArmor", - hasAppArmor: false, pod: api.Pod{ ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}}, Spec: api.PodSpec{}, @@ -756,34 +770,43 @@ func TestDropAppArmor(t *testing.T) { for _, test := range tests { for _, enabled := range []bool{true, false} { - t.Run(fmt.Sprintf("%v/enabled=%v", test.description, enabled), func(t *testing.T) { - defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AppArmor, enabled)() + for _, fieldsEnabled := range []bool{true, false} { + t.Run(fmt.Sprintf("%v/enabled=%v/fields=%v", test.description, enabled, fieldsEnabled), func(t *testing.T) { + defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AppArmor, enabled)() + defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AppArmorFields, fieldsEnabled)() - newPod := test.pod.DeepCopy() + newPod := test.pod.DeepCopy() - if actual := appArmorInUse(newPod.Annotations, &newPod.Spec); actual != test.hasAppArmor { - t.Errorf("appArmorInUse does not match expectation: %t != %t", actual, test.hasAppArmor) - } - - DropDisabledPodFields(newPod, newPod) - require.Equal(t, &test.pod, newPod, "unchanged pod should never be mutated") - - DropDisabledPodFields(newPod, nil) - - if enabled { - assert.Equal(t, &test.pod, newPod, "pod should not be mutated when AppArmor is enabled") - } else { - if appArmorInUse(newPod.Annotations, &newPod.Spec) { - t.Errorf("newPod should not be using appArmor after dropping disabled fields") + if hasAnnotations := appArmorAnnotationsInUse(newPod.Annotations); hasAnnotations != test.hasAnnotations { + t.Errorf("appArmorAnnotationsInUse does not match expectation: %t != %t", hasAnnotations, test.hasAnnotations) + } + if hasFields := appArmorFieldsInUse(&newPod.Spec); hasFields != test.hasFields { + t.Errorf("appArmorFieldsInUse does not match expectation: %t != %t", hasFields, test.hasFields) } - if test.hasAppArmor { - assert.NotEqual(t, &test.pod, newPod, "pod should be mutated to drop AppArmor") - } else { - assert.Equal(t, &test.pod, newPod, "pod without AppArmor should not be mutated") + DropDisabledPodFields(newPod, newPod) + require.Equal(t, &test.pod, newPod, "unchanged pod should never be mutated") + + DropDisabledPodFields(newPod, nil) + + if enabled && fieldsEnabled { + assert.Equal(t, &test.pod, newPod, "pod should not be mutated when both feature gates are enabled") + return } - } - }) + + expectAnnotations := test.hasAnnotations && enabled + assert.Equal(t, expectAnnotations, appArmorAnnotationsInUse(newPod.Annotations), "AppArmor annotations expectation") + if expectAnnotations == test.hasAnnotations { + assert.Equal(t, test.pod.Annotations, newPod.Annotations, "annotations should not be mutated") + } + + expectFields := test.hasFields && enabled && fieldsEnabled + assert.Equal(t, expectFields, appArmorFieldsInUse(&newPod.Spec), "AppArmor fields expectation") + if expectFields == test.hasFields { + assert.Equal(t, &test.pod.Spec, &newPod.Spec, "PodSpec should not be mutated") + } + }) + } } } } diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 762735a75d6..f99c9ce3dbf 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -4736,6 +4736,9 @@ func ValidateAppArmorProfileFormat(profile string) error { // validateAppArmorAnnotationsAndFieldsMatchOnCreate validates that AppArmor fields and annotations are consistent. func validateAppArmorAnnotationsAndFieldsMatchOnCreate(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { + if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmorFields) { + return nil + } if podSpec.OS != nil && podSpec.OS.Name == core.Windows { // Skip consistency check for windows pods. return nil diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go index c22193519c3..92d7be0c2c8 100644 --- a/pkg/features/kube_features.go +++ b/pkg/features/kube_features.go @@ -63,6 +63,10 @@ const ( // beta: v1.4 AppArmor featuregate.Feature = "AppArmor" + // owner: @tallclair + // beta: v1.30 + AppArmorFields featuregate.Feature = "AppArmorFields" + // owner: @danwinship // alpha: v1.27 // beta: v1.29 @@ -975,6 +979,8 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS AppArmor: {Default: true, PreRelease: featuregate.Beta}, + AppArmorFields: {Default: true, PreRelease: featuregate.Beta}, + CloudDualStackNodeIPs: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.32 ClusterTrustBundle: {Default: false, PreRelease: featuregate.Alpha}, diff --git a/pkg/registry/core/pod/strategy.go b/pkg/registry/core/pod/strategy.go index 927d15f69b0..0ce8332a4a5 100644 --- a/pkg/registry/core/pod/strategy.go +++ b/pkg/registry/core/pod/strategy.go @@ -764,6 +764,10 @@ func applySchedulingGatedCondition(pod *api.Pod) { // applyAppArmorVersionSkew implements the version skew behavior described in: // https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/24-apparmor#version-skew-strategy func applyAppArmorVersionSkew(pod *api.Pod) { + if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmorFields) { + return + } + if pod.Spec.OS != nil && pod.Spec.OS.Name == api.Windows { return } diff --git a/pkg/security/apparmor/helpers.go b/pkg/security/apparmor/helpers.go index eeaa3955dd3..aa6ad5b4299 100644 --- a/pkg/security/apparmor/helpers.go +++ b/pkg/security/apparmor/helpers.go @@ -20,7 +20,9 @@ import ( "strings" v1 "k8s.io/api/core/v1" + utilfeature "k8s.io/apiserver/pkg/util/feature" podutil "k8s.io/kubernetes/pkg/api/v1/pod" + "k8s.io/kubernetes/pkg/features" ) // Checks whether app armor is required for the pod to run. AppArmor is considered required if any @@ -52,6 +54,10 @@ func isRequired(pod *v1.Pod) bool { // GetProfileName returns the name of the profile to use with the container. func GetProfile(pod *v1.Pod, container *v1.Container) *v1.AppArmorProfile { + if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmorFields) { + return getProfileFromPodAnnotations(pod.Annotations, container.Name) + } + if container.SecurityContext != nil && container.SecurityContext.AppArmorProfile != nil { return container.SecurityContext.AppArmorProfile }