From dbb34f4b3e5c256b59ece8209d143fa01e1dbbf3 Mon Sep 17 00:00:00 2001 From: Daryl White <53910321+djwfyi@users.noreply.github.com> Date: Thu, 4 May 2023 14:51:44 -0500 Subject: [PATCH] Adds STS info for Operator (#841) Creates a new page for STS tokens specifically for Operator. Closes #792 Staged: http://192.241.195.202:9000/staging/k8s-sts/developers/sts-for-operator.html --- source/developers/security-token-service.rst | 4 + source/developers/sts-for-operator.rst | 187 +++++++++++++++++++ source/images/k8s/sts-diagram.png | Bin 0 -> 33126 bytes source/index.rst | 8 +- source/url-excludes.yaml | 12 +- 5 files changed, 209 insertions(+), 2 deletions(-) create mode 100644 source/developers/sts-for-operator.rst create mode 100644 source/images/k8s/sts-diagram.png diff --git a/source/developers/security-token-service.rst b/source/developers/security-token-service.rst index 815907dc..17c53d15 100644 --- a/source/developers/security-token-service.rst +++ b/source/developers/security-token-service.rst @@ -14,6 +14,9 @@ The MinIO Security Token Service (STS) APIs allow applications to generate tempo The STS API is *required* for MinIO deployments configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials. +STS API Endpoints +----------------- + MinIO supports the following STS API endpoints: .. list-table:: @@ -35,6 +38,7 @@ MinIO supports the following STS API endpoints: * - :ref:`AssumeRoleWithCustomToken ` - MinIO Identity Plugin - Generates a token for use with an external identity provider and the :ref:`MinIO Identity Plugin `. + .. toctree:: :titlesonly: diff --git a/source/developers/sts-for-operator.rst b/source/developers/sts-for-operator.rst new file mode 100644 index 00000000..a39ec114 --- /dev/null +++ b/source/developers/sts-for-operator.rst @@ -0,0 +1,187 @@ +.. _minio-sts-operator: + +=============================================== +Security Token Service (STS) for MinIO Operator +=============================================== + +.. default-domain:: minio + +.. contents:: Table of Contents + :local: + :depth: 2 + +Overview +-------- + +.. versionadded:: Operator v5.0.0 + + The MinIO Operator supports a set of API calls that allows an application to obtain STS credentials for a MinIO Tenant. + +Benefits of STS for MinIO Operator include: + +- :ref:`STS credentials ` allow an application to access objects on a MinIO Tenant without the need to create credentials for the application on the tenant. + +- Allows applications to access objects in MinIO tenants using a Kubernetes-native authentication mechanism. + + Service Accounts or Service Account Tokens are a core concept of :kube-docs:`Role-Based Access Control (RBAC) ` :kube-docs:`authentication ` in Kubernetes. + +- Implementing STS for MinIO Operator allows you to utilize infrastructure as code principles and configuration by using the tenant custom resource definition (CRD) and a MinIO PolicyBinding CRD. + +.. important:: + + MinIO Operator launches with STS *disabled* by default. + To use STS with the Operator, you must first explicitly enable it. + + The procedure on this page includes instructions to enable the STS API in the MinIO Operator. + +How STS Authorization Works in Kubernetes +----------------------------------------- + +An application can use an ``AssumeRoleWithWebIdentity`` call including a :kube-docs:`Kubernetes Service Account's ` :abbr:`JWT (JSON Web Token)` to send a request for temporary credentials to the MinIO Operator. +When linked to a pod, such as through a deployment's ``.spec.spec.serviceAccountName`` field, Kubernetes mounts a :abbr:`JWT (JSON Web Token)` for the service account from a well-known location, such as ``/var/run/secrets/kubernetes.io/serviceaccount/token``. +The Pod can access those service accounts from that location. + +The Operator checks the validity of the request, retrieves policies for the application, obtains credentials from the tenant, and then passes the credentials back the application. +The application uses the issued credentials to work with the object storage on the tenant. + +.. image:: /images/k8s/sts-diagram.png + :width: 600px + :alt: A diagram showing STS token process flow on a Kubernetes MinIO deployment between the requesting application, MinIO Operator, Kubernetes API, PolicyBinding custom resource definition, and the MinIO tenant. + :align: center + +The complete process includes the following steps: + +1. An application sends an ``AssumeRoleWithWebidentity`` :ref:`API request ` to the MinIO Operator containing the tenant namespace and a service account to use. +2. The MinIO Operator uses the Kubernetes API to check that the JSON Web Token (JWT) associated with the :ref:`service account ` in the application's request is valid. +3. The Kubernetes API returns the results of its validity check. +4. The MinIO Operator checks for :ref:`Policy Bindings ` that matches the application. +5. The PolicyBinding CRD returns the policy or policies that match the request, if any. +6. The MinIO Operator sends the combined policy information for the application to the MinIO Tenant. +7. The tenant creates temporary credentials matching the policy or policies for the request and returns those to the MinIO Operator. +8. The MinIO Operator forwards the temporary credentials back to the application. +9. The application uses the credentials to send the object storage calls to the MinIO tenant. + +Requirements +------------ + +STS for the MinIO Operator requires the following: + +- MinIO Operator v5.0.0 or later. +- The deployment **must** have :ref:`TLS configured `. +- :envvar:`OPERATOR_STS_ENABLED` environment variable set to ``on``. + +Procedure +--------- + +1. Enable STS functionality for the deployment + + .. code-block:: shell + :class: copyable + + kubectl -n minio-operator set env deployment/minio-operator OPERATOR_STS_ENABLED=on + + - Replace ``minio-operator`` with the namespace for your deployment. + - Replace ``deployment/minio-operator`` with the value for your deployment's MinIO Operator. + + You can find the deployment value by running ``kubectl get deployments -n ``, where you replace ```` with the namespace for the MinIO Operator. + Your MinIO Operator namespace is typically ``minio-operator``, though this value can change during install. + +2. Ensure an appropriate :ref:`policy ` or policies exist on the MinIO Tenant for the application to use for the application + + The next step uses a YAML document to map one or more existing tenant policies to a service account through a custom resource called a ``PolicyBinding``. + +3. Create YAML resources for the Service Account and Policy Binding: + + - Create the :ref:`Service Account ` in the MinIO Tenant for the application to use. + + For more on service accounts in Kubernetes, see the :kube-docs:`Kubernetes documentation `. + - Create a :ref:`Policy Binding ` in the target tenant's namespace that links the application to one or more of the MinIO Tenant's policies. + +4. Apply the YAML file to create the resources on the deployment + + .. code-block:: shell + :class: copyable + + kubectl apply -k path/to/yaml/file.yaml + +5. Use an SDK that supports the ``AssumeRoleWithWebIdentity`` like behavior to send a call from your application to the deployment + + The STS API expects a JWT for the service account to exist in the Kubernetes environment. + When linked to a pod, such as through a deployment's ``.spec.spec.serviceAccountName`` field, Kubernetes mounts a :abbr:`JWT (JSON Web Token)` for the service account from a well-known location, such as ``/var/run/secrets/kubernetes.io/serviceaccount/token``. + + Alternatively, you can define the token path as an environment variable: + + .. code-block:: shell + :class: copyable + + AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/kubernetes.io/serviceaccount/token + + The following MinIO SDKs support ``AssumeRoleRoleWithWebIdentity``: + + - :ref:`Golang ` + - :ref:`Java ` + - :ref:`JavaScript ` + - :ref:`.NET ` + - :ref:`Python ` + + For examples of using the SDKs to assume a role, see :minio-git:`GitHub `. + +Example Resources +----------------- + +.. _minio-operator-sts-service-account: + +Service Account +~~~~~~~~~~~~~~~ + +A Service Account is a :kube-docs:`Kubernetes resource type ` that allows an external application to interact with the Kubernetes deployment. +When linked to a pod, such as through a deployment's ``.spec.spec.serviceAccountName`` field, Kubernetes mounts a :abbr:`JWT (JSON Web Token)` for the service account from a well-known location, such as ``/var/run/secrets/kubernetes.io/serviceaccount/token``. + +The following yaml creates a service account called ``stsclient-sa`` for the ``sts-client`` namespace. + +.. code-block:: yaml + :class: copyable + + apiVersion: v1 + kind: ServiceAccount + metadata: + namespace: sts-client # The namespace to add the service account to. Usually a tenant, but can be any namespace in the deployment. + name: stsclient-sa # The name to use for the service account. + +.. _minio-operator-sts-policy-binding: + +Policy Binding +~~~~~~~~~~~~~~ + +A ``PolicyBinding`` is a MinIO-specific custom resource type for Kubernetes that links an ``application`` to a set of policies. + +Create Policy Bindings in the namespace of the tenant they are for. + +For the purposes of the MinIO Operator, an application is any requesting resource that identifies with a specific service account and tenant namespace. +The ``PolicyBinding`` resource links the application to one or more policies for the tenant on that namespace. + +The below yaml creates a ``PolicyBinding`` that links an application using the service account ``stsclient-sa`` that exists in the namespace ``sts-client`` to the policy ``test-bucket-rw`` in the target tenant located in the namespace ``minio-tenant-1``. +The policies granted in the yaml definition **must** already exist on the MinIO Tenant. + +.. code-block:: yaml + :class: copyable + + apiVersion: sts.min.io/v1alpha1 + kind: PolicyBinding + metadata: + name: binding-1 + namespace: minio-tenant-1 # The namespace of the tenant this binding is for + spec: + application: + namespace: sts-client # The namespace that contains the service account for the application + serviceaccount: stsclient-sa # The service account to use for the application + policies: + - test-bucket-rw # A policy that already exists in the tenant + # - test-bucket-policy-2 # Add as many policies as needed + +Reference +--------- + +- :minio-git:`STS Examples by SDK ` +- :kube-docs:`Kubernetes documentation on Service Accounts ` +- :minio-git:`MinIO STS API ` \ No newline at end of file diff --git a/source/images/k8s/sts-diagram.png b/source/images/k8s/sts-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..801ae95958d9a7161ecfbddfac9700c8e63ad35b GIT binary patch literal 33126 zcmd?R1yoyY*EX1z3T=@ZZWUUJLxJK_C|2AxNNIsUvEmwP(BcFu?iwHzhajaCDDDL3 z!8N!`m^*#m_y3-6{WJ58d^2m-nyi(k;hb}yTlT&8bzOU(d{tGJCB9C59Rh(6%gen` zhd>AdA&`rjgjc{{YKThM!N)awIXy=R6M`$FG@&nX0Q4U$5_7yq_h&D}z9izjtmB?z$+dWxHSfLai5DR*=@@SZ<|b@ZP1YB|d3T zYv8Ov8kr(mpPrI*5zTT>{DvG>{;gtcHSd*M-+tYTy@{Y&-#$AF@8F8CGk(mev)tvl7ZqY|g z+!Ym_k&P=c_}(h{&(mf$ z*O7^DzyXu1|Mj9V{zju*GAH;zD~vZltKfydsqbAK9i8m9JeJEJ8*&zEwio|x2^CJOTO5Uvb}AnUuvJaZCFTO(NgR@=E8S$w$0D? z*}8IJ1<7l6>?BXuuop~BGw&pDm+%T-ZjM|aIfq=^378K=V3IUMPR$6V<6bB-QF6*L zQG3dv6&YjQzra3?Rr0Af^ z#dRW82D3U1ex5Xq)nQhHsb8(QP~@c57$SIcbDoT!=xSeb7Riq2iR)KBUU%|qN-A%; z?XIW;#ykLSw%hC%jL2Z74_)YvA6vx$ucFTIZ&P4rhE;SAm%0av(1)6LedF+Nyp`ln zd3(w5%j3K2D=RB=_5yQjUbJ?e((YB7lP7W8h8*m*u&*B)Qouq?4i~ApyBFGXK7l|e zg}#*#LYTXz?VU*I&Kw7J8ceuElDSH~)z#DlX!lENE5J2L(4B;RkJ@(vwD0EU6L+i$ zAduX@mt$wKbC8DSS=;I!%T1y-tc$Eow`0}Z!O31n+@cWuVpW>oCwv=VR#;es$VW!X zZ9LuhG(E_;2iy+^yYil}mZ6Ctazem#Gjh_>9^ls%yXT=bP_?9pk+vmgH@sOlWvZqY zK2IxZv#}C~LQ>1(IDk?C)$mqXnjH{}4>^b;nN&6fz>~dD%C= z$;kz|;tJpQOxs%qv_xzQUV!}g>sNv_gz}R|9MA6rNeINga7piy?{jeYPK7Hf8w(an zG!<;e+jA2-@ug$t;QMee-V5IJ&(3i32V2LN?!WeeVfR$zx2(|C;A%PYe{Rd0{;tMY zHv9qMe{b@?chGcC_+z@aZ;R1HCaT+t_N+{eFjp!FR|Yuio^;L8G{bI3^8uEFfHHFE zZ1#Y!lc#n4Da1t1l#&J9<8McOZF?OFh5fI(h{(GeMd&M#B7*v*Dv} z;}$x}-elq!qd}nYeI5cXE&><7K^Q$HlA67~J?r-?Yn#UtjX1>a4ZZ%zK#V#o( zI=Vc&xZ0fh{jEjxh9YOE$EoR_g_W&MNiH?;Sv01%nSHR1 zan{w3+io$u*YZ1DXnb>!pD;*Z3aa-^kMs0kEIrB7=}g#Tz2Lwmj}YQJ&}@|>aXl}; zFxHZ?`FMA_k+06)5cTm@#(2Wp;LdtgEEYS(MP%kJ9(|37h2L1XaoZ4+Bm*`#Ik@$6 zKhu03C7yKqx9|Nj6HibuTjg?@s&{YV7HYca6?Wf)ZCy6Om$FgF7XQ}0@NJ(oOT1G! z@gOk0V@kj48Q;M8M-b*lTr4Uf;SXom$L7R^(|Eh*1JE0n(`9q#-H^)3f;;&c6gJlv^5J2&a%>BMID>f}`J!t8|!uL+_mq3)fr z39abaI-Xh)TCuYN8~ljT-Xsv;2467sl#N{LJVcGOQHxJsVf*I}@R1J0j~n8PE)qzF93bZ6qh9SHvP`Wu82Tm= zsuY!)BY<)u4y;Gw*iI|K%ubM~1rP8&@e^^|aW(7mOb8RN9&<;$iQp(^D_jDqXQN8>zXSzG|Zjx82>q3O!uJ3qwN^xh<n$8Q4L1Bk3ve|`z#6EM`rSY`=FQD@{i5hC5A{h;SM7d=GCvESa8S*N2VQft%$2`2YdS%fPx>v*|mL5V4w}UGy+Ux~r5g8I(Igjhb zMPz$*HX;VNlexE#3S}}}FNMoDHI0d*3b5VV{x!*BhkyOxSAS;ER%`#)n4n5fHv`?^ z#{;lor;VDYwBU~?yj<#8+aJq*Zj}oc{i-h86J!WkY%6Y!{%di=TzSSn*(WQ0N7&=R zdEVRNU!89u5auA@r=F(L|LPfUN=r)%@g2VFS@eWKM z&zrxUG+z&d@-dL^<|Zx7vRM&8C`AYZixf&S0IGg4_}XGoF_QQGq?oPidjM++6VWcN zpMK@B%vTxaJ>kR@PN3)Uz-G;RO?mT|ygZ^l7Z#dfA|5S17Zn}V*=8?vb?wwYgm<}T z^A>>%Zbwa}QQ@T8PS0VtmWq^@R(`2c;oRm2o$XiIw9SLyA+69A+D#FLAEW*5#lKVS7zN(=3{GQcd~w?1`_3&0h^bC7@I ze{ete$YD~_$ZyfZV+Bh~*l#;m9X-E@m)ECO9!#nZY$zsE^L6k()qPe`?(CV|Tr5wK z3--jcO;s$F+Wiu=SyThRL+oHy>Vj3d!*cI9j z#|wVJqYI<-bx|^w0###Ge`9LA zU7dWYfxxE^uK?z=tvkx9lv1S$r6)c+)PxTaWyBRqsfwTSx^NoJm5+A>*>1!ig7&P> zPS9zgNSvZ0gWJz{?Ll%1KIM;DGQd19_wH>hfj8r>5MZ%)L<1#O+()>APH5_F-zh&? z^WlyXiBV9n(@z8Z1xzyw3rm1IGAQh?uXn7(h8{F>xkMWucb*Zb@`pVo;q@x8<2Z3R zbf}TQ@0MuqhyHMclG^0(qo;C3kzB>R&@s3Sxkq-B{QX@G zHSOy9;_8Jh5Vhyk;3cn!Wut^7&5ROEv+rAsj?G&izC^r^Tj=v)-4~e!RF55&IpKVd zd+XvW;{(y2O=rpb-&rLeKuow^QL==606tlV%1^Do$L&RDi+BtaHnAB&NHBY-FUyeLHlg_G_^V&mnU`YM%0f&R%tP7->O%U#Agkx@@|@Lcd3 zK$BrLP12H!`#Ec8D~2>)L} z_J4Sk@9W>?fr# zv~Z=88cOw~@BJ!{fz2HIM@1*bMm}T670i^iQdU6t>|!WZQ~Mst!zduWxF1}akRM@~ z{jF@FI-5{sI^0WHWA~QzcYsab1?158{sz*xh7wn`JXqnp(xdZCn*i`mJk=nADWPi8 z?<5a?W~itrU0&rwjp%}%_Yu#_{;lvVCGJOS)46w16U9$WW|fDEm!$$R?g}ZGdz0Tn z#S4686{XH-EV!1bike6p57GVyl_8SPCh^Y9(m7Y@z}hfia*hfLXO;XC93dn>QW0uAFn3pS+&N6?^Qp+QDw$2?UnE| z1RL^!2apW{oF!_s?wZkIV$8Z)$~_zvJssO$$lqaH{@t5yHLfFUVk2#JS`CYiq&wD| z^kyd*8j`5@UvxLXV_7r0D-fw@)3~e&zQ07&0CY3x+wbxhCK_*yw|1HHBP*F(4Bp?|5$u5#6PMW`1~ht#Si_TqTT=X!%g<+8=&obn%bC3 z#?ENoLEWRXdT!Z__QTUKUKR_NH_n~J2(g?etb3%YV|N~P`n*Lrx)e=>dH#a&CDK1b z7awotb-9RBesQ?~SyJ(X#kpX7cV3u2Z+I&|Cd{xdpld8XR%Znv(gI$>)P?o43`{Q&)H#G z_<)16qyd{kM)yS@VA(_&Z7b9_US($>`$X*Tye=S(?KsGwZp-ndWpAP6_e z<36A^5_~QCk^%4vPAp z@$S5@y?i5Tw;Kk7u~0g`f9F_yM`(Q@w;wRisL_iTKrA(jTZkgyV*^2}&g4A}LAzi`1+`+PuC!&FrxGfZJHJoOD|rU1l4QU1^5dG_vWAaEmq*m7{hh1r9%071S! zXdPz`)7KwO>T-_;Ve1lp^Y;9Uz-|yV+ABYyMG|F~s4O}J(dJ(JY!($A{kW0qnU*$2 zQ7Hxc2BH1h!aUFNRQlT0fkHr5`JSCig6V=cas`o|IDuTk6$tPcT$WUR-@AA_J3s^M zI|QDrcPWV*?Wz5?^lQ9@rB{99f9dPtP!Q`6|U!OnD=p~rH zcE$b#_lBGr`i}thq5up6^541-V7h$fyH6T;B2L_{ zaNBS~g_L%_ZLs%oJ)Sp%u)AJe%k!JPwX;?ENrvrcjWobvh>WA1g}k&Hkp-NY%;Iw3 zNB=~`I`;G`#McI>br2#U{K6~s@BT7S&1&7iRAY=Hz-@p8O5zW$*00BvRn`WjZyP>U zax@I83gnmT`=<6?DvuF6T5G_Gv$7F*^7ujHGSME#hA90M@JS`B%{2vw6w!P zNoisfb3gCS9lh6}qwfLofe^`P^!t-;a2I_RNC*iz7wRgEUa=Q=wVs?LX1Ltw53JuB zZEMZn3HzE~tq&Ar{5_eI6mI8nGd5Bc1_Ga5MCJ(G^G9WUeSK38507zgz(Rqb?&>ya zlGOglxR$fV1}K*Yhr7E@W%1_PbB?Je_p%-p<#e99J3e9_H&1)8@LYLq@I3^w%k#$u zxrx$S>Wu+oCnK8&f_Mdxitok=ep`Ik+TT7|N2u{AamNN=WlEwyaV)nu@1;S7O$;N@ z+1s%kVcj|?kP5H?tEB9oj@h~P2pf~3k*#uI_Z=Ady+1dA+1ZItPWn7v7mL!OyU_up zuj%`#EE~Fq_?7CKVA!K1@7&+dd87d}uLB)z%u+|}p-pli4;D+{Vhe$Ie7p?){TKp^ zgA*nRQ1RV>y3;)=6YUtXXVe!vg@c{ZR!?2TNbA;pUPg0d?Hd0;W7&6#%jgKv3^Y z=I6K7efx(gTtrN+nC}=MoKD}StnmXxKlrXj3utbIz(pT;0ts^W;-8g7z~at_$O-c; zZ(O>&TIbJ`rJ@5AdXP5&3!w>2KqQ8B-5qpDbz|~;3~GXW!s?A&=@+N7Iz3*h#N*}F z>1Whr^YhbH;i6^UrLCy_5c+nenRP;l#O)ryt0?oef!7=AabsK$Qw4+y@EdTps2`ua zm8A$^G^30K0cD{;D@+#h)|agli&IT?=gvBeK;N` zL*qo49p?Q=V@d|L>wL&=XZ=Uex8-XWyq85Mq zEoN$RQjGmBr6)DXSRz>AV}%I{K3h}6X)b$1b~W2FWUFraR?Q3 zUMVHv_sXnaBlRyE{CcJ7i^~~M75gQn)X&uqK2z6=jhb1$6`afioN4H}ajjziu6%Vs z3gEGP|J%V;8n~%D#D9F}BSfT_SLM^E2`?FZT(&mAo=aifWvVM_JTN~36?IZ=_(fI!UzTFF39-{Q; zedl~iJ8;)>CAmwG3^t%D`4tiV;7C@iwvEb&N+i`$IXkV@YPH0;En8}$7qICFeC$1Y zFBphNIsZ)=;-4UgI&_f*X{{)~9eLLkJ%L6&TloGxWO>!0l&{E!?xb2xA%-oS(c5#B zx8S_f?n-_^T}>g*htm?dXa>Ms@VBcODFAOcN>1y(5lEb{RT(<}sCkq~uV_Q3w^Lo` zv+gY4w}g()ap1H7`RTU9#o=(jbizMc^=L!j)rz5sB%!TKK*kC`%xaRsgEIXqi%|6Ap5; zpAMXbXbE)Xw=?^kL72~w(4~E%q~rr~wpLc#24ZdlgM%;>#@bzM*A0b1R#ywP3w~@! z0g1v|v7wEF_NjpkAV=2Nxwaha6ZBOL+_>j1Sq~R8_8!6cedj#3bgbuH(0lF{!;V6< z+ioJ$kTQ_%#*efLM8qj9fEI(Z8%Kfl`ba9CEPNglu?s}DCZd#0V z!!!X@)?MhXj33Y&t*AHXKR8C%6&u|@T{KYfuO#}B*E=CvAYcJWGn zRcd{`@gCrg?W2`4U`Tig@@}YXlveT!?@j%K(N%ncAD^L~{SL6>>9ooU zVF~D5$msgc(a*(~nl;Z{v7_u2V|2KleK5l9Bd<@=89_VPMjbHmqKOz^3V4}z-SP3} ztTU=M3&4v`R|C|AEuZd(c(^8(tTJ_i7LHte2P_S#6kqWhs(O>eWn$R_I$q{k0W#U# zhVdEp1*xm%mgw%q{;saozd-LmfHpcE)YsD1`b?1Dy?EoQsr=~BqhB&c3U{h(U3HSt zDH4Gc9E1nW7XfqOe(j&?GB|gD1i1{dc?~kcE8vU2xYuVt4xl?vlbQfAI)Oyi?RS6L z=Np;;JkZY!YSoyb|Aw{O9_MWG(>qEl3j~S4szDb&olA3=-$E(*H{MU~rl2n`1KMr7 zzXGI{C)YBKmPA&dXAU&mvVPIEWA=7!xu&*uZd#fMZ84Z*0Fy_@+!II2JY5IMek~$H z!4_D#{<)^s$nJ1Fe9WS2iO@Y619sg(cbujsBbZfs5}~G9HRuHH3kG_3a17I5#;cyT z2c%-c0Dx?L?~jyFb_3{>26FL+R@?l0ZibdQQ3KqcI;NfERy;YO(np$jJl9~NnvB5$ zEaG18Gh79VG42vwX+&W_0RyO<*k!x;OkU>O@~BK&{YGI;O^%}zRGgXadpwz zdAs1CNz^!_&QQTK4>b!i@hSBq^yHu>2Kk8i@cPI5phy7gBBxzrR~dimV>3|>1qBX0 zV9yECk|->#6{vE~fGq}AnkU=17wco|`n*D_|28*#(h!fhfUB`y-N%j&9Z^GwlqT45 zx333HbV7;tt{lh5{XDt+k?SoZeolMiDnrN4e^}VN9x<=vEbU%ql4{j346bvi^vA=1ycgSWeDrPZ2 zI6H@Pa=b_lkANGeRgLItze>QDPT#RU($b7X7H_WwWTbMYWw~*Dbyvi!zM9L+3~wAt zFW1oqZlezjPif2WHvKw>^QQ)YKb4jyL$?YuzZZ^uUjcBCpm9H`={;icT`t)Apmb)q z>h9TX04R0vWi%E;A{0hdb_+qvq9mm4j#W;bgF4Hd#584{WzhE~MLHMWzFf@n=PZOG ztqbc|PKnR&c0bC?&!Y|_6$SRY*9>-N=f65AtuE`2_B#t}10QQ*LYV~{ z)t9(;Q#bPht>5U}hOVvX)0-}AYdv@AuaMm)x-u)af3z}>Jdpm3{_UCCB>YU9J-qRk z2QvGa6f$3kwkuLs*{55U0k(_?nYNlrdZx4r-=T?T{m|(mkk~ciLeWd(U2EigfM%99 z7Oxglo*TWrDm1%u#0L6%=(TtK3IW&})3cHlS(Tng(Cb$|Oc?P?IeQuDWQ*t+4U}cA zt_Hki9V+7;uyw^?3->KAQDi!fK*`Xv)7*FQq?Cnr(GzVXp*XZQkIVeh8(`q(jcQ9_3X32 zc&1JXa`A;!0MF)5ykV4nP>=jhe_$Rz;GneJ?wpy;8R=1tbLN+PpsgG1%E7$vEZpmT z0U~iuxs9g)-m^{uz@6!7Gk{>c=zo6-p!Ovi0M$WAcmrxaAU_`eD?le9UZLB6K&pZ$ZMg4;4ONIOqYV2n(afY+~F*^ef#Q z5Ui3cn}3HElY8T$?v)(QO}L%72wVFb!O#6x$$WRnOm7izFfqxtuUDpz*>q@J;<_uU zc1xIOlE?kqkOyS=pI1=v^(KFZa08+lM zSa`js@~31x>qX!9Joo#1q;3UH7`mIr;jB~3DsBOB^NpwOucP@brsRQ2huK$MrkB*I z!2DIL}{EjC2HC=*+{Ng=Q*kXM1_xB&5^ty}odwSiLa{*?Y8%oe7+zbp2=h;N5nNk0>Y z^G&}&2YzYUFIt+=LHB8>zXc}M^RQ3{(o^sTp?isNsg@35RF3}Q28tW-#`AY==dWpI z=1J3kR}mU)P6PGvUKyTrf!Dt!&CgiVUQqZq3JU-5uU-IGL2=~fJUIj+ko=zuYyfVq znilchxovvOm;G=PSbEqfU@G|6ziUf>{;P}sRcqz{GAoGOB@8QMkrk*6;PpS1rvCR~ zXMFR4VE6y^9}{>b6)$RLRa9`jIAPKd;f!eP$x*+EVl1e?!osVFz7VAlc z_~EK*+Q-lN{Vzz=mxzLbG&{Vi7g_qU&nCQESSCaj)a>MZb`(3>Rq-5E+W8E~Z%l;t zJ;<*5VvKP+(A10(!nu(bH7J|9F65K_q zfn+QQ!&kw8S_qbhjk%_<-t?8Rix;Sc#;)V(dBTs+>4`5~%*<}7`vkZc$i?Ho^7(jc%AR$`e9O|) z0`yk6HVC3F4b*E5gfzSl-RgY2WSUJ>Y#9oFle7joWuAk32{dm>rhooXgfxFHXl=%SYLsw zOIGl%64Ya<{pEqpJ8~?Ddsvtq;}H-Qkw{kJxBkhf@zCLj8eEJR81KtdsVx&4dS{sI zapF?@*&8rlqi81s7xS#~%M|)Da=#*`ovb8NHG+*927wyG1H|njkTiaI@u4s7g)VJI z^Z0kwS)X^=%Jf#MXZ@(9C7O->c6V7YoN<*6^>t^SyPH0R^=wD}IX?ufdf{pf0S0U> z-cOgSb6V2LyL%5?Hu__uwfPDsQkr9)>3*;f0kc(oSjNQOjS)Y~TS@kLbn1q0X{fZ= z*7{4NbJH8@GRu(S!b-)5LgKIW61|}<2b##E+C-t_W^`>H%^9k=y7>)dvw0)eQ>MEi zeAOiFFM)6`7tBeUO>mX;^Tk;o@~?7reCM-b6K;*p$J_QF>AiN{ZG7N5^$D&E6`cJ9 z2jgk6F)^^kmci;bM|nB+<*yrPC*T!(qkP8*LA6l0{g|ZacBptyj6copv7hVSPga`r zEV#nQ+GG=E-JdT zZ(Zn0L_RA=e`WGGvph97hw&^!y~<@)+rjrINlT8X;V(bE$nq<-(#aFgdS-SN`@W4) z$b2q&5ez>SlkY29Qv?U4&DM2u((P)H%`ua-MUy@2K~Fj`hfM3FSKGoO{HfWTiP~Ec z{XFuBNWKC^z5X`Mq8aT$@v{JGjIEr0=NFKGam<2MPf&z>@0eOHz-J+h1(e~rCz4sP zI&D2D&u6>o2n+md2J<_4tbW#7LxUM&P*>Nh_`HndrOW6q{S<3QjHGx{EYmY9i4Nt1z1%5yxc1r`c`A(6Epi1 zgbJaKsMyphOh?c6Xl>EMr5z7%vvaTTFStQL{h4IChq4J8szgA?*WUbfjc$*>8$Z(( zKts)SM7^`55jL;nh~<(*4D<~Zh8|p*U4JMK$IWDr@F&rSmH&ynFU~2!>{8V4XM}9z zY6J6Tq^0(se+}!v-r!pZ`Ai-CqhiRLk4;#^%+@%CyMnW)mw!qNoJQnk=>&Fn6YBiw zX*GUl%qq|foUV6O+AMa(=8gkmIFKet9i5o#AYP@Rtn!^?+ycw~;|D$)!w!>oF*ol> z%~rw<>vb>N|DLvgAFRbQaRHA9<=>zPg)mb^nQKZ+dDa#HO!qm)*I0m;+IA2j!-b| zZFPI8jWMZEre?zgF@7On%wtA0>54>vGzBi zL}OL&vFbXk`uhJ`57OtAO(*Z{1(Q4o-gIGtA0A%cN&oN)GmYHhtw(EgZmes9ndZfP zJ(&k)pCj$)w4jS5IXkWLL6Lo@0zo4S#scrSJYkE<&+7ve^cB6ano%K8c=VIHyV^AU z`g0|?+>G(DpmhoAwG+%=IvvcvI~<{6HA<#KJ!1T>n8$gR7_;0=Q@HxQ+0g-SvQNZz11WZYqVCX)6dj#GM^AAawdK>$ z0+9MO+~V^0sWpZ>X!t`z7(MHc14yd zs>Am_vkN~|I(J(9Wz zBbc=~Wm#PHU{`B~Czm@1KaCo=dS~kMU*6M~O@596HylZd$u((WmnRKSb7qT64>a~v zr>Ms%yn#CC)hD4%nhK^dLx+9MV#JxmYXw>p2Mj~NY0Kjsi{%T`{G*U1I}ms|fFwV+ z@VezpVo(PpKc6b`Nc9n)`D{~?&G9XPLFCx{ zXc_Ra-o<-b6Yv9edEx-*XDh=B^C)v4G#mvD6>+mTT%5erBqt0%m-RjvDtW(iwSv90 zCT8gmVinzpD)M~P8WnNJ(H}e_@yuotUpxhbBv2yxp}{27I1B{;mmrPnXL{-_KEw*r z@;01oPu!42DJHMPlZEF`PrJCOg|lWilobrn^e1~5E0}df70VC$T{aR2U~y{e39(j& z=;s&g3YyP$y99333_l#8@$gb93#mI|I4jmw0Vg0bc-RZPuLs;`B7K(Qfc4u<6H7g~ zz1a0PD}&WQ%@x#L%-2*^fyIHE#GFO^QxAa3Bj#KTbn1y(f&Br5H99tCq2M9-J@2Gt z<6y0KjTJQ@%BpQSLg)H~sms54M{CZjfxw@7_lIc3Qrh=iXYBP(QW1=M%zY51~&Q%R3q{Ku*={8M(==)L5Hy!MUX={kU6}?RR^S!w$l_6=(?syJ~qbLwHpWR4|qS z0gX?`n9Nbm3X~#;(AsQ+EWcv@6V{2T?s;R*<>Q|pJ`5s~gg}mdZoz8`zG?{-n_u%h zIYiYDSr{h}iPs$)P{oOSH^X@;tWp(>y<@AfS^G9!?K3pOd}qs}e-*?LE2X{Egz z$Nm;3nqJ{bTXAVP)6p?9QBV=FyB|U>e;u;}KIm*k3WO;Zr3YgY!?RW`-h2){X`Gbk z5R8Hz*nsPRn@*oh?(w|25=A@+Uz`!~E%vhXN!K@|Y z;Ls@L{3dxfL8`R5I&?1W>7r0F_W+V|*ub+38S65xJ{#S&Lvm)fcs`#ymmg?9XBkm< zvcigdWdr|2W7!5%<4m`p43jZC$L+99)qR?Y;RY#2+4$KnwibQ+1Z|a(UZ-n z+F9tVtIS{whqBjr9_S}|E-Yv7ZI6~61JY_eJ=5eZw4q8K$N6nVa)-kjcUl!^aO_k2 zwPs!hPULVlktFW7=oF&zo%7n&pAtrBk7}d6X5o#xjV}AQm z-QDRh)j%MZ;G*PVGdCA-20b1U+3QB)%yzQQ&Q!MtY?BO_mnXq$d6Euc>c>fKGCqMx zb~?*1fiEV*(_3%bK31Wn;ydShItP7f`ob-qv0!X`+~!M_ql3|akGgEmN$XCqT7$w0 zAu1d^0+kqpbdHZtAFV&$?%3?qKiQmc&0b-JhFFy^<(6L~Yc|qh_J6?|hmr&T>#qMWCtYui9-25ajH> zZ3tz|lwEBy)c>zh=a7cE*z9Cwb4PB9Kq@g2=yIc{>sL^gt^tK6GVW2{eZ&l8b#v{Z z95?3|qs8uysFkn0w&Rty$#yVUFTue?cFa)WAoJp|STdYz?8w2nMf8&Ah@)G6rWW4e zbk>@iprEN^YP$nyD*f>f@} zy@kRQTF)5BTf8%#E)!Z;fO2-(k`7vQd{nEct6H@7(@u2x-GcFmO6SPzHgiahQ3aSQ zhOo`>#BlR#8tSs4;{+AKLv*(Sr<{lbQa5?se-gg2$XM=bau*tR8@+9r8S-P0Z`hfP z>M>f3VZ_YsEI&WzV8MPCR#sZ(|8aS*q!@sjNu>K%mGdX!US3OO;A$Ayk<^un~Pxxg=_8Io7Fbhv=cyZmZPZq7w%r2M?>l z^769i2BqoZdMM+gA>=nJ{gA}^sV`#t9mqJ3J@)DohU9_oU4lQiXsuy`v)y%hxtQ^^ z%yu1OH}7N*>%HS<*G4`ccQ+Glsj~qC8lSTmBXzGXQ@hDB3luaNSGAwe^%=+aR(C_} zkBAFOEr0?ZC+=!=>X`lLEFHQwCnWdDqe>EBI+BCPy^8N;-~Ot1=6q2e{(ruBRQ@!afUuLJR1UYGYzaKi^{vqr3bEUQ}eGLpFlsgUx+a zg3~F700}iNo{TXtTqk|r*(KNC=Uz3f|G@LE)J7wn_|E5#+tbbc6Z`5j)Bxg9_Lt4R{Hbq#!om4W}62O80>@OR?x@8E?n%L|aOM{=q;)>@Oj(7EC z*^}&|`g)KO8vuekh)5s@@E;kl_ zAPp}yi!YR-5nh;h)08NT(MhGRRQ(NBNq1ng7lfIYLiBvH4r47g$2+))X`>%tYmqYC zxvmbiQ~Hi2wTXrdmr-nC>DZ@>%52-Yy{!XyXe%XmZliG8GKXh)2<73~vQ<*?YZ$IR zCT4r%Y7>&P`->o)YrE<i z!Na~Q^Ifsb*%pX|B>C#YJ>!)h-l42T{9AUI8`|U4e3+e{?&K17L#BSxjaq(YtlPoh z%2y_OV=`+`pa-zJ&Ak4Zj63c_y8WqG?)50D6EmlSTIqvw;dS>G+tYRpmF2U8$v}_w z@-aIMXd~vb?E_v0;lh?AZ!ON6Vl~on@4%O$bQ=dZJo%m4Qaw9$&&b5CfMopO6WDIjV1tP+_P8w!JDj~~6+(79f-FP6T2zBUTcRbgo3F(0zQUy^p%T4n;)Kf z4|=Ut+UnK4?8eQAMHxM1_BwCvsc8i$kPTTF0$8-V%J&6hVU3-_*jwx2qCkPh*V_=e=X9#q6{ks-G6u3Bi)F|fZiv+Oj#E!;h?2OFusZBETA2S(;MX%*XhY zh&RqqtPp->*qs&B0MDD40iG~qV@txh@NTc->F&sQ!Uf|uC1^4+Qof{+>fE#H&Q9)7 zhTrsM(L+4b$>Jw78QLOLCvgZly3{6^Bua47tL?X=--3IV)c(m|$DE~N*H0ZaoAM-Th_Hn~RA?Qs5a zQxjBW#t-fn;+AzZ&v#kd5_vSLFr7VLet!7&ehZJJM21rq4ulpov)b$@cGN(@5|dUk zZn>xT@p+|M;rO=`@O1OZ0Mc!MfnId)-4s%BJgq4(;@K~LEjnw#!bAoG6!Bv9bxYU9 zHEIM2t<{oC{fm`VrN6F!Ztk(~iS6g;KcAYcZIRWQI>EtFzH{`qKS^A?{wc!h-X$td z>F3W=MFY^U3Iax1=#jPS1x^)%NuvR(6N@@3qSCIedv`M}4cG_udjrnOQZg>ie10w| zY1x12NtguT+*5h;i}FK95A_0LJ09J6+S)e1=OyB`*3qHAdJ>!KnQ(ACndCjqhh2V` zj;xHQF~&7IP;k~r?udyh98oCWK+mkCwwbYTuw#Zu14|wHpGnR@fMCrEihB#~HZ7g> zmzw0ehL-yawt4yF`&hYa)~YT2S4g#!7WRDwKj9n?>Pp>8Ma2t|YYq>iR``v(;PpT3 z^WFWlC0;58+*o2SNje{UPY!jIM|dmeh>~T7q@45`87E(E4&6WA-Rr79(|K5?dqR)H zN(AoHiI8b^Pu6|RUbBXBJrXnF)3G+CQPGI6?X%vm46j~5FlIguB^-{}rn+26Da`$1 zNoHd!mqc>1cK)~pI~8)|oL-ex=BCV6NEW>A*GqrY+nrt)U6w;~g|wd+ZeLxt7ZdKI zIj@+Q2R~cjXOyOon@1JYLY;}}`?-R!B^F%*H<2C>O@G5ILPrv(zW&`DmlEUm{O;?X z$0I1oI(qEQv17mH9IKX;?P^m>abcgC*Y7Gf%06QZ3s?&YC&e0XgOZ)Y)`+2G?lGr# zPe=r@U3WN>dPZf7yNG0KR}I%_X&nQIpM z=6p?KH@pVEKiKyBDdTC}sF2OHBx}r&?J8`He(mw<$IDy{ZY*`UX6xqZ;*G4wP0P6( zK@}94t@Qj)O*We5eHtasC^D;@JU%!%`b{3?$is!*UT*jdyuNDc+1*A!CsktiE!hel z!hqddP7ICzSk4zNB$j+5JE(Zk?Im69_b;L?jjxQ>OQQlBCZ!>M^g7RR)lkouxY?zx zxctb-xiE#FOpJ`5CK7}a^3n&b?Ckg%&+f@&UX;)@ynN)mo;JgfU~6->ymg0(Z+)Em zc}qg)fqn@Fd3+_5sBxHb_I^&I^8D72?{rR#vPw^kkbk;QDTbnG_$63im%m0-hbbNI zQ|CVP(vy0O9#tK-v=cNfh_hnHz3Y4=@A6|C6H!at9SwJ@Guh4wyV3Xd$y*{y<>M_Q z)EO0&%U$z_Hr0mLc)r4^7*h2_*&}WYi&c1b_u0yd0^%ci<+6tt+>5-i_s2KU8xYfP zS?;o)o@ku=;g``-Pw|e0*U(x%#Z_i7;OL};F?Yus5RWFUu=-K1AR9g=>v`Ckk6rJ2 zg4jf!RFv!+N|^{)oN>_euZ>A$MC``;BBLZCsS6`EPu>Oz<%?`a{P?UZ(uqCZ8zX-1 zDQpY6DV)8LUMqIC89VD;Tq~;+)nY)f&%1U!%7YrZGKgEPpxFiQi+=gX2Q^|_GuMFn zYxCO_i64!pw$|mE^3ztc=a@hzkykCC@~-z{jnPJWfJ668D!LxE5PIzWUdlwSGG#6p zXO+jr&F%1<_iA-uz((|L`=>)SA$Z@fl1ZmyFu)KxRJbW+6R`DfBmFxkGbe3Rod;t1 zbizmL7rUCLp)|*9qnU5!-;vGHe6Ptu=LkUiQY$Mf=hn7jWvpIqCjIW+EGu2IpI5VP zC`5XC++iaZI?zj)n!@f!^Lah(^AbP5p9T#r@%wVzO-1DDl~aD|Z{Wh@IW7ksrqX`c zNxZf$D(xZOn`AfWJ?Dm;xI^8V*?(uCXMlcx_{QVV;zb%6p7TEH+celM0>kO@MJ7)B z>MwG%41U*5+*sIIlQ&p?hpy;?6%uk)+q!Gqo=bK@O0T~EsUv6qNl9s01#-o*OhgIP z!ln=NcCvPt+d{s4?wZcgiOZ_mvLEct|8DkFl0-f@qpl%6y~SFwpVu2vH~m7Dwj&K% z%hP8K^&I<2$FOo_DVdhJ?Pl%d$>g$=^lHl^hrU^^+A|sKB$m7$D(v1(10t!*Tu&;m zZ!<*g9u1Y3FMRZ8)pE}to%9k)=+8EAKK&(sW_JF(pV~vnb0H|U@Wbi-vT$DChE}bx z^RKYD{(}3t=fiN-J>n!=|8Y<1_}AW~aar!5QlAxUqSfPUD@fxtQIIGk218v1d+IAf z8^iAwJ;?9o)b%_3<(E($uhUqvUZ8>vuI;s9`W&*Kc5#VC?uxEg6HrFsb82g$ex|(g$DljNstZ?APy+Pi3hiw= zbMwlM)kKhwFBU`7&=b;4?T;q#?Zh@OEF2|eW%*tccktVKpFxKhg8pjrgX)UvHgoa{2|7>r6v*wze0R ztiils9@VZp(LwJ0>xXo1Uc?Vu6s)c^q7N-{c1@}j@=Fr9qn|k2eyFC1bYCQg3a0A% zHkCGM$`r_43#3(u*NsazxzhMK1j6D18|g}{RpfJFarI%PA%78?q^uHsX$OzVXsK)G zn7Lq?Vb7Fy$eg`UHp?yB5F#n?qY@tj&^d=P;D;JGnA^FCGBdND2y&|}CO9sv<`)#0 z@oB1!-MxQ2)PsOzTYuqY*(eoU)U^bV?uu@&b@_|_}b2>c`l zB`+AoDkD3M;Hyu~iNZ4J{pyYM@o|X!t=Z*-le0XW6s6p%1o;(oDs0~cNApscCD}}yFl*- zJ@Mn?N?*ufuTgTexI5e2cjJ0NDGEh;vTZ(jkD@9l&2^f+4rJNBW3IfzaWAH2Bouzw zu~n3MTPk_>#yGGLgJmaT$dzZVY7WPRqK`a5uM?y5awEC}Des;EQ?uI6cpJ>XuMK`H zL*4`B81fJz&<54?s>pC9Zj?(BVKx|<OUiGb9+D;RbaEbhpx<@FO!uPm8g zd#9il`PfoP6pomgnL!NRqC|6i>1PLa_Js_X(?$7u#V-t*=g*vr!StYoAN>|w3>r9! zc&yLg9qqg>9(aEZv7CA?y2bE}x=WaWf7QR67DJjWSZG{7ky1}5@}|E0wNF5u6I8!r zF6rBcmcVOK>|Vbo0q)J`!IB|;r^&g?DACEujw8ofPpL&Jo} zZ{8#h5_7eGsT6n<+8t?3I{Se#>g$Eac+V&#+Te2vmg3B{^5!yX+YLE+RH=t|{1!$9 zgQCd1iwiJUb9eT8n)fcOIUpc)TXsH+Oz2+E-99@Ra=$LMUelGtbwoT~i|#4sOoKXVW^}2~+Gpt;$&Du6lCi?)hY68>q|g9NTkoEA>nBGgx|@ z;3{TY?s>N#u`DIY^>c>%i)2!enL z7C?#uB3(g1RH_sO0|JjyB1P#Pr78%D2uhXSdy^920RgF@CPQUB$!UBnlCTR8jaX9hiIX=wK_L)yn zA%78_hir>9B{#O;A9<(AU-*3e#GpL+oaP`J+f^)4o7*`$n(Q5g$J@+qe*FCYtEZ=D zc3q@Z%N>{|fAE0yBXZrXqk}7JAau!|nFnJ_noi}zLZKW}1Pfu}WY`DIyZbq+&U?S< zEap|*_(?Zc=k&}?*KGA2t)}1&39MrQJ_F5dr>a_!Z^T$@cjClfCFENLWb#^p+1A$b zhF1-D=C{Y0Kl7@i1VFh{#Wf|`K>6d+&QexCp9)BhPfD09(A(*rSEPBmL(hv1p>XyS zrC6D+y?Oy3GtgwJt)=`%b2T*8pu9^$Ow6qreC8ZsA=A9?vVtM5+1LKP6M?tbZca_3 zOI1NlTKaY3#Msnk4Z%yo$XYu!Ao>OzWwJOfT;&}MNA3s7-xT0<|Kn>FBXYe$p%>RK zUwIbDoPyz%=+JS9_rV4+vL5oQzTICdEo6T5jAqzIK>}&83ztb}pHc8n2cM0;<$7Z@ zCB057qx}QB{ANaTi-WMjRDZf-2{PV|NIR;iw2ZV49p=G8x5r*VK|xn+(gn+J{-xix zC(wCf!2RpPZ~Ym{qEz~ulj=OhB(8*{gzlJ^Lk#69R6eN@Tnrwqn5^>DB(1D@7~wqZ zSNZgTUGDNZNy*u(^XO6{zP9Lsjpz68p8LA+UG-Q@D2LZkf3O7$J;0(Y3m86}m z;3X}flqN;@b%kZE&(|s1!Y=>i%e(PlmCz3FXYspw6~!YLz33&$PNxRR$thV4b!W%z zA70_%*831D);x91yDU@R^7~}4d$#>7W#_tqvd%am#58^|&=z;yt~H`ob;8JG){Fr4 z{%{bEmYQp3I|HsLI<0qID{|9llFeyiz!f`;Ys_UUx^8bhJXZ92y1{i(cWa^HQdEa; z8>i?RX=ZM-1RnzOz1u)huN10vTfM&J?5R~^m&K}60B1`UU!7>?dw()Vt8HS%q?fdI zL7`)1*}7Rst8rp=Dx*j^HFY|cyLaxij@u1%k=6zY1MO-&W#iM?GHMS#e$*IzQN4CvLB~K_{ESs|g3(Uo zhH(~-)?te_;t1ng$0?#`w*FH4)ZsnYk2_Hg1tHjz$Ad;-Z=w#&N8}(QW6q~i#3{$_?=uj#w$G|M@1cEDN>wT6K zwq(soiV%_Bb+p29sm(HrvYw>e|5?~j?t2XzDI}yvMmg)-_Dcn|uC~;Gp`<+e7p_p< z{~oB8M{rt-KYXGJKeRv+ThP90dw(>>5c?uGH5QjC(fTk(2?_|QM~(n5#|!cciU(#|Rs85+S|F_G*SDv#HrM1e zd+QRD681TtI!LE6MM)RU^LS0M@hK_aoS&ZG;?fSqMG6nOW!eiGWW{zaxs0!D1Ph&O z++n?U-+$ZXSxzQ-qDa_v!5hb`-J13~F8Hd;hG%|C(VF~&>Yy$|<44z|YUUMZQdA`A_JBh@aoV&RoI7P#oc{UDDYX^Tu;6@ovhRZlr|m*y z#qqcYf@4Nfodf&re&RL`%BH=8|A1MS7yC&!zzs|F2Wx%0&-~Hi1`Nq#E%im3*xBIo zqF_I}I?}WnM-EG!+>nZPpq^HpG@?jI9dTGkOITGp}rM8rF%rF@xFN-M<*eOJ#}qjfqq zt_7#oUt5v7`ExL}AVzhhqC_1rc4TdE>EgY8cOz%of3%2AB<(y(sNmV~?(YzGY4o#w zav%A%igx2GH}VI#4KaXJj@KTH7k55>oLDiqcr<~poXhwXvjUOJyS247?^EZ2y;-;< z7*1GJ=q30Ud20=0VUqIK^^3P3)9h`zqkQl1BwCE|+-+IMjF}hIp;Cz@j>?sLuT7b7 zvS6Jehj3DNG8~s3BnlEooN7etm^M$R3Y&whk!8@MZ)2zMWn6D4*XIrE4fO;sz4b(w zftHH0CkJaU5Ofog@aY60_%7tJlSb=a;h@=-Z47Z?>ap#NL1~>OOq$oxmZ`W01=IBt zbC#ly9qE0}XW5!PPwy z_Lp>B?XG>tXY}EJfslvnlrG}^X=d(_WWb^eez_% zb-@NE>#NtA&R>EbH=37j{#*rF=NA1qWEbG|m9dB17&yC@XR2q{a3TuwJ5f;7OKE$2T2ahJ zf@XEK!ujjSr)rDKDpyWrY~b0`=4KwgYMFkeW9iixRcEwHqb>6|LqDq2kCJ)RZ8I&T zzoeVi4&SOu5iKQ+vw%STr1I{=MC^&V0!w1mHBdfDc3=W8T7+2`>%g@1aX5i%Dj4la zo7K-Asv7RV;Cs*6-R{p4juNw-rSO@^TVMj@mcP%Ke>~}cJ0J1sceulR#KWy3{$kBf znFpaw%5zJnm~P(il=bYix%GKUr;4uPUc^Sqdt6c1LE8PMBI*h8Z84!gipJ@+32$wc ze`K23uLbX)P4dnA7!s1mMj5?SvK8ed&HL92%JP_g%j^d#%F+m%6w|z{ooWt8v#3jn z(CqsRe}91r#oXN7?VYHvpux+V&Tv*r-{<*;wh|{VuldAKoP0IDEg?}7{eC8^hVI^{ z8W&sgtJusKRhy&lY*na*^7E2PNHv#Tro1~& z^1d`3C*JJXbTkWN+Ki+y7SH?Hpgg04R1q>UiyZH01>)_&0)W9n?3N>Dq_=0F_?@?n z)&Tu@ODTuY^&Y9@!tdG7Z`W(fs!xCB>$YJ`s&R9A2cfUDIrH(iZdtvEkH8qyOrGvT zt0ji-$S)2*4l$NVq3C|VYcfR#2bY01<0)hR~=>oaN~6`;6`q?Peg29<7xNZfR9S~llosCk0iSO?(#nG4+Fuek?y_|rJqUuCb8~#@Y=^4>*`Nc~t{D7E zg{a?2s%nLm5+WBFo$!E?4rV)riPDuo8u0t1EPe@BI6yI0XuxTpC$c-NEGi_Y9sJrR znI!Yr%CvZVQmZnv-!38vaCCFVb()cK!#Ye*Vw9V1w@0R)bL1&qs{$?(EK5hZ??Xvy z@+#u}JzNTdfiCsFa%h>jDBZk)f%67nB0DG3!F9t>EMG~4kNb&Ub@=>-Zs5dDa|0!~U5sijH-X^8qT4HU zM{+sR$p(H8fu!VDIfYHBv=9vVP*KZdt|v?35V2s_OLt0N2%IF2m!|zL8(g%3Iw;*Y zzqfjefXNr>AH8_1s~RnGv&i&GJRUsN;Zk0``bQWK;r}~*) zXs{QJzgKTRh@gSi6)&P`i8b0V>?xkA3Ba-QTzG<$Z3K5lH{kUW8fu8cAHnIpMSnqgiveY2?6Me}`fA>c$6m0TajDVhEcjx! zYc(wz&1Ow5+?3OhT#8^SsDQtt7O^0v4gD z@GjA0*~1jI4)Oa;)L5VwjnP3-r{2t^-ctSu6@ooDUm0_ooJHzE8j<+b$`~#rPy%Gh zSiGxP(aX&RoRIeF=*n@QH{Pj)X~lGmac7O+{Ey!n4@1TRI4(~^&?9_aYYYm z&a1d;`A+;mX^iWqy3~xJO>Q(;MFUlK)SVz;XNuczj~$SwAK7nC+fQ~8auXzmMlbMC zKFP&Rq3=NivnE3$JeyyN(a!R5Z0;enx#4P6>edpEDnK9~0&4Ju`E>363l_wCV!wfi zwlg!lTuQ<;BND*TBA=9Cy8SIjf8o2&0}w>ph|n`9C#R3`NFOA0IkWl7v$p%47pi-5 ztkzxakaEMTDH!n_FDJFr^W=APGfYfEPy$Pg2&L~T`^UI9&pXl9P68ttbP2+r#Vpo$a~HlKn+AL#u+9 zWd-Cq zuKGOccD2TPy-QQHP)S|T?(K=nfU4Hc{Yg$*@`(09H(h3P|4 zwQ3>9qdv7{@aozDfMFIk&I1@p4g9^YtF5UaquU#U@KF7yBN~1|9TTbu*B=bc@0(fa z$Iq??WQm+E!+Ps8Hp6ZO;M!ndXpYE9sKD&!F9V!_<}S>TO%Pros5IIBmamLt@ntvB za5XwrSlfI22>diBTsZmcwDsNcI~*QhisQ$i)Xy1|Xe|-?2bG zO$xKC!PSc6j6Xy@M)vqLqWGI~Y>*d6pw1owk`lO%eP7D{94cm((1Gyv!;2*l^y5kP zuW>kU$EXBDgvaU=~wWzd7?yARlz~)o-?nL%-i* zuiRoL)RWX-21~WfqAn&iqTE>@ZS*^JRl*7W zN96B@n+?Jh3Gt(&u9%ff9Z4e!d6?URq*IDQeXjy?gC&OX8|b|#Vz)naqA0rR{c2BI zRs*^1;O0tr)?}U3#v68_$F2(H>~pbe%P*7YMR&yq1a?SAiJ{)!2P6tjKXFVI3{rFx zoYq7iBSd}G?`MI4sxsGnPTN78b!*8mO>;`Pf}G(&zelF!k`e=oMvZERVh6)@KR5GZ zsCpBZ6m`UYzM4+5Rc~k8$Yne)+6KI!@lVn=03Za^SBo2xG(voKJ$I2=p;5#yc4V^Z z72G{~^eFi;FzR{uL1_wgfZE*rC@glHRS`&ys`JM8)<_I#@Yi}#-{($7oc0Z5xeVz-CZVH zg(W470$j<bcEOgI)XY-4rX*C^R;tQW96|4@DQQaZB38z zwxe~WU%(2N=oK7-i0c&BcFKFZ3nql9 zAT`(`a?S*u{yGi}#M^kpmveD)tC!Bl8URO9n_#mR0?it<0hNvmEL9ZaH2~iLS+s8w zY#v35)Pf<6G8s?bgn zbYEVUkMmwAY<7{+7D1%&@mofx^h4m2KG|M)26E&++t31UqS9jZOjD zBV}1;Mq~(ZGHC_;uVPd%i_Ohd;q$yoA9F9k4yDxl9cBG!^|JZr(+5#s`4DU8@iPv< zM}XQoC-XaX(a23KK(V*37;gytdVu!+by2xNQ`*@%tEYuE+GLfV7Xi$>)BN_Jj=P}DwLdE)QcSqjc1@H=1G*2~bU6iGvW$(29Zk?f6XNyD+PN41o{spy4hJgp zBu*cpM%~l{n!{aQy>ey-2BQEr;p?+kp`=k@V{?vj_!34s5kSiOpcmAujz(F-9-ujQ z6%_(fH7TN1r;jrvy_g92U=lWRp{?`~$}(akEoLvO^+Dv;X8msSvv zkv1=saVzNiM0yXemGi#c&0_sO$7Jn)GZQr^kUnN!h2wdCCYNYrBP{B5Ht-GtcJ3Ppigo&fo#-jZ_Otzfr zYnkZOR8cMkE*>5YNZ2c9@Qa<6)lb5)x-&TC^QVA^j?K!M(ezKCK_jXYA8?Z)0LDO` zt#HkZCKGUT8*f30oy4kjG&ME5t;9TH`;{2HqG}V9-==4zcVzDL0*&CQf7AR1BnFV<#1*rKP{`Hy16+d>>CJE&sju zkR*8Bs}IvAAPlA}QF|%7(g*mQj|H)5Tm-C z{eCVBSP4fNE_?hPpLB5h<9qvOOL)+Y3ml%hO$D%Hs3Ri-I0xTkGk}qa2FAY1;||3g zM?eic!cD^H?rA&E+P}N_)Q8p;0ENwVmZG%Z1vb2AdiJ?CHJf~G;HC49XY+LIhhQ2! z){a6Rp>!B_Wr1y+FVw{3u*@u|AiFk*_U~w_lf#fa*_;nJ^w{Fyy*B)pA@G&@KnzYw zQTX7v5g*|GEaN_t0vPY8#ES}!4G?EvsESD&86Mtoh5bhY?Pc|uLY~xbgILtyjTyqR zB_JsmApA!$<|7vVX!T`D+cLn|qjb?}FuDfAE-0+2x5xG8>kuG-?-W!V{HOZUafY5Z za$`BBl=n=6%CI6Y?ON9`lQ1nL9>*>}EC4`VBn@*$>V+C)gY*mxYj!|cZb?6CS9&!T zQD683JJy^QEfZqV=eqQu=ts+%sSe%t)-Rjo`l08lX#v5di?=3%4 zc1g-bu%GI@vf)RiqC$AmMFpwPFb~st&$nP9E?FxCI);U@LZyQfwo@VQ8?4%K_LjcT z)q)5$t2_eJ%hVgy>niPQC12PMqukkd<4H)KkX&xNB%Zmqr>7k9pbhJ9y0viQ&GtMv z2|n;~;5+{uUO{`FmrIvtYW_izjzyNpqpcK`IwtS7D^v6eGraKTt9uqb`@z3K^z}RL zJ3Baajenobfg+no$`5dWzlIiEx6m`Ib(FP_T9C8qPL%rx-gWGRy-GWab`|KE!OZv) zkco3UgBca-7-l#A9OwEmm}|5)?_NjlG><$nw-c#g{ke3Xl_m3%InRWH`JSP z=ioNt8Dzcw$$|cd$Z^#E;qAf3raKzXC6m(wW?^{fn} z)wc~JshO+9lE~5T_RURSjHL!t)y^qs+b?;QELdsX4btr)#td|qloHG$6(!Ib1fZA8 zy*RniLiT38v6QGZKQ#2anbM(M4kP_gPjwW;#l@=G)FDtxbt!k^UV^HEm7F zL1fLKjMp9l&dNXJKz8tWlc!H zD0cjQw5iX?g%#dhCx-Acp3NP;onH^JN<|3eAKtB4Czj*c4 z?)`XTq+oHFdJbo)TytDQ-D_uiGmR`kFF(7+rx0!%Qv3HjlE#3x`qV%wKo8b9g17pr z7-_z!+Tf*u^UXj_!nv>=n18X$`CdUEh44`Vk5nI>ICjb^x6X8f$4@#lxMXoyTw*8f z9nAUULo*N7sG@Gy<|ASuFd4JgQ!x^%U1MziFySPp7En0;IxCq8er?LyQZ2qe?2EwF z$-FND5_OqBDH66U!%o#@kMuFKI1;%xB{>y||4>hE>bJyJ2c3}faxTZHq-U<~^L)cR z-aKtP6mjR8fZ8g|H`VJ{%4)`YLx}}8+ESAHrW8pklbf5y=vn-sVKIQAXp`CkRNHIwe4tp_i7TKxhJTRnjBWpU!ffTg@l!1Beq@qjY&pH0T*Psx};JN1X- z^0z}|8$=rSdqtQ7aT{uqj(CL>7yRA6KWFmV?%!H5_bQR9$g7X}MGH}2Pwq@>n~+7h zk&g_9_p$N?SQMU}M|GrfCT`BB+=xBeYnuj|O#ey9wtFcW^W~!ie*Qy*fQ#wPjJB49 zU{Oa6tK3?WJ$?7v1}3Bv&|!7eM{%KK?_h0gC`&=4L!j7QE@CY{;9Npi0jtDXUEZKn z+Z4&?Ez~`{cJovB#mPsr@?c5yeFDq}ig8i$!UcJucY{bi4}HfTX4K7p$~~nxbr_?1 z>K-8`4zM4V&R#9_Ob&z12T{k{gWV-MB0ooF4bPi34^=Rkf}I+_k5g5$tuxL3a@ypU z71{B8pMemk>$&`yt1t}EukU}C{*}~w5QMV{n_Ox098>UR4v9&eKlxCkE^p#am~&FB zC{9XU`&CDUQT~l8=NeG;{J8k4dHoeSAGA+@?Q0?7_PJ_v`_Y(tTLrpe#s0+43y!JTJ-ZgS$D9toxGC5>= zS>&gokmUCemYh+xx8w=qyKfzop9#)wQ5L${{xy-wXwnUPC*ADEl@S3os;Z8ko&)pi z3;JKad`R_K&`xK$K+hEY0newOf!U(Wa7PmYf{rLQvofD-h1!?3Q(tHfF$? z@3~k`HquvziE{S|lKPppX|3z4kHYuNRcu6QR^&cHR`iM}Xs6f{o9?01-&H)M5Cn|y z^3;ot*ucBm#~U%_0g%q7h^ooI}fvXo^w_GT;e zX-#2a`ltQxQqG#gpHjZdz_DLn6;532rhJfaCSInLQ=tyfd&iJG2F%@5!GPI*Hj1~6 zHIWJ%xP`fqK#3KG@eot{qaqll9QzBpM$HZ%F_bV%N`jZhS%hGt|CW9F4n|$SGq~jK zkhixGpPVetngca>ps|FK>wj%$w`Lb$*I0AmwI3M07cOa?9Q(=woOy_KCS&+V2~DKi zTwIvo_NR2U&0=e^Hc<2c6Q9UKetK%n^7=%qhlAvs9!JYxd@8~szj{7Vk1z9D)y-cZ| z?g{zF7#!Q)>+lsKg}sv>2)Zsp7YX%H%VqpX4eIh$8N%(`V;(GG`A-JKC5ZhCqUa-V z`{tf%l|8quM;G;xO6PU*7@txowCwIWYLDAJyaOig>_ZtDk0@QNHg#rM5b#~2_-Wem zd|4Hg{0R|L4}>Jy6@xk_F{&>R*NXQPFP{lv-l@t+4U1sR`XX|oI;xH<)@7kUORozm zrS&6+u|f?D7Nr>kGeIGtW-dyorw}*aSKroys1Y3IT_whZrPC&10_=#J2#QAr*erHWhSq3x!KMkK8Dza1VuwBz*;N-@_0J~1$BtGbwZ1Z{ZcvQHnos;1x+}5WZ=u)!U-D{0f=38aNh6?cCe7gs z`_JS#7^Se5Tjj7YGUz(%->l42Cphl)erMiYsG~es(MjtHwn)ai1{~u-Pi5|4?LD^j zWqybJTz(~nTi|1HuA0a$H#f;u^~&8kFM*)U%}s!PCq=|fX&CzC2^tyM+dI^q(Cq8i zu^cev`>v=97&)%Xnr(vtv`#18&(gRnJ$WuOrbP!Lg{>FQzw{$d3jzH;@{H`zI*0uY%$FyvpVL~ej*)nzLwv66yeZgUL54H9T@)tKANfd4hr*D10sA$=ny?SD60iw~pEekCWXO}GKjqlHw zhc{H9PzH@lQM)+Kg$&CQT2D5Fzk}cOM|kP z(zAgNRUdW44aFmYMD;LeGAxiwe?K9znNMex;NxI)YWr8{5%2mL>>L+(EhNq~9;#vJ z*@IJqPJ#!?vBQGxI8|uZ);?<1mZKdAGHgX0tEoPsXQ+OG`yJN#s4T)( zvVk~kRLhX<$hE!bmN(&9He&*U5FV@~ns6?b!vE_$G? z$*Xm%ylvtr^yXK3D_B3wa-nrE)uh|(&oeTY5g|s@nC`y#$o=eY7V%P38W0XR-&2cV zVsJ6q{{hYZWVQ&t_6HR~p*;UJ7pQ%^@jhT}aExl@Wl{!$nZWfgPz?U@e>`wmf11)a@+#MiYWD=p&@cP45|Bzs~rhPp%2&JG^hLi%`S?BCCV z(||}L|JDI$^!4dvefVlp;r1V(obIhFZN*jtN;K2 literal 0 HcmV?d00001 diff --git a/source/index.rst b/source/index.rst index a85dd4c9..28051d07 100644 --- a/source/index.rst +++ b/source/index.rst @@ -164,7 +164,7 @@ Any file uploaded to ``play`` should be considered public and non-protected. /administration/batch-framework /administration/concepts -.. cond:: not linux +.. cond:: not (linux or k8s) .. toctree:: :titlesonly: @@ -198,6 +198,12 @@ Any file uploaded to ``play`` should be considered public and non-protected. :titlesonly: :hidden: + Software Development Kits (SDK) + /developers/sts-for-operator + Object Lambda + MinIO Client + MinIO Admin Client + Integrations /reference/kubectl-minio-plugin .. toctree:: diff --git a/source/url-excludes.yaml b/source/url-excludes.yaml index 4f82c1c9..70aea572 100644 --- a/source/url-excludes.yaml +++ b/source/url-excludes.yaml @@ -98,7 +98,17 @@ excludes: - 'reference/minio-server*' - 'reference/minio-mc*' - 'reference/deprecated/*' -- 'developers/*' +- 'reference/deprecated/*' +- 'developers/dotnet/*' +- 'developers/go/*' +- 'developers/haskell/*' +- 'developers/java/*' +- 'developers/javascript/*' +- 'developers/python/*' +- 'developers/security-token-service/*' +- 'developers/minio-drivers.rst' +- 'developers/security-token-service.rst' +- 'developers/transforms-with-object-lambda.rst' - 'integrations/*' --- tag: openshift