operator-framework / operator-lifecycle-manager

A management framework for extending Kubernetes with Operators
https://olm.operatorframework.io
Apache License 2.0
1.72k stars 545 forks source link

Per-CRD RBAC resources not being created #1957

Closed LCaparelli closed 3 years ago

LCaparelli commented 3 years ago

Bug Report

What did you do? I am attempting to install an operator via the following CSV:

Click to expand ```yaml apiVersion: v1 items: - apiVersion: operators.coreos.com/v1alpha1 kind: ClusterServiceVersion metadata: annotations: alm-examples: |- [ { "apiVersion": "apps.m88i.io/v1alpha1", "kind": "Nexus", "metadata": { "name": "nexus3" }, "spec": { "networking": { "expose": false }, "persistence": { "persistent": false }, "replicas": 1, "resources": { "limits": { "cpu": "2", "memory": "2Gi" }, "requests": { "cpu": "1", "memory": "2Gi" } }, "useRedHatImage": false } } ] capabilities: Seamless Upgrades categories: Developer Tools certified: "false" containerImage: quay.io/m88i/nexus-operator:0.5.0 createdAt: "2019-11-16T13:12:22Z" description: Nexus Operator to deploy and manage Nexus 3.x servers olm.operatorGroup: test-operators olm.operatorNamespace: test-operators operators.operatorframework.io/builder: operator-sdk-v1.2.0 operators.operatorframework.io/project_layout: go.kubebuilder.io/v2 repository: https://github.com/m88i/nexus-operator support: m88i Labs tectonic-visibility: ocs creationTimestamp: "2021-01-14T12:20:46Z" generation: 1 labels: olm.api.d9aed9862d42d8e0: provided olm.copiedFrom: test-operators managedFields: - apiVersion: operators.coreos.com/v1alpha1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:alm-examples: {} f:capabilities: {} f:categories: {} f:certified: {} f:containerImage: {} f:createdAt: {} f:description: {} f:olm.operatorGroup: {} f:olm.operatorNamespace: {} f:olm.targetNamespaces: {} f:operators.operatorframework.io/builder: {} f:operators.operatorframework.io/project_layout: {} f:repository: {} f:support: {} f:tectonic-visibility: {} f:labels: .: {} f:olm.api.d9aed9862d42d8e0: {} f:olm.copiedFrom: {} f:spec: .: {} f:apiservicedefinitions: {} f:customresourcedefinitions: .: {} f:owned: {} f:description: {} f:displayName: {} f:icon: {} f:install: .: {} f:spec: .: {} f:clusterPermissions: {} f:deployments: {} f:permissions: {} f:strategy: {} f:installModes: {} f:keywords: {} f:labels: .: {} f:name: {} f:links: {} f:maintainers: {} f:maturity: {} f:provider: .: {} f:name: {} f:version: {} f:status: .: {} f:conditions: {} f:lastTransitionTime: {} f:lastUpdateTime: {} f:message: {} f:phase: {} f:reason: {} f:requirementStatus: {} manager: olm operation: Update time: "2021-01-14T12:20:46Z" name: nexus-operator.v0.5.0 namespace: operators resourceVersion: "1431" selfLink: /apis/operators.coreos.com/v1alpha1/namespaces/operators/clusterserviceversions/nexus-operator.v0.5.0 uid: fd231b17-7702-4400-92ec-8c1d2be80c1a spec: apiservicedefinitions: {} customresourcedefinitions: owned: - displayName: Nexus kind: Nexus name: nexus.apps.m88i.io version: v1alpha1 description: |- Creates a new Nexus 3.x deployment in a Kubernetes cluster. Will help DevOps to have a quick Nexus application exposed to the world that can be used in a CI/CD process: * Deploys a new Nexus 3.x server based on either Community or Red Hat images * Creates an [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) in Kubernetes (1.14+) environments to expose the application to the world * On OpenShift, creates a Route to expose the service outside the cluster * Automatically creates Apache, Red Hat and JBoss Maven repositories * Automatically updates Nexus within the same minor version [See our documentation](https://github.com/m88i/nexus-operator/blob/main/README.md) for more installation and usage scenarios. If you experience any issues or have any ideas for new features, please [file an issue in our Github repository](https://github.com/m88i/nexus-operator/issues) or send an email to our maillist: [nexus-operator@googlegroups.com](mailto:nexus-operator@googlegroups.com) *Please note that the operator is an individual work and it's not provided nor supported by Sonatype.* displayName: Nexus Operator icon: - base64data: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+CjxzdmcKICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgogICB4bWxuczpjYz0iaHR0cDovL2NyZWF0aXZlY29tbW9ucy5vcmcvbnMjIgogICB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiCiAgIHhtbG5zOnN2Zz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiAgIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIKICAgeG1sbnM6c29kaXBvZGk9Imh0dHA6Ly9zb2RpcG9kaS5zb3VyY2Vmb3JnZS5uZXQvRFREL3NvZGlwb2RpLTAuZHRkIgogICB4bWxuczppbmtzY2FwZT0iaHR0cDovL3d3dy5pbmtzY2FwZS5vcmcvbmFtZXNwYWNlcy9pbmtzY2FwZSIKICAgcm9sZT0iaW1nIgogICB2aWV3Qm94PSI4LjM3IDUuODcgNTYxLjI0MTYzIDQ3My40NDQ0NSIKICAgdmVyc2lvbj0iMS4xIgogICBpZD0ic3ZnNDE2NyIKICAgc29kaXBvZGk6ZG9jbmFtZT0ic29uYXR5cGUtbmV4dXMtY3JvcC5zdmciCiAgIGlua3NjYXBlOnZlcnNpb249IjAuOTIuNCAodW5rbm93bikiCiAgIHdpZHRoPSI1NjEuMjQxNjQiCiAgIGhlaWdodD0iNDczLjQ0NDQ2Ij4KICA8bWV0YWRhdGEKICAgICBpZD0ibWV0YWRhdGE0MTczIj4KICAgIDxyZGY6UkRGPgogICAgICA8Y2M6V29yawogICAgICAgICByZGY6YWJvdXQ9IiI+CiAgICAgICAgPGRjOmZvcm1hdD5pbWFnZS9zdmcreG1sPC9kYzpmb3JtYXQ+CiAgICAgICAgPGRjOnR5cGUKICAgICAgICAgICByZGY6cmVzb3VyY2U9Imh0dHA6Ly9wdXJsLm9yZy9kYy9kY21pdHlwZS9TdGlsbEltYWdlIiAvPgogICAgICAgIDxkYzp0aXRsZT5Tb25hdHlwZSBOZXh1cyBsb2dvPC9kYzp0aXRsZT4KICAgICAgPC9jYzpXb3JrPgogICAgPC9yZGY6UkRGPgogIDwvbWV0YWRhdGE+CiAgPGRlZnMKICAgICBpZD0iZGVmczQxNzEiIC8+CiAgPHNvZGlwb2RpOm5hbWVkdmlldwogICAgIHBhZ2Vjb2xvcj0iI2ZmZmZmZiIKICAgICBib3JkZXJjb2xvcj0iIzY2NjY2NiIKICAgICBib3JkZXJvcGFjaXR5PSIxIgogICAgIG9iamVjdHRvbGVyYW5jZT0iMTAiCiAgICAgZ3JpZHRvbGVyYW5jZT0iMTAiCiAgICAgZ3VpZGV0b2xlcmFuY2U9IjEwIgogICAgIGlua3NjYXBlOnBhZ2VvcGFjaXR5PSIwIgogICAgIGlua3NjYXBlOnBhZ2VzaGFkb3c9IjIiCiAgICAgaW5rc2NhcGU6d2luZG93LXdpZHRoPSIxOTIwIgogICAgIGlua3NjYXBlOndpbmRvdy1oZWlnaHQ9Ijk5MCIKICAgICBpZD0ibmFtZWR2aWV3NDE2OSIKICAgICBzaG93Z3JpZD0iZmFsc2UiCiAgICAgaW5rc2NhcGU6em9vbT0iMS4wNTE1OCIKICAgICBpbmtzY2FwZTpjeD0iMjgwLjQ2NzY3IgogICAgIGlua3NjYXBlOmN5PSIxMDcuOTk0NDQiCiAgICAgaW5rc2NhcGU6d2luZG93LXg9IjAiCiAgICAgaW5rc2NhcGU6d2luZG93LXk9IjAiCiAgICAgaW5rc2NhcGU6d2luZG93LW1heGltaXplZD0iMSIKICAgICBpbmtzY2FwZTpjdXJyZW50LWxheWVyPSJzdmc0MTY3IiAvPgogIDx0aXRsZQogICAgIGlkPSJ0aXRsZTM5NjMiPlNvbmF0eXBlIE5leHVzIGxvZ288L3RpdGxlPgogIDxzdHlsZQogICAgIGlkPSJzdHlsZTM5NjUiPnN2ZyB7ZW5hYmxlLWJhY2tncm91bmQ6bmV3IDAgMCA2MDAgNzY0fTwvc3R5bGU+CiAgPHN0eWxlCiAgICAgaWQ9InN0eWxlMzk2NyI+LnN0NXtmaWxsOiNkNGQ0ZDR9LnN0NTR7ZmlsbDojMzI2Nzk4fS5zdDU1e2ZpbGw6I2ViZWJlYn0uc3Q1NntmaWxsOiMwMjAyMDJ9LnN0NTd7ZmlsbDojZWNlY2VjfS5zdDU4e2ZpbGw6IzAxMDEwMX0uc3Q2MHtmaWxsOiMwNDA0MDR9LnN0NjF7ZmlsbDojYmRiZGJkfS5zdDYye2ZpbGw6I2U4ZThlOH0uc3Q2M3tmaWxsOiNjZGNkY2V9LnN0NjR7ZmlsbDojY2ZjZmNmfTwvc3R5bGU+CiAgPHBhdGgKICAgICBkPSJtIDE0LjA4NzY2MywyMDAuOTcgYyAxLjksNS41IDQuNSwxMC42IDguNiwxNSA3LjIsNC45IDE1LjEsNi4xIDIzLjcsNi4xIDE2MS43OTk5OTcsLTAuMiAzMjMuNTk5OTk3LC0wLjIgNDg1LjM5OTk5NywwIDguNiwwIDE2LjUsLTEuMiAyMy43LC02LjEgNCwtNC4zIDYuNywtOS40IDguNiwtMTUgMC42LC02LjMgLTAuNywtMTIuMiAtMy4xLC0xOCAtNi42LC05LjMgLTE1LjUsLTEyLjggLTI2LjksLTEyLjggLTE2My4zLDAuMiAtMzI2LjYsMC4yIC00ODkuODk5OTk3LDAgLTExLjQsMCAtMjAuMywzLjUgLTI2LjksMTIuOCAtMi41LDUuOCAtMy44LDExLjggLTMuMiwxOCB6IG0gMC4xLC04Mi4zIGMgMi4xLDUuMSA0LjQsMTAgOC4zLDEzLjkgNi44LDQuNiAxNC4yLDUuOCAyMi40LDUuOCAxNjIuNTk5OTk3LC0wLjEgMzI1LjE5OTk5NywtMC4xIDQ4Ny43OTk5OTcsMCA3LjYsMCAxNC43LC0wLjggMjEuNCwtNC43IDIuMywtMi43IDQuNywtNS40IDcsLTguMSAxLC0zLjIgMiwtNi40IDMsLTkuNyAwLjQsLTYuNSAtMS44LC0xMi4zIC00LjgsLTE3LjkgLTYuNCwtNy4yIC0xNC4zLC0xMC4xIC0yNC4xLC0xMC4xIC0xNjQuMiwwLjEgLTMyOC4zLDAuMSAtNDkyLjQ5OTk5NywwIC05LjcsMCAtMTcuNiwyLjggLTI0LjEsMTAgLTEuNCwzLjcgLTQuOSw2LjUgLTQuNywxMSAwLjIsMy41IDAuMiw2LjcgMC4zLDkuOCB6IgogICAgIGNsYXNzPSJzdDU0IgogICAgIGlkPSJwYXRoMzk2OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiMzMjY3OTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEzLjg4NzY2MywzNjMuODcgYyAxLjEsMi4xIC0wLjMsNC45IDEuNiw2LjggMi40LDMuOSA1LDcuNyA4LjUsMTAuOSA2LjQsMy44IDEzLjMsNC43IDIwLjYsNC43IDE2My4wOTk5OTcsLTAuMSAzMjYuMTk5OTk3LC0wLjEgNDg5LjE5OTk5NywwIDgsMCAxNS4xLC0xLjQgMjEuNiwtNS45IDQuNSwtNC42IDYuOCwtMTAuNCA4LjYsLTE2LjUgMC4yLC02IC0xLjQsLTExLjUgLTQuMSwtMTYuNyAtNi4zLC04LjEgLTE0LjUsLTExLjIgLTI0LjgsLTExLjIgLTE2NC4yLDAuMSAtMzI4LjMsMC4xIC00OTIuNDk5OTk3LDAgLTEwLjMsMCAtMTguNSwzLjEgLTI0LjgsMTEuMiAtMi41LDUuMiAtNC4xLDEwLjggLTMuOSwxNi43IHoiCiAgICAgaWQ9InBhdGgzOTcxIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEzLjg4NzY2MywzMy45NyBjIDEuNCw2LjMgNC4xLDExLjkgOC42LDE2LjUgNi44LDQuNiAxNC4yLDUuOCAyMi40LDUuOCAxNjIuNzk5OTk3LC0wLjEgMzI1LjQ5OTk5NywtMC4xIDQ4OC4yOTk5OTcsMCA4LjIsMCAxNS42LC0xLjMgMjIuNCwtNS44IDMuOSwtNCA2LjMsLTguOSA4LjMsLTEzLjkgMCwtMy4yIDAuMSwtNi40IDAuMSwtOS42IC0xLjYsLTMuNyAtMy4xLC03LjMgLTQuNywtMTEgLTYuNCwtNy4yIC0xNC4zLC0xMC4xIC0yNC4xLC0xMC4xIC0xNjQuMiwwLjEgLTMyOC4zLDAuMSAtNDkyLjQ5OTk5NywwIC05LjcsMCAtMTcuNiwyLjggLTI0LjEsMTAgLTIuOSw1LjcgLTUuMSwxMS42IC00LjcsMTguMSB6IgogICAgIGNsYXNzPSJzdDU0IgogICAgIGlkPSJwYXRoMzk3MyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiMzMjY3OTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEzLjg4NzY2MywyODEuNzcgYyAxLjMsNi4zIDQuMiwxMS44IDguNiwxNi41IDYuNiw0LjQgMTMuNyw1LjkgMjEuNyw1LjkgMTYzLjE5OTk5NywtMC4xIDMyNi40OTk5OTcsLTAuMSA0ODkuNjk5OTk3LDAgOCwwIDE1LjEsLTEuNSAyMS43LC01LjkgMy44LC00IDYuNCwtOC44IDguMywtMTMuOSBsIDAuMywtOC4xIC00LjgsLTEyLjMgYyAtNi40LC03LjIgLTE0LjMsLTEwLjEgLTI0LC0xMC4xIC0xNjQuMiwwLjEgLTMyOC4zLDAuMSAtNDkyLjQ5OTk5NywwIC0xMC4zLDAgLTE4LjUsMy4xIC0yNC44LDExLjIgLTIuOCw1LjIgLTQuNCwxMC43IC00LjIsMTYuNyB6IG0gMCwxNjQuMyBjIDEuMyw2LjMgNC4yLDExLjggOC42LDE2LjUgNi42LDQuNCAxMy43LDUuOSAyMS43LDUuOSAxNjMuMTk5OTk3LC0wLjEgMzI2LjQ5OTk5NywtMC4xIDQ4OS42OTk5OTcsMCA4LDAgMTUuMSwtMS41IDIxLjcsLTUuOSAzLjgsLTQgNi40LC04LjggOC4zLC0xMy45IDAuMSwtMy4yIDAuMSwtNi40IDAuMiwtOS41IC0xLjYsLTMuNyAtMy4xLC03LjMgLTQuNywtMTAuOSAtNi42LC03LjYgLTE0LjgsLTEwLjIgLTI0LjgsLTEwLjIgLTE2My43LDAuMiAtMzI3LjUsMC4yIC00OTEuMTk5OTk3LDAgLTkuOSwwIC0xOC4xLDIuNiAtMjQuNywxMC4xIC0zLjEsNS41IC01LjIsMTEuNCAtNC44LDE3LjkgeiIKICAgICBpZD0icGF0aDM5NzUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIgLz4KICA8cGF0aAogICAgIGQ9Ik0gNDMuNjg3NjYzLDIzMi45NyBIIDQyMi4yODc2NiBjIDM3LjYsMCA3NS4yLDAuMiAxMTIuOCwtMC4xIDE0LjIsLTAuMSAyNS41LC02IDMxLjcsLTE5LjUgNS4zLC0xMS42IDIuOCwtMjQuNSAtNS45LC0zMC40IDUsNC45IDUuNSwxMS4xIDQuNywxNy41IC0wLjMsMS4xIC0wLjYsMi4xIC0wLjksMy4yIDEsOC45IC03LjUsMTkuMiAtMTQuNSwyMiAtNC43LDEuOSAtOS41LDMuMSAtMTQuOCwzLjEgLTE2NC4yLC0wLjEgLTMyOC4zLC0wLjEgLTQ5Mi40OTk5OTcsLTAuMSAtMTUuOSwwIC0yNi42LC04LjMgLTI5LjYsLTIyLjggLTAuMywtMS4zIC0wLjYsLTIuNSAtMC4yLC0zLjcgLTAuMiwtMC42IC0wLjMsLTEuMiAtMC41LC0xLjggLTAuOCwtNi41IC0wLjQsLTEyLjcgNC43LC0xNy42IC02LjIsNC4zIC05Ljk5OTk5OTcsMTQuNCAtOC4yOTk5OTk3LDIyLjUgMy4zOTk5OTk3LDE3LjYgMTYuMTk5OTk5NywyNy43IDM0LjY5OTk5OTcsMjcuNyB6IgogICAgIGNsYXNzPSJzdDU1IgogICAgIGlkPSJwYXRoMzk3NyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlYmViZWIiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEyLjQ4NzY2MywyMDAuNjcgYyAwLjIsMC42IDAuMywxLjIgMC41LDEuOCAwLjIsLTAuNSAwLjUsLTEgMS4xLC0xLjQgLTAuNiwtNi4zIDAuNywtMTIuMiAzLjEsLTE4IC01LjEsNC45IC01LjUsMTEuMSAtNC43LDE3LjYgeiBtIDU1MS40OTk5OTcsMC4zIGMgMC4zLDAuOSAwLjUsMS44IDAuNiwyLjggMC4zLC0xIDAuNywtMi4xIDAuOSwtMy4yIDAuOCwtNi41IDAuNCwtMTIuNiAtNC43LC0xNy41IDIuNSw1LjcgMy44LDExLjcgMy4yLDE3LjkgeiBNIDQ0LjI4NzY2MywzOTcuMjcgSCA0NzEuODg3NjYgYyAyMS4xLDAgNDIuMiwwLjEgNjMuMywwIDE4LjMsLTAuMSAzMC4zLC05LjkgMzQsLTI3LjQgMS44LC04LjcgLTIuMywtMTkuMSAtOS4xLC0yMi43IDUsNC41IDYsMTAuNCA1LjYsMTYuNyAtMC4zLDEuMyAtMC42LDIuNSAtMC45LDMuOCAwLjUsOS43IC02LjksMjAuNiAtMTcuMSwyMy43IC0zLjcsMS4xIC03LjUsMS45IC0xMS42LDEuOSAtMTY0LjcsLTAuMSAtMzI5LjQsLTAuMSAtNDk0LjA5OTk5NywtMC4xIC0xNS43LDAgLTI1LjQsLTcuNyAtMjguOCwtMjIuNyAtMC4yLC0wLjkgLTAuNCwtMS44IC0wLjUsLTIuNiAtMC4zLC0xLjMgLTAuNSwtMi43IC0wLjUsLTQuMSAtMC4xLC02LjIgMC43LC0xMi4xIDUuNywtMTYuNSAtNi43LDMuNiAtMTAuODk5OTk5NywxNC4xIC05LjA5OTk5OTcsMjIuNyAzLjc5OTk5OTcsMTcuOSAxNS45OTk5OTk3LDI3LjMgMzUuNDk5OTk5NywyNy4zIHoiCiAgICAgY2xhc3M9InN0NTUiCiAgICAgaWQ9InBhdGgzOTc5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2ViZWJlYiIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY0LjA4NzY2LDM2My44NyBjIDAuNCwxLjIgMC41LDIuNSAwLjYsMy43IDAuMywtMS4yIDAuNywtMi41IDAuOSwtMy44IDAuNCwtNi4zIC0wLjYsLTEyLjIgLTUuNiwtMTYuNyAyLjgsNS4zIDQuNCwxMC44IDQuMSwxNi44IHogbSAtNTUxLjg5OTk5NywtMC4yIGMgMCwxLjQgMC4yLDIuOCAwLjUsNC4xIC0wLjEsLTEuNCAwLC0yLjcgMS4yLC0zLjkgLTAuMiwtNiAxLjQsLTExLjUgNC4xLC0xNi43IC01LjEsNC40IC01LjksMTAuMyAtNS44LDE2LjUgeiIKICAgICBjbGFzcz0ic3Q1NSIKICAgICBpZD0icGF0aDM5ODEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZWJlYmViIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NTkuMjg3NjYsNDI4LjA3IGMgMy41LDMgNS4xLDcgNi4yLDExLjMgMCwwLjMgMC4xLDAuNyAwLjEsMSAyLjgsMy4zIDEuMiw3LjYgMC45LDExLjIgLTAuNiw3LjYgLTMuMSwxNC42IC0xMSwxOCAtMS40LDAuOSAtMi44LDEuOSAtNC4xLDIuOCAtNCw0LjQgLTkuNCw0LjIgLTE0LjcsNC4yIEggNDAuNDg3NjYzIGMgLTUsMCAtMTAuMiwwLjEgLTE0LC00LjIgLTYuNCwtNC44IC0xMS41LC0xMC41IC0xMy40LC0xOC42IC0wLjQsLTIgLTEsLTQgLTAuNCwtNS45IC0wLjIsLTAuNyAtMC4zLC0xLjQgLTAuNSwtMi4xIC0wLjYsLTYuOSAxLjEsLTEzIDYuNCwtMTcuOCAtNy42LDMuOSAtOS42OTk5OTk3LDExIC0xMC4wOTk5OTk3LDE4LjUgLTEsMTguMiAxMy41OTk5OTk3LDMyLjggMzIuNTk5OTk5NywzMi44IDQ5LjksMC4xIDk5LjY5OTk5NywwIDE0OS41OTk5OTcsMCBoIDM0NC41IGMgMTAuNCwwIDE5LjUsLTMuMSAyNi42LC0xMS4yIDExLjMsLTEyLjUgMTAuMSwtMzIgLTIuNSwtNDAgeiIKICAgICBjbGFzcz0ic3Q1NyIKICAgICBpZD0icGF0aDM5ODUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZWNlY2VjIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjUuNTg3NjYsNDQwLjQ3IGMgMCwtMC4zIC0wLjEsLTAuNyAtMC4xLC0xIC0xLjEsLTQuMyAtMi43LC04LjMgLTYuMiwtMTEuMyAxLjYsMy42IDMuMSw3LjMgNC43LDEwLjkgMC43LDAuNCAxLjIsMC45IDEuNiwxLjQgeiBtIC01NTMuMTk5OTk3LDUuNSBjIDAuMSwwLjcgMC4zLDEuNCAwLjUsMi4xIDAuMiwtMC43IDAuNSwtMS4zIDEuMSwtMiAtMC40LC02LjUgMS43LC0xMi40IDQuOCwtMTcuOSAtNS4zLDQuOCAtNywxMC45IC02LjQsMTcuOCB6IgogICAgIGNsYXNzPSJzdDU3IgogICAgIGlkPSJwYXRoMzk4NyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlY2VjZWMiIC8+CiAgPHBhdGgKICAgICBkPSJNIDQ0LjE4NzY2MywzMTUuMTcgSCA0MzguMzg3NjYgYyAzMi4yLDAgNjQuNCwwLjIgOTYuNiwtMC4xIDE0LjUsLTAuMSAyNiwtNS41IDMxLjksLTE5LjkgNSwtMTIuMiAyLC0yNS4yIC03LjcsLTMxLjMgMy44LDMuMyA1LjUsNy43IDYuMywxMi41IDAuMSwwLjkgMC4xLDEuOCAwLjEsMi43IDIuOSw3IDAuNSwxNi44IC02LDIyLjIgLTIuOCwyLjMgLTUuNSw0LjYgLTguMyw3IC0zLjcsMy4zIC04LjEsNC4yIC0xMi44LDQuMiBIIDM5LjI4NzY2MyBjIC00LjcsMCAtOS4yLC0wLjkgLTEyLjgsLTQuMiAtNi44LC01LjEgLTEyLjEsLTExLjEgLTEzLjQsLTE5LjkgLTAuMiwtMS41IC0wLjYsLTMuMSAtMC4zLC00LjUgLTAuMiwtMC43IC0wLjMsLTEuMyAtMC40LC0yIC0wLjQsLTYuMyAwLjYsLTEyLjIgNS42LC0xNi44IC02LjcsMy42IC0xMC44OTk5OTk3LDE0LjEgLTkuMDk5OTk5NywyMi43IDMuNzk5OTk5NywxOCAxNS42OTk5OTk3LDI3LjQgMzUuMjk5OTk5NywyNy40IHoiCiAgICAgY2xhc3M9InN0NTUiCiAgICAgaWQ9InBhdGgzOTg5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2ViZWJlYiIgLz4KICA8cGF0aAogICAgIGQ9Im0gMTIuMzg3NjYzLDI4MS43NyBjIDAuMSwwLjcgMC4zLDEuMyAwLjQsMiAwLjIsLTAuNyAwLjUsLTEuNCAxLjEsLTIgLTAuMiwtNiAxLjQsLTExLjUgNC4xLC0xNi43IC01LDQuNSAtNi4xLDEwLjQgLTUuNiwxNi43IHogbSA1NTMuMzk5OTk3LC0yLjggYyAwLC0wLjkgMCwtMS44IC0wLjEsLTIuNyAtMC44LC00LjggLTIuNSwtOS4yIC02LjMsLTEyLjUgbCA0LjgsMTIuMyBjIDAuNiwxIDEuMSwxLjkgMS42LDIuOSB6IE0gMzIuNTg3NjYzLDY2LjA3IGMgOC41LDEuNyAxNywxLjMgMjUuNiwxLjMgSCA1MzMuMDg3NjYgYyAxMSwwIDIxLC0yLjUgMjguOCwtMTEuMSAxMS4yLC0xMi40IDkuMiwtMzQuOCAtMi41LC00MC4yIDMuNSwzIDUuMSw3IDYuMiwxMS4zIDAuMSwxLjEgMC4yLDIuMiAwLjIsMy4zIDMuMiw5LjMgLTAuNiwyMS40IC04LjgsMjUuNiAtMS44LDEuNCAtMy43LDIuOCAtNS41LDQuMiAtMy43LDMuMyAtOC4xLDQuMiAtMTIuOCw0LjIgSCAzOS40ODc2NjMgYyAtNC43LDAgLTkuMiwtMC45IC0xMi44LC00LjIgLTYuOCwtNS4xIC0xMi4xLC0xMS4xIC0xMy40LC0xOS45IC0wLjIsLTEuNSAtMC42LC0zLjEgLTAuMywtNC41IC0wLjIsLTAuNyAtMC4zLC0xLjQgLTAuNSwtMi4xIC0wLjYsLTYuOSAxLjIsLTEzIDYuNCwtMTcuOCAtMi43LDAuNiAtNC4zLDIuNyAtNS43LDQuOCAtMTEuMDk5OTk5NywxNi41IC0wLjIsNDEuMiAxOS40LDQ1LjEgeiIKICAgICBjbGFzcz0ic3Q1NSIKICAgICBpZD0icGF0aDM5OTEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZWJlYmViIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjMuOTg3NjYsMjYuOTcgYyAwLjcsMS4xIDEuMywyLjQgMS43LDMuNiAwLC0xLjEgLTAuMSwtMi4yIC0wLjIsLTMuMyAtMSwtNC4zIC0yLjcsLTguMyAtNi4yLC0xMS4zIDEuNiwzLjcgMy4yLDcuNCA0LjcsMTEgeiBtIC01NTEuNTk5OTk3LDYuOSBjIDAuMSwwLjcgMC4zLDEuNCAwLjUsMi4xIDAuMiwtMC43IDAuNSwtMS40IDEuMSwtMiAtMC40LC02LjUgMS44LC0xMi4zIDQuOCwtMTcuOSAtNS4zLDQuOCAtNywxMC45IC02LjQsMTcuOCB6IG0gMzEuMywxMTUuNiBIIDQwOS43ODc2NiBjIDQxLjgsMCA4My41LDAuMSAxMjUuMywtMC4xIDE0LjUsLTAuMSAyNi4xLC01LjUgMzIsLTE5LjkgNSwtMTIuMiAyLC0yNS4zIC03LjcsLTMxLjQgNS4xLDQuNyA2LjksMTAuNyA2LjQsMTcuNCAtMC4yLDEuNCAtMC41LDIuOCAtMC45LDQuMiAwLjUsNi43IC0yLjUsMTIuMyAtNy4yLDE3LjMgLTEuOSwyIC00LjEsMy43IC02LjEsNS41IC0zLjcsMy4zIC04LjEsNC4yIC0xMi44LDQuMiBIIDM5LjU4NzY2MyBjIC00LjcsMCAtOS4yLC0wLjkgLTEyLjgsLTQuMiAtMiwtMS4yIC00LjUsLTEuNyAtNS42LC00LjIgLTguMSwtNC4yIC0xMS44OTk5OTk3LC0xNi4yIC04LjgsLTI1LjQgMCwtMS4xIDAsLTIuMyAwLjEsLTMuNCAwLjUsLTQuNyAyLjksLTguMyA2LjQsLTExLjMgLTcuNSw0LjcgLTExLjY5OTk5OTcsMTUuMiAtOS43OTk5OTk3LDI0LjEgMy42OTk5OTk3LDE3LjkgMTUuNDk5OTk5NywyNy4yIDM0LjU5OTk5OTcsMjcuMiB6IgogICAgIGNsYXNzPSJzdDU1IgogICAgIGlkPSJwYXRoMzk5MyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlYmViZWIiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NC4xODc2NiwxMTYuMDcgYyAwLjMsMS4zIDAuNSwyLjUgMC42LDMuNyAwLjQsLTEuNCAwLjcsLTIuNyAwLjksLTQuMiAwLjUsLTYuOCAtMS4zLC0xMi43IC02LjQsLTE3LjQgMy4xLDUuNiA1LjMsMTEuNCA0LjksMTcuOSB6IG0gLTU1MS44OTk5OTcsLTYuNiBjIDAsMS4xIC0wLjEsMi4zIC0wLjEsMy40IDAuNCwtMS4zIDEsLTIuNiAxLjgsLTMuOCAtMC4yLC00LjQgMy4zLC03LjIgNC43LC0xMSAtMy41LDMuMSAtNS45LDYuNyAtNi40LDExLjQgeiIKICAgICBjbGFzcz0ic3Q1NSIKICAgICBpZD0icGF0aDM5OTUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZWJlYmViIiAvPgogIDxwYXRoCiAgICAgZD0ibSAzOS44ODc2NjMsMjI1Ljk3IGMgMS41LDAuNCAzLjIsMC4xIDQuOSwwLjEgSCA1MzMuMzg3NjYgYyA3LjEsMCAxMy44LC0xLjEgMTkuNiwtNS42IDEuMSwtMC44IDEuOSwtMS42IDIuMywtMi43IC0wLjMsMC4yIC0wLjUsMC40IC0wLjgsMC42IC01LjQsNC4xIC0xMS41LDUuNiAtMTguMiw1LjYgSCA0MS45ODc2NjMgYyAtNi43LDAgLTEyLjgsLTEuNSAtMTguMSwtNS41IDMuMyw1LjkgMTAsNi4xIDE2LDcuNSB6IgogICAgIGNsYXNzPSJzdDYxIgogICAgIGlkPSJwYXRoNDAxMSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNiZGJkYmQiIC8+CiAgPHBhdGgKICAgICBkPSJNIDQxLjg4NzY2MywyMjMuOTcgSCA1MzYuMTg3NjYgYyA2LjcsMCAxMi44LC0xLjUgMTguMiwtNS42IDAuMywtMC4yIDAuNiwtMC40IDAuOCwtMC42IDAuMiwtMC41IDAuMywtMS4xIDAuMiwtMS44IC03LjIsNC45IC0xNS4xLDYuMSAtMjMuNyw2LjEgLTE2MS44LC0wLjIgLTMyMy42LC0wLjIgLTQ4NS4zOTk5OTcsMCAtOC42LDAgLTE2LjUsLTEuMiAtMjMuNywtNi4xIDAuMywxIDAuNywxLjggMS4yLDIuNiA1LjQsNCAxMS40LDUuNCAxOC4xLDUuNCB6IgogICAgIGNsYXNzPSJzdDYxIgogICAgIGlkPSJwYXRoNDAxMyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNiZGJkYmQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU1NS45ODc2NiwyMTcuMTcgYyAwLjIsMC43IDAuMiwxLjMgMCwxLjkgMi43LC0yLjYgNC42LC01LjYgNiwtOS4xIC0xLjUsMi43IC0zLjQsNS4xIC02LDcuMiB6IG0gLTUzMy45OTk5OTcsMCBjIC0yLjQsLTEuOSAtNC4yLC00LjIgLTUuNywtNi43IDEuNCwzLjIgMy4zLDYgNS42LDguNCAtMC4xLC0wLjQgLTAuMSwtMSAwLjEsLTEuNyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDE1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjEuOTg3NjYzLDIxNy4xNyBjIDAuMSwtMC40IDAuMywtMC44IDAuNiwtMS4yIC00LC00LjMgLTYuNywtOS40IC04LjYsLTE1IDAuMywzLjQgMS4xLDYuNiAyLjMsOS41IDEuNSwyLjYgMy40LDQuOCA1LjcsNi43IHogbSA1MzkuOTk5OTk3LC03LjMgYyAxLC0yLjcgMS43LC01LjcgMiwtOC45IC0xLjksNS41IC00LjUsMTAuNiAtOC42LDE1IDAuMywwLjQgMC41LDAuOSAwLjYsMS4yIDIuNiwtMi4xIDQuNSwtNC41IDYsLTcuMyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDE3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU2LjA4NzY2LDIxOS4wNyBjIC0wLjQsMS4yIC0xLjcsMi4xIC0zLDMgLTUuMSwzLjYgLTEwLjcsNS4zIC0xNi45LDUuNCBIIDQ0LjU4NzY2MyBjIC03LjEsMCAtMTMuOCwtMS4yIC0xOS43LC01LjQgLTEuMywtMC45IC0yLjYsLTEuOSAtMywtMy4xIC0yLjQsLTIuNCAtNC4yLC01LjIgLTUuNiwtOC40IC0xLjUsLTIuNSAtMi41LC01LjIgLTMuNCwtOC4xIC0wLjQsMS4xIC0wLjEsMi40IDAuMiwzLjcgMy4xLDE0LjUgMTMuNywyMi44IDI5LjYsMjIuOCAxNjQuMTk5OTk3LDAgMzI4LjI5OTk5NywwIDQ5Mi40OTk5OTcsMC4xIDUuMywwIDEwLjEsLTEuMyAxNC44LC0zLjEgNy4xLC0yLjggMTUuNiwtMTMuMSAxNC41LC0yMiAtMC43LDIuMiAtMS42LDQuMiAtMi42LDYuMSAtMS4yLDMuNCAtMy4yLDYuNCAtNS44LDkgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDAxOSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDE0LjA4NzY2MywyMDAuOTcgYyAtMC41LDAuNCAtMC45LDAuOSAtMS4xLDEuNCAwLjgsMi45IDEuOSw1LjYgMy40LDguMSAtMS4zLC0yLjggLTIuMSwtNiAtMi4zLC05LjUgeiBtIDU0Ny44OTk5OTcsOC45IGMgMS4xLC0xLjkgMS45LC00IDIuNiwtNi4xIC0wLjEsLTAuOSAtMC4zLC0xLjkgLTAuNiwtMi44IC0wLjMsMy4zIC0xLDYuMiAtMiw4LjkgeiBtIC02LDcuMyBjIC0wLjIsMC4yIC0wLjUsMC40IC0wLjgsMC42IC0wLjQsMS4xIC0xLjIsMS45IC0yLjMsMi43IC01LjgsNC41IC0xMi41LDUuNiAtMTkuNiw1LjYgSCA0NC42ODc2NjMgYyAtMS42LDAgLTMuMywwLjMgLTQuOSwtMC4xIC01LjksLTEuNCAtMTIuNywtMS42IC0xNi4xLC03LjQgMCwwIC0wLjEsMCAtMC4xLC0wLjEgLTAuNiwtMC40IC0xLjEsLTAuOCAtMS43LC0xLjMgLTAuMiwwLjcgLTAuMiwxLjIgLTAuMSwxLjcgNC42LDQuNiAxMC44LDcuNSAxOCw3LjkgMi4zLDAuMSA0LjYsMC4xIDcsMC4xIEggNTMwLjk4NzY2IGMgNS4xLDAgMTAuMSwwIDE1LjEsLTEuOCA0LC0xLjUgNy4zLC0zLjUgOS45LC02IDAuMiwtMC42IDAuMywtMS4yIDAsLTEuOSB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDIxIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjMuNjg3NjYzLDIxOC40NyBjIC0wLjMsLTAuNyAtMC43LC0xLjUgLTEuMSwtMi41IC0wLjMsMC40IC0wLjUsMC45IC0wLjYsMS4yIDAuNiwwLjUgMS4xLDAuOSAxLjcsMS4zIHogbSA1MzEuNTk5OTk3LC0wLjcgYyAwLjMsLTAuMiAwLjUsLTAuNCAwLjgsLTAuNiAtMC4xLC0wLjQgLTAuMywtMC44IC0wLjYsLTEuMiAwLDAuNyAtMC4xLDEuMyAtMC4yLDEuOCB6IG0gLTI0LjIsOS4xIEggNDYuODg3NjYzIGMgLTIuMywwIC00LjYsMC4xIC03LC0wLjEgLTcuMiwtMC40IC0xMy41LC0zLjMgLTE4LC03LjkgMC40LDEuMyAxLjcsMi4yIDMsMy4xIDUuOSw0LjIgMTIuNSw1LjQgMTkuNyw1LjQgMTU0LjU5OTk5NywtMC4xIDMwOS4xOTk5OTcsMCA0NjMuNzk5OTk3LDAgaCAyNy44IGMgNi4yLDAgMTEuOCwtMS44IDE2LjksLTUuNCAxLjMsLTAuOSAyLjYsLTEuOCAzLC0zIC0yLjYsMi41IC01LjksNC41IC05LjksNiAtNSwxLjkgLTEwLDEuOSAtMTUuMSwxLjkgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDAyMyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDM4LjQ4NzY2MywxNDIuMzcgYyAyLjQsMC42IDUuMSwwLjEgNy42LDAuMSBIIDUzNC41ODc2NiBjIDUuMywwIDEwLjYsMCAxNS4zLC0yLjkgMC43LC0xIDEuNCwtMi4xIDIuMSwtMy4xIC01LjUsMyAtMTEuNCwzLjkgLTE3LjYsMy45IC0xNjMuOCwtMC4xIC0zMjcuNSwtMC4xIC00OTEuMjk5OTk3LDAgLTcuMSwwIC0xMy41LC0xLjUgLTE5LjYsLTUuMSAzLjMsNS41IDkuNiw1LjggMTUsNy4xIHoiCiAgICAgY2xhc3M9InN0NjEiCiAgICAgaWQ9InBhdGg0MDI1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2JkYmRiZCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNDMuMjg3NjYzLDE0MC40NyBjIDE2My43OTk5OTcsLTAuMSAzMjcuNDk5OTk3LC0wLjEgNDkxLjI5OTk5NywwIDYuMiwwIDEyLjEsLTAuOCAxNy42LC0zLjkgMC43LC0wLjkgMS4zLC0xLjkgMiwtMi44IC02LjYsMy44IC0xMy44LDQuNyAtMjEuNCw0LjcgLTE2Mi42LC0wLjEgLTMyNS4yLC0wLjEgLTQ4Ny43OTk5OTcsMCAtOC4yLDAgLTE1LjYsLTEuMyAtMjIuNCwtNS44IDAuMywxLjEgMC43LDIgMS4yLDIuOCA1LjksMy42IDEyLjQsNSAxOS41LDUgeiIKICAgICBjbGFzcz0ic3Q2MSIKICAgICBpZD0icGF0aDQwMjciCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojYmRiZGJkIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NDguOTg3NjYsMTQxLjc3IGMgLTAuNCwwLjMgLTAuOCwwLjUgLTEuMiwwLjggMC4xLC0wLjEgMC4yLC0wLjEgMC40LC0wLjIgMi45LC0xLjggNS41LC0zLjggNy43LC02LjEgLTAuOCwwLjYgLTEuNiwxLjIgLTIuNSwxLjcgLTEuMiwxLjUgLTMuMSwyLjUgLTQuNCwzLjggeiBtIDExLjcsLTEyLjkgYyAtMC4zLDEuMSAtMC43LDIuMiAtMS4yLDMuMSAxLjUsLTIuMiAyLjcsLTQuNiAzLjUsLTcuMiAtMC4yLDAuNSAtMC40LDEgLTAuNiwxLjQgLTAuNiwxIC0xLjIsMS44IC0xLjcsMi43IHogbSAtMTU1LjksMTUuNiBIIDQ1Ljc4NzY2MyBjIC02LjgsMCAtMTMuNSwtMC41IC0xOS40LC00LjMgLTIuNCwtMS41IC01LC0zIC00LjQsLTYuMSAtNCwtMy40IC02LjUsLTcuOCAtOC4yLC0xMi42IC0wLjIsMy45IDEuMSw3LjMgMywxMC41IDEuMywxLjkgMi45LDMuNyA0LjksNS40IDIuNSwxLjggNSwzLjUgNy43LDQuOCA0LjEsMiA4LjQsMi41IDEyLjgsMi41IEggNTM1Ljg4NzY2IGMgMi4xLDAgNC4xLC0wLjEgNi4xLC0wLjUgLTEuOSwwLjIgLTMuOSwwLjIgLTUuOCwwLjIgLTQzLjcsMC4xIC04Ny42LDAuMSAtMTMxLjQsMC4xIHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQwMjkiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSAyMS45ODc2NjMsMTM0LjE3IGMgMC4xLC0wLjUgMC4yLC0xIDAuNSwtMS41IC0zLjksLTQgLTYuMywtOC45IC04LjMsLTEzLjkgLTAuMiwxIC0wLjMsMS45IC0wLjQsMi44IDEuNyw0LjggNC4yLDkuMSA4LjIsMTIuNiB6IG0gNTQwLjI5OTk5NywtNy45IGMgMC4yLC0wLjUgMC40LC0xIDAuNiwtMS40IDAuOCwtMi43IDEuMywtNS41IDEuMiwtOC43IC0xLDMuMiAtMiw2LjQgLTMsOS43IC0wLjEsMS4xIC0wLjMsMi4xIC0wLjUsMy4xIDAuNiwtMSAxLjIsLTEuOCAxLjcsLTIuNyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDMxIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU5LjQ4NzY2LDEzMS45NyBjIC0wLjksMS43IC0yLjEsMy4xIC0zLjYsNC40IC0yLjIsMi4yIC00LjgsNC4yIC03LjcsNi4xIC0wLjEsMC4xIC0wLjIsMC4xIC0wLjQsMC4yIC0xLjgsMS4xIC0zLjcsMS41IC01LjcsMS44IC0yLDAuMyAtNCwwLjUgLTYuMSwwLjUgSCA0Mi4yODc2NjMgYyAtNC41LDAgLTguOCwtMC41IC0xMi44LC0yLjUgLTIuNywtMS40IC01LjMsLTMgLTcuNywtNC44IC0yLC0xLjcgLTMuNiwtMy41IC00LjksLTUuNCAxLjMsMi4yIDIuOCw0LjIgNC4zLDYuMyAxLDIuNSAzLjYsMyA1LjYsNC4yIDEyLjQsMy43IDI1LjIsMi44IDM3LjksMi44IEggNTE0LjQ4NzY2IGMgMTIuNCwwIDI1LDAuOSAzNy4yLC0yLjggMi4xLC0xLjggNC4zLC0zLjUgNi4xLC01LjUgNC43LC01IDcuNywtMTAuNiA3LjIsLTE3LjMgLTAuNSwxLjcgLTEuMSwzLjQgLTEuOCw1IC0xLjEsMi40IC0yLjMsNC44IC0zLjcsNyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDMzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTYyLjg4NzY2LDEyNC43NyBjIDAuNywtMS42IDEuMywtMy4zIDEuOCwtNSAtMC4xLC0xLjIgLTAuMywtMi40IC0wLjYsLTMuNyAwLjEsMy4yIC0wLjQsNi4xIC0xLjIsOC43IHogbSAtOS41LDEzLjMgYyAtMSwwLjYgLTIuMiwxLjIgLTMuNCwxLjcgLTQuOCwyLjggLTEwLDIuOSAtMTUuMywyLjkgLTE2Mi44LC0wLjEgLTMyNS43LDAgLTQ4OC40OTk5OTcsMCAtMi42LDAgLTUuMiwwLjUgLTcuNiwtMC4xIC01LjUsLTEuMyAtMTEuNywtMS43IC0xNC44LC03IC0wLjEsLTAuMSAtMC4yLC0wLjEgLTAuMywtMC4yIC0wLjUsLTAuNCAtMC45LC0wLjggLTEuNCwtMS4yIC0wLjYsMy4xIDIuMSw0LjYgNC40LDYuMSA1LjksMy44IDEyLjUsNC4zIDE5LjQsNC4zIDExOS42OTk5OTcsLTAuMSAyMzkuMjk5OTk3LDAgMzU4Ljk5OTk5NywwIGggMTMxLjUgYyAxLjksMCAzLjksMCA1LjgsLTAuMiAxLjksLTAuMyAzLjgsLTAuOSA1LjcsLTEuOCAwLjQsLTAuMiAwLjgsLTAuNSAxLjIsLTAuOCAxLjIsLTEuMyAzLjEsLTIuMyA0LjMsLTMuNyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDM1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjMuMzg3NjYzLDEzNS4yNyBjIDAuMSwwLjEgMC4yLDAuMSAwLjMsMC4yIC0wLjUsLTAuOCAtMC45LC0xLjcgLTEuMiwtMi44IC0wLjIsMC41IC0wLjQsMSAtMC41LDEuNSAwLjUsMC4zIDAuOSwwLjcgMS40LDEuMSB6IG0gNTI0LjM5OTk5Nyw3LjMgYyAtMS44LDAuOSAtMy43LDEuNCAtNS43LDEuOCAyLC0wLjMgMy45LC0wLjggNS43LC0xLjggeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDAzNyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEyLjc4NzY2MywxMTguNTcgYyAwLC0wLjIgLTAuMSwtMC40IC0wLjEsLTAuNSAwLDEuNiAwLjEsMy4xIDAuMyw0LjcgMC4xLC0wLjcgMC4yLC0xLjQgMC41LC0yLjEgLTAuMywtMC43IC0wLjUsLTEuNCAtMC43LC0yLjEgeiIKICAgICBjbGFzcz0ic3Q2MiIKICAgICBpZD0icGF0aDQwMzkiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZThlOGU4IiAvPgogIDxwYXRoCiAgICAgZD0ibSAxMi43ODc2NjMsMTE4LjU3IGMgMC4yLDAuNyAwLjQsMS40IDAuNiwyIDAuMiwtMC42IDAuNCwtMS4yIDAuNywtMS45IDAsLTMuMiAtMC4xLC02LjQgLTAuMSwtOS42IC0wLjgsMy4xIC0xLjMsNiAtMS4zLDguOSAwLDAuMiAwLjEsMC40IDAuMSwwLjYgeiIKICAgICBjbGFzcz0ic3Q2MiIKICAgICBpZD0icGF0aDQwNDEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZThlOGU4IiAvPgogIDxwYXRoCiAgICAgZD0ibSAxMi45ODc2NjMsMTIyLjY3IGMgLTAuMiwtMS41IC0wLjMsLTMuMSAtMC4zLC00LjcgLTAuNCwtMS43IC0wLjUsLTMuNCAtMC41LC01LjEgLTMuMDk5OTk5Nyw5LjIgMC43LDIxLjIgOC44LDI1LjQgLTQuNCwtNC41IC04LjksLTkuMSAtOCwtMTUuNiB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDA0MyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEzLjk4NzY2MywxMDkuMTcgYyAtMC43LDEuMiAtMS4zLDIuNSAtMS44LDMuOCAwLDEuNyAwLjEsMy40IDAuNSw1LjEgMC4xLC0yLjkgMC41LC01LjkgMS4zLC04LjkgeiBtIC0wLjIsMTIuMyAtMC4zLC0wLjkgYyAtMC4yLDAuNyAtMC40LDEuNCAtMC41LDIuMSAwLjUsMy4zIDEuNyw2LjQgMy44LDkuMyAtMS45LC0zLjEgLTMuMiwtNi41IC0zLC0xMC41IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MDQ1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMTMuNzg3NjYzLDEyMS40NyBjIDAsLTAuOSAwLjIsLTEuOCAwLjQsLTIuOCAtMC4zLDAuNiAtMC41LDEuMyAtMC43LDEuOSB6IG0gMywxMC42IGMgLTIsLTIuOSAtMy4yLC02IC0zLjgsLTkuMyAtMC45LDYuNSAzLjYsMTEuMSA4LDE1LjcgLTEuNSwtMi4yIC0zLC00LjMgLTQuMiwtNi40IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MDQ3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU2Ljc4NzY2LDEzMy4zNyBjIC0wLjgsMC43IC0xLjYsMS4zIC0yLjQsMS45IDAsMC4zIDAsMC42IC0wLjEsMC44IDAuOCwtMC44IDEuNywtMS43IDIuNSwtMi43IHoiCiAgICAgY2xhc3M9InN0NjMiCiAgICAgaWQ9InBhdGg0MDQ5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2NkY2RjZSIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU2Ljc4NzY2LDEzMy4zNyBjIDEuOCwtMi4zIDMuMywtNC44IDQuNCwtNy42IC0yLjMsMi43IC00LjcsNS40IC03LDguMSAwLjEsMC42IDAuMiwxIDAuMiwxLjUgMC44LC0wLjcgMS42LC0xLjMgMi40LC0yIHogbSAtMi42LDIuOCBjIDAsLTAuMyAwLjEsLTAuNSAwLjEsLTAuOCAtMC42LDAuNCAtMS4xLDAuNyAtMS43LDEuMSAtMC4xLDAuMSAtMC4zLDAuMSAtMC40LDAuMiAtMC43LDEgLTEuNCwyLjEgLTIuMSwzLjEgMS40LC0xLjEgMi44LC0yLjMgNC4xLC0zLjYgeiIKICAgICBjbGFzcz0ic3Q2MyIKICAgICBpZD0icGF0aDQwNTEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2RjZGNlIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NTIuMTg3NjYsMTM2LjY3IGMgMC4xLC0wLjEgMC4zLC0wLjEgMC40LC0wLjIgMC42LC0wLjMgMS4yLC0wLjcgMS43LC0xLjEgMCwtMC41IC0wLjEsLTEgLTAuMiwtMS41IC0wLjYsMC45IC0xLjMsMS44IC0xLjksMi44IHogbSA0LjYsLTMuMyBjIC0wLjgsMSAtMS42LDEuOSAtMi41LDIuOCAtMC4xLDAuNyAtMC40LDEuMyAtMC45LDEuOSAwLjksLTAuNSAxLjcsLTEuMSAyLjUsLTEuNyAxLjQsLTEuNCAyLjYsLTIuOCAzLjYsLTQuNCAwLjUsLTAuOSAwLjksLTIgMS4yLC0zLjEgLTEuMiwxLjYgLTIuNSwzLjIgLTMuOSw0LjUgeiIKICAgICBjbGFzcz0ic3Q2MyIKICAgICBpZD0icGF0aDQwNTMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2RjZGNlIiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjAuNjg3NjYsMTI4Ljg3IGMgMC4zLC0xIDAuNCwtMiAwLjUsLTMuMSAtMS4xLDIuOCAtMi42LDUuNCAtNC40LDcuNiAxLjQsLTEuMyAyLjcsLTIuOSAzLjksLTQuNSB6IG0gLTEuMiwzLjEgYyAtMS4xLDEuNSAtMi4zLDMgLTMuNiw0LjQgMS40LC0xLjMgMi42LC0yLjcgMy42LC00LjQgeiBtIC05LjUsNy43IGMgMS4yLC0wLjUgMi4zLC0xLjEgMy40LC0xLjcgMC40LC0wLjUgMC43LC0xLjIgMC45LC0xLjkgLTEuNCwxLjQgLTIuOCwyLjYgLTQuMywzLjYgeiIKICAgICBjbGFzcz0ic3Q2MyIKICAgICBpZD0icGF0aDQwNTUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2RjZGNlIiAvPgogIDxwYXRoCiAgICAgZD0ibSAyOC4yODc2NjMsMzg3Ljg3IGMgMiwxLjEgNC4yLDEuOSA2LjUsMi41IEggNTQwLjI4NzY2IGMgNSwtMS45IDExLjIsLTIgMTQuMSwtNy4yIC02LjIsMy44IC0xMi45LDUuMSAtMjAuMiw1LjEgLTE2My41LC0wLjEgLTMyNy4xLC0wLjEgLTQ5MC41OTk5OTcsMCAtNi40LDAgLTEyLjUsLTAuNiAtMTguMSwtNCAtMC4xLC0wLjEgLTAuMiwtMC4xIC0wLjMsLTAuMiAxLDEuMSAyLjIsMiAyLjcsMy40IHoiCiAgICAgY2xhc3M9InN0NjEiCiAgICAgaWQ9InBhdGg0MDU3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2JkYmRiZCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjUuNTg3NjYzLDM4NC4yNyBjIDUuNiwzLjQgMTEuNyw0IDE4LjEsNCAxNjMuNDk5OTk3LC0wLjEgMzI3LjA5OTk5NywtMC4xIDQ5MC41OTk5OTcsMCA3LjMsMCAxNCwtMS40IDIwLjIsLTUuMSAwLjUsLTAuOCAwLjgsLTEuNyAxLjEsLTIuOCAtNi41LDQuNiAtMTMuNyw1LjkgLTIxLjYsNS45IC0xNjMuMSwtMC4xIC0zMjYuMiwtMC4xIC00ODkuMTk5OTk3LDAgLTcuNCwwIC0xNC4zLC0wLjkgLTIwLjYsLTQuNyAwLjEsMS4xIDAuNywxLjggMS4zLDIuNiAtMC4xLDAgMCwwLjEgMC4xLDAuMSB6IG0gOS4yLDYuMSBjIC0yLjMsLTAuNiAtNC41LC0xLjQgLTYuNSwtMi41IDEuOCwyIDQuMSwyLjQgNi41LDIuNSB6IgogICAgIGNsYXNzPSJzdDYxIgogICAgIGlkPSJwYXRoNDA1OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNiZGJkYmQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDE0Ljk4NzY2MywzNzIuNzcgYyAwLjcsMi4xIDEuNyw0LjEgMi45LDUuOSAtMC42LC0xLjEgLTEuMSwtMi4zIC0xLjUsLTMuNSAtMC41LC0wLjggLTAuOSwtMS42IC0xLjQsLTIuNCB6IG0gNTQxLjA5OTk5Nyw5LjEgYyAwLjEsMC41IDAuMiwxIDAuMSwxLjQgMi41LC0yLjUgNC41LC01LjQgNS44LC04LjcgLTEuNSwyLjYgLTMuNCw1LjEgLTUuOSw3LjMgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDA2MSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDE0Ljk4NzY2MywzNzIuNzcgMS41LDIuNCBjIC0wLjQsLTEuNCAtMC43LC0yLjkgLTAuOSwtNC41IC0xLjksLTEuOSAtMC41LC00LjcgLTEuNiwtNi44IC0wLjQsMy4xIDAsNiAxLDguOSB6IG0gNTQ2Ljk5OTk5NywxLjcgYyAxLjMsLTMuMiAyLjEsLTYuOCAyLjEsLTEwLjYgLTEuOCw2IC00LjEsMTEuOCAtOC42LDE2LjUgMC4zLDAuNSAwLjUsMSAwLjYsMS41IDIuNSwtMi4yIDQuNCwtNC43IDUuOSwtNy40IHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQwNjMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NTYuMTg3NjYsMzgzLjI3IGMgLTAuMywxLjkgLTIuMywzLjEgLTQsNC4xIC00LjIsMi41IC04LjcsNCAtMTMuNyw0LjMgaCAtMC42IGMgLTEuNCwwLjMgLTIuOCwwLjEgLTQuMiwwIEggNDQuMDg3NjYzIGMgLTEuMywwLjEgLTIuNywwLjMgLTQsMCBoIC0wLjYgYyAtNC4xLC0wLjMgLTguMiwtMC4zIC0xMS44LC0yLjcgLTEsLTEuMiAtMi41LC0yLjIgLTMuNCwtMy40IC0yLjgsLTEuOCAtNSwtNC4xIC02LjUsLTYuOSAtMS4zLC0xLjkgLTIuMiwtMy45IC0yLjksLTUuOSAtMC4zLC0wLjUgLTAuNiwtMC45IC0wLjgsLTEuNCAtMC43LC0xLjEgLTEuMiwtMi4zIC0xLjUsLTMuNSAwLjEsMC45IDAuMywxLjcgMC41LDIuNiAzLjUsMTQuOSAxMy4yLDIyLjYgMjguOSwyMi42IDE2NC42OTk5OTcsMCAzMjkuMzk5OTk3LDAgNDk0LjA5OTk5NywwLjEgNCwwIDcuOSwtMC44IDExLjYsLTEuOSAxMC4yLC0zLjEgMTcuNiwtMTQuMSAxNy4xLC0yMy43IC0wLjcsMi40IC0xLjYsNC43IC0yLjcsNi45IC0xLjQsMy4zIC0zLjQsNi4zIC01LjksOC44IHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQwNjUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjEuOTg3NjYsMzc0LjQ3IGMgMS4yLC0yLjEgMiwtNC41IDIuNywtNi45IC0wLjEsLTEuMyAtMC4zLC0yLjUgLTAuNiwtMy43IDAsMy44IC0wLjgsNy40IC0yLjEsMTAuNiB6IG0gLTU0Ni45OTk5OTcsLTEuNyBjIC0wLjksLTIuOCAtMS40LC01LjggLTEuMSwtOC45IC0xLjEsMS4yIC0xLjMsMi42IC0xLjIsMy45IDAuMywxLjIgMC43LDIuNCAxLjUsMy41IDAuMiwwLjUgMC41LDEgMC44LDEuNSB6IG0gMTEsMTMuOCBjIDAuOCwwLjUgMS41LDAuOSAyLjMsMS40IGwgLTAuMywtMC4zIGMgLTAuNywtMC40IC0xLjQsLTAuOCAtMiwtMS4xIHogbSA1MzAuMDk5OTk3LC00LjcgYyAtMC40LDAuNCAtMC45LDAuOCAtMS40LDEuMiAtMC4xLDAuMSAtMC4yLDAuMSAtMC4zLDAuMiAtMi45LDUuMiAtOS4xLDUuMyAtMTQuMSw3LjIgbCAtMC42LDAuNiBjIDEuNCwtMC4xIDIuOCwtMC40IDQuMiwtMC43IDQuOSwtMS4zIDkuMSwtMy43IDEyLjQsLTcgMCwtMC42IC0wLjEsLTEgLTAuMiwtMS41IHogbSAtNTIxLjI5OTk5Nyw4LjUgYyAxLjIsMC4zIDIuNCwwLjUgMy42LDAuNiAtMC4yLC0wLjIgLTAuNSwtMC40IC0wLjcsLTAuNiB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDY3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU0Ljc4NzY2LDM4Mi45NyBjIDAuNSwtMC40IDAuOSwtMC44IDEuNCwtMS4yIC0wLjEsLTAuNSAtMC4zLC0wLjkgLTAuNiwtMS41IC0wLjMsMS4xIC0wLjYsMiAtMS4xLDIuOCAwLDAgMC4xLDAgMC4zLC0wLjEgeiBtIC01MDkuNzk5OTk3LDguNyBoIC0wLjggNDg5LjU5OTk5NyAtMC42IGMgLTE2Mi44LDAuMSAtMzI1LjUsMC4xIC00ODguMTk5OTk3LDAgeiBtIDQ5NC42OTk5OTcsLTAuOCBjIC0wLjUsMC40IC0xLjEsMC43IC0xLjcsMC44IGggMC42IGMgNC45LC0wLjMgOS41LC0xLjggMTMuNywtNC4zIDEuOCwtMS4xIDMuOCwtMi4yIDQsLTQuMSAtMy4zLDMuMyAtNy41LDUuNyAtMTIuNCw3IC0xLjUsMC4zIC0yLjksMC41IC00LjIsMC42IHogbSAtNTA0Ljg5OTk5NywtMC41IGMgLTIuNCwtMC4xIC00LjcsLTAuNSAtNi41LC0yLjUgLTAuOCwtMC40IC0xLjYsLTAuOSAtMi4zLC0xLjQgbCAtMS41LC0wLjkgYyAwLjksMS4yIDIuNCwyLjIgMy40LDMuNCAzLjYsMi40IDcuNywyLjQgMTEuOCwyLjcgaCAwLjYgYyAtMC42LC0wLjEgLTEuMiwtMC40IC0xLjcsLTAuOCAtMS40LDAgLTIuNiwtMC4zIC0zLjgsLTAuNSB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDY5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjMuNTg3NjYzLDM4My4wNyBjIC0wLjgsLTAuNSAtMS41LC0xLjEgLTIuMSwtMS43IDAuNywwLjggMS40LDEuNiAyLjIsMi4zIC0wLjEsLTAuMSAtMC4xLC0wLjMgLTAuMSwtMC42IHoiCiAgICAgY2xhc3M9InN0NjQiCiAgICAgaWQ9InBhdGg0MDcxIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2NmY2ZjZiIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjMuNTg3NjYzLDM4My4wNyBjIDAsLTAuNSAwLjEsLTEgMC40LC0xLjYgLTMuNCwtMy4xIC02LC02LjkgLTguNSwtMTAuOSAxLjMsNC4xIDMuMyw3LjYgNiwxMC43IDAuNywwLjcgMS40LDEuMyAyLjEsMS44IHogbSA0LjQsNC41IGMgLTAuNSwtMS40IC0xLjcsLTIuMyAtMi43LC0zLjQgLTAuNiwtMC4zIC0xLjEsLTAuNiAtMS42LC0xIHYgMC42IGMgMS4zLDEuMyAyLjgsMi42IDQuMywzLjggeiIKICAgICBjbGFzcz0ic3Q2NCIKICAgICBpZD0icGF0aDQwNzMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2ZjZmNmIiAvPgogIDxwYXRoCiAgICAgZD0ibSAyNS4yODc2NjMsMzg0LjA3IGMgLTAuNiwtMC43IC0xLjIsLTEuNSAtMS4zLC0yLjYgLTAuMiwwLjYgLTAuMywxLjEgLTAuNCwxLjYgMC42LDAuNCAxLjEsMC43IDEuNywxIHogbSAtMSwxLjMgYyAtMC4zLC0wLjUgLTAuNSwtMSAtMC42LC0xLjYgLTAuOCwtMC44IC0xLjUsLTEuNSAtMi4yLC0yLjMgLTIsLTEuOCAtMy42LC0zLjkgLTUuMSwtNi4yIDAuNCwxLjMgMC45LDIuNCAxLjUsMy41IDEuNywyLjQgMy45LDQuNyA2LjQsNi42IHoiCiAgICAgY2xhc3M9InN0NjQiCiAgICAgaWQ9InBhdGg0MDc1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2NmY2ZjZiIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjEuNDg3NjYzLDM4MS4zNyBjIC0yLjYsLTMuMSAtNC43LC02LjYgLTYsLTEwLjcgMC4yLDEuNiAwLjUsMy4xIDAuOSw0LjUgMS41LDIuMyAzLjEsNC40IDUuMSw2LjIgeiBtIC0zLjYsLTIuNyBjIDEuNSwyLjggMy43LDUuMSA2LjUsNi45IC0wLjEsLTAuMSAtMC4xLC0wLjIgLTAuMiwtMC4zIC0yLjQsLTEuOCAtNC42LC00LjEgLTYuMywtNi42IHogbSA1LjgsNS4xIGMgMC4xLDAuNiAwLjMsMS4xIDAuNiwxLjYgMC42LDAuNCAxLjEsMC44IDEuNywxLjIgMC43LDAuNCAxLjMsMC43IDIsMSAtMS41LC0xLjIgLTMsLTIuNSAtNC4zLC0zLjggeiIKICAgICBjbGFzcz0ic3Q2NCIKICAgICBpZD0icGF0aDQwNzciCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2ZjZmNmIiAvPgogIDxwYXRoCiAgICAgZD0ibSAyNC4yODc2NjMsMzg1LjM3IGMgMC4xLDAuMSAwLjEsMC4yIDAuMiwwLjMgbCAxLjUsMC45IGMgLTAuNiwtMC40IC0xLjIsLTAuOCAtMS43LC0xLjIgeiIKICAgICBjbGFzcz0ic3Q2NCIKICAgICBpZD0icGF0aDQwNzkiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojY2ZjZmNmIiAvPgogIDxwYXRoCiAgICAgZD0ibSAzOC40ODc2NjMsNjAuMjcgYyAxLjUsMC40IDMuMiwwLjEgNC45LDAuMSAxNjMuNzk5OTk3LDAgMzI3LjQ5OTk5NywwIDQ5MS4yOTk5OTcsMC4xIDYsMCAxMS40LC0xLjMgMTYuNiwtNC4yIDEuNiwtMC45IDMuMSwtMS45IDMuOCwtMy41IC0wLjEsMC4xIC0wLjMsMC4yIC0wLjQsMC4zIC02LjMsMy45IC0xMy4xLDUuMyAtMjAuNSw1LjMgLTE2My40LC0wLjEgLTMyNi45LC0wLjEgLTQ5MC4yOTk5OTcsMCAtNy4zLDAgLTE0LC0xLjMgLTIwLjEsLTUuMSAzLDUuMyA5LjMsNS42IDE0LjcsNyB6IgogICAgIGNsYXNzPSJzdDYxIgogICAgIGlkPSJwYXRoNDA4MSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNiZGJkYmQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDQzLjc4NzY2Myw1OC4zNyBjIDE2My4zOTk5OTcsLTAuMSAzMjYuODk5OTk3LC0wLjEgNDkwLjI5OTk5NywwIDcuNCwwIDE0LjIsLTEuNCAyMC41LC01LjMgMC4xLC0wLjEgMC4zLC0wLjIgMC40LC0wLjMgMC4zLC0wLjYgMC41LC0xLjQgMC41LC0yLjIgLTYuOCw0LjYgLTE0LjIsNS44IC0yMi40LDUuOCAtMTYyLjgsLTAuMSAtMzI1LjUsLTAuMSAtNDg4LjI5OTk5NywwIC04LjIsMCAtMTUuNiwtMS4zIC0yMi40LC01LjggMC4zLDEuMSAwLjcsMiAxLjIsMi44IDYuMywzLjcgMTMsNSAyMC4yLDUgeiIKICAgICBjbGFzcz0ic3Q2MSIKICAgICBpZD0icGF0aDQwODMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojYmRiZGJkIiAvPgogIDxwYXRoCiAgICAgZD0ibSAyMS45ODc2NjMsNTEuODcgYyAtMi45LC0yLjUgLTUuMSwtNS41IC02LjYsLTguOCAxLjQsNC4yIDMuNyw3LjggNi45LDExIC0wLjQsLTAuNiAtMC41LC0xLjMgLTAuMywtMi4yIHogbSA1MTAuMTk5OTk3LDEwLjUgYyAtMTYyLjEsMCAtMzI0LjIsMCAtNDg2LjI5OTk5NywwLjEgLTYuNiwwIC0xMi45LC0wLjUgLTE4LjYsLTMuOSAwLjgsMC42IDEuNywxLjIgMi41LDEuNyAzLjgsMS45IDcuOSwyLjQgMTIuMiwyLjQgSCA1MzUuNzg3NjYgYyA0LjUsMCA4LjgsLTAuNSAxMi44LC0yLjUgMS40LC0wLjcgMi43LC0xLjcgNCwtMi43IC0zLjksMi45IC04LjUsNC40IC0xMy40LDQuOCAtMi40LDAuMiAtNC43LDAuMSAtNywwLjEgeiBtIDMyLjEsLTIzIGMgLTEuNyw0LjggLTQuMiw5LjIgLTguMiwxMi42IDAuNCwxLjkgLTAuNiwzLjIgLTEuOSw0LjMgMC42LC0wLjUgMS4zLC0wLjkgMiwtMS4zIDIuNCwtMS43IDQuMywtMy44IDUuOCwtNi4yIDEuNSwtMi45IDIuNCwtNiAyLjMsLTkuNCB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MDg1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjEuOTg3NjYzLDUxLjg3IGMgMC4xLC0wLjQgMC4zLC0wLjkgMC41LC0xLjQgLTQuNSwtNC43IC03LjIsLTEwLjMgLTguNiwtMTYuNSAwLDMuMyAwLjUsNi40IDEuNCw5LjIgMS42LDMuMyAzLjgsNi4yIDYuNyw4LjcgeiBNIDU2NC4yODc2NiwzOS4zNyBjIDAsLTAuOSAtMC4yLC0xLjggLTAuNCwtMi44IC0yLjEsNS4xIC00LjQsMTAgLTguMywxMy45IDAuMywwLjUgMC41LDEgMC42LDEuNCAzLjksLTMuNCA2LjMsLTcuNyA4LjEsLTEyLjUgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDA4NyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU1Ni4xODc2Niw1NC44NyBjIC0wLjcsMC40IC0xLjMsMC44IC0yLDEuMyAtMC41LDAuNCAtMSwwLjggLTEuNSwxLjEgbCAtMC4xLDAuMSBjIC0xLjMsMSAtMi41LDEuOSAtNCwyLjcgLTQsMiAtOC4zLDIuNSAtMTIuOCwyLjUgSCA0MS45ODc2NjMgYyAtNC4yLDAgLTguMywtMC41IC0xMi4yLC0yLjQgLTAuOSwtMC42IC0xLjcsLTEuMSAtMi41LC0xLjcgLTAuNiwtMC40IC0xLjMsLTAuOCAtMS45LC0xLjIgLTEuMywtMC45IC0yLjYsLTEuOSAtMy4zLC0zLjEgLTMuMSwtMy4yIC01LjUsLTYuOCAtNi45LC0xMSAtMS4xLC0yLjIgLTEuOSwtNC42IC0yLjUsLTcuMiAtMC4zLDEuNCAwLjEsMyAwLjMsNC41IDEuMyw4LjggNi42LDE0LjkgMTMuNCwxOS45IDEyLjIsMy43IDI0LjcsMi44IDM3LjIsMi44IEggNTEzLjM4NzY2IGMgMTIuNywwIDI1LjQsMC45IDM3LjksLTIuOCAxLjgsLTEuNCAzLjcsLTIuOCA1LjUsLTQuMiAxLjgsLTIuNCAzLjYsLTQuOSA1LC03LjUgLTEuMywyLjQgLTMuMiw0LjUgLTUuNiw2LjIgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDA4OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDEzLjg4NzY2MywzMy45NyBjIC0wLjYsMC42IC0wLjksMS4zIC0xLjEsMiAwLjYsMi41IDEuNCw0LjkgMi41LDcuMiAtMC45LC0yLjggLTEuNCwtNS45IC0xLjQsLTkuMiB6IG0gNTQyLjE5OTk5NywxNy45IGMgLTAuMywwLjMgLTAuNywwLjYgLTEsMC44IC0wLjcsMS42IC0yLjIsMi42IC0zLjgsMy41IC01LjIsMi45IC0xMC42LDQuMiAtMTYuNiw0LjIgLTE2My44LC0wLjEgLTMyNy41LC0wLjEgLTQ5MS4yOTk5OTcsLTAuMSAtMS42LDAgLTMuMywwLjMgLTQuOSwtMC4xIC01LjUsLTEuNCAtMTEuNywtMS43IC0xNC44LC03IC0wLjEsLTAuMSAtMC4zLC0wLjEgLTAuNCwtMC4yIC0wLjUsLTAuNCAtMC45LC0wLjggLTEuNCwtMS4yIC0wLjIsMC45IC0wLjEsMS42IDAuMiwyLjIgMS41LDEuNiAzLjMsMyA1LjEsNC40IDUuNiwzLjQgMTIsMy45IDE4LjYsMy45IDE2Mi4wOTk5OTcsLTAuMSAzMjQuMTk5OTk3LC0wLjEgNDg2LjI5OTk5NywtMC4xIDIuMywwIDQuNiwwLjEgNywtMC4xIDQuOSwtMC40IDkuNSwtMS45IDEzLjQsLTQuOCAwLjUsLTAuNCAxLjEsLTAuOCAxLjYsLTEuMiAxLjQsLTEgMi40LC0yLjMgMiwtNC4yIHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQwOTEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSAyMy4yODc2NjMsNTMuMDcgYyAwLjEsMC4xIDAuMywwLjEgMC40LDAuMiAtMC41LC0wLjggLTAuOSwtMS43IC0xLjIsLTIuOCAtMC4zLDAuNSAtMC40LDEgLTAuNSwxLjQgMC40LDAuNCAwLjgsMC44IDEuMywxLjIgeiBtIDUzMi43OTk5OTcsLTEuMiBjIC0wLjEsLTAuNCAtMC4zLC0wLjkgLTAuNiwtMS40IDAsMC45IC0wLjIsMS42IC0wLjUsMi4yIDAuNSwtMC4yIDAuOCwtMC41IDEuMSwtMC44IHogbSAtMy40LDUuNSBjIDAuNSwtMC40IDEsLTAuNyAxLjUsLTEuMSAtMC42LDAuNCAtMS4xLDAuOCAtMS42LDEuMiAwLC0wLjEgMCwtMC4xIDAuMSwtMC4xIHogTSAyNS4zODc2NjMsNTcuMjcgYyAwLjYsMC41IDEuMiwwLjkgMS45LDEuMiAtMS45LC0xLjQgLTMuNiwtMi44IC01LjEsLTQuNCAwLjYsMS4zIDIsMi4zIDMuMiwzLjIgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDA5MyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NC41ODc2NiwzOC40NyBjIDAuMiwwLjYgMC4zLDEuMiAwLjQsMS44IDAuMiwtMS40IDAuMywtMi45IDAuMywtNC40IDAsMC4yIDAsMC4zIC0wLjEsMC41IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MDk1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY0LjU4NzY2LDM4LjQ3IGMgMC4yLC0wLjcgMC41LC0xLjQgMC43LC0yLjEgMCwtMC4yIDAsLTAuMyAwLjEsLTAuNSAwLC0yLjggLTAuNCwtNS44IC0xLjMsLTguOSAwLDMuMiAtMC4xLDYuNCAtMC4xLDkuNiAwLjIsMC43IDAuNCwxLjMgMC42LDEuOSB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDA5NyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NS4yODc2NiwzNS44NyBjIDAsMS41IC0wLjEsMyAtMC4zLDQuNCAxLjEsNi42IC0zLjUsMTEuMyAtOCwxNS45IDguMiwtNC4yIDEyLC0xNi4zIDguOCwtMjUuNiAwLDEuOCAtMC4xLDMuNiAtMC41LDUuMyB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDA5OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NS4yODc2NiwzNS44NyBjIDAuNCwtMS44IDAuNSwtMy41IDAuNCwtNS4zIC0wLjQsLTEuMyAtMSwtMi41IC0xLjcsLTMuNiAwLjksMy4xIDEuMyw2LjEgMS4zLDguOSB6IG0gLTEsMy41IGMgMC4yLDMuNSAtMC44LDYuNSAtMi4zLDkuNCAxLjUsLTIuNSAyLjYsLTUuMyAzLC04LjQgLTAuMSwtMC42IC0wLjIsLTEuMiAtMC40LC0xLjggLTAuMSwwLjIgLTAuMiwwLjUgLTAuMywwLjggeiBtIC0wLjQsLTIuOCBjIDAuMiwwLjkgMC4zLDEuOSAwLjQsMi44IGwgMC4zLC0wLjkgYyAtMC4yLC0wLjYgLTAuNCwtMS4yIC0wLjcsLTEuOSB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDEwMSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NC45ODc2Niw0MC4yNyBjIC0wLjUsMy4xIC0xLjUsNS45IC0zLDguNCAtMS40LDIuNiAtMy4yLDUgLTUsNy41IDQuNSwtNC42IDksLTkuMyA4LC0xNS45IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTAzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMzguNDg3NjYzLDMwOC4wNyBjIDEuNSwwLjQgMy4yLDAuMSA0LjksMC4xIDE2My43OTk5OTcsMCAzMjcuNTk5OTk3LDAgNDkxLjI5OTk5NywwLjEgNiwwIDExLjQsLTEuMyAxNi42LC00LjIgMS42LC0wLjkgMy4xLC0xLjkgMy44LC0zLjUgLTAuMSwwLjEgLTAuMywwLjIgLTAuNCwwLjMgLTYuMywzLjkgLTEzLjEsNS4zIC0yMC41LDUuMyAtMTYzLjQsLTAuMSAtMzI2LjksLTAuMSAtNDkwLjI5OTk5NywwIC03LjMsMCAtMTQsLTEuMyAtMjAuMSwtNS4xIDMsNS4zIDkuMyw1LjYgMTQuNyw3IHoiCiAgICAgY2xhc3M9InN0NjEiCiAgICAgaWQ9InBhdGg0MTA1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2JkYmRiZCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNDMuODg3NjYzLDMwNi4xNyBjIDE2My4zOTk5OTcsLTAuMSAzMjYuODk5OTk3LC0wLjEgNDkwLjI5OTk5NywwIDcuNCwwIDE0LjIsLTEuNCAyMC41LC01LjMgMC4xLC0wLjEgMC4zLC0wLjIgMC40LC0wLjMgMC4zLC0wLjcgMC41LC0xLjQgMC40LC0yLjMgLTYuNiw0LjQgLTEzLjcsNS45IC0yMS43LDUuOSAtMTYzLjIsLTAuMSAtMzI2LjUsLTAuMSAtNDg5LjY5OTk5NywwIC04LDAgLTE1LjEsLTEuNSAtMjEuNywtNS45IDAuMywxLjEgMC43LDIgMS4yLDIuOCA2LjMsMy44IDEzLDUuMSAyMC4zLDUuMSB6IgogICAgIGNsYXNzPSJzdDYxIgogICAgIGlkPSJwYXRoNDEwNyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNiZGJkYmQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDUzMi4xODc2NiwzMTAuMTcgYyAtMTYyLjEsMCAtMzI0LjIsMCAtNDg2LjM5OTk5NywwLjEgLTYuNiwwIC0xMi45LC0wLjUgLTE4LjYsLTMuOSAwLjgsMC42IDEuNywxLjIgMi41LDEuNyAzLjgsMS45IDcuOSwyLjQgMTIuMiwyLjQgSCA1MzYuMDg3NjYgYyA0LjMsMCA4LjMsLTAuNiAxMi4xLC0yLjQgMS42LC0wLjggMywtMS44IDQuMywtMi45IC00LDIuOSAtOC42LDQuNSAtMTMuNSw0LjkgLTIuMSwwLjIgLTQuNSwwLjEgLTYuOCwwLjEgeiBtIDIzLjksLTEwLjUgYyAwLjQsMS42IC0wLjMsMi43IC0xLjMsMy43IDEuMywtMS4xIDIuNiwtMi4zIDQsLTMuNSAxLjUsLTEuNCAyLjcsLTIuOSAzLjcsLTQuNSAxLjEsLTIuNiAxLjksLTUuMyAxLjgsLTguMiAtMS44LDQuOCAtNC4yLDkuMiAtOC4yLDEyLjUgeiBtIC01MzQuMTk5OTk3LDAgYyAtMi45LC0yLjUgLTUsLTUuNSAtNi42LC04LjggMS40LDQuMiAzLjcsNy44IDYuOCwxMSAtMC4yLC0wLjYgLTAuMywtMS4zIC0wLjIsLTIuMiB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTA5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY0LjE4NzY2LDI4Ny4yNyBjIDAsLTAuOSAtMC4xLC0xLjkgLTAuNCwtMi45IC0yLDUuMSAtNC41LDkuOSAtOC4zLDEzLjkgMC4zLDAuNSAwLjUsMSAwLjYsMS40IDQsLTMuMyA2LjQsLTcuNyA4LjEsLTEyLjQgeiBtIC01NDIuMjk5OTk3LDEyLjQgYyAwLjEsLTAuNCAwLjMsLTAuOSAwLjYsLTEuNCAtNC40LC00LjcgLTcuMywtMTAuMiAtOC42LC0xNi41IDAsMy4zIDAuNSw2LjQgMS40LDkuMiAxLjYsMy4yIDMuNyw2LjIgNi42LDguNyB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTExIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU4Ljc4NzY2LDI5OS45NyBjIC0xLjMsMS4yIC0yLjYsMi4zIC00LDMuNSAtMC41LDAuNSAtMS4xLDEgLTEuNywxLjQgLTAuMSwwLjEgLTAuMiwwLjIgLTAuNCwwLjMgLTEuNCwxLjEgLTIuOCwyLjEgLTQuMywyLjkgLTMuOCwxLjggLTcuOSwyLjQgLTEyLjEsMi40IEggNDIuMDg3NjYzIGMgLTQuMiwwIC04LjMsLTAuNSAtMTIuMiwtMi40IC0wLjksLTAuNiAtMS43LC0xLjEgLTIuNSwtMS43IC0wLjYsLTAuNCAtMS4zLC0wLjggLTEuOSwtMS4zIC0xLjIsLTAuOSAtMi42LC0xLjkgLTMuMiwtMy4xIC0zLjEsLTMuMiAtNS41LC02LjggLTYuOCwtMTEgLTEuMSwtMi4zIC0xLjksLTQuNiAtMi41LC03LjIgLTAuMywxLjQgMC4xLDMgMC4zLDQuNSAxLjMsOC44IDYuNiwxNC45IDEzLjQsMTkuOSAxMi4yLDMuNyAyNC43LDIuOCAzNy4yLDIuOCBIIDUxMy42ODc2NiBjIDEyLjcsMCAyNS40LDAuOSAzNy45LC0yLjggMi44LC0yLjMgNS41LC00LjYgOC4zLC03IDAuOSwtMS45IDEuOSwtMy44IDIuNywtNS44IC0xLjEsMS43IC0yLjMsMy4yIC0zLjgsNC42IHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQxMTMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSAxMy44ODc2NjMsMjgxLjc3IGMgLTAuNiwwLjYgLTAuOSwxLjMgLTEuMSwyIDAuNiwyLjUgMS40LDQuOSAyLjUsNy4yIC0wLjksLTIuOCAtMS40LC01LjkgLTEuNCwtOS4yIHogbSA1NDIuMTk5OTk3LDE3LjkgYyAtMC4zLDAuMyAtMC43LDAuNiAtMSwwLjggLTAuNywxLjYgLTIuMiwyLjYgLTMuOCwzLjUgLTUuMiwyLjkgLTEwLjYsNC4yIC0xNi42LDQuMiAtMTYzLjgsLTAuMSAtMzI3LjYsLTAuMSAtNDkxLjI5OTk5NywtMC4xIC0xLjYsMCAtMy4zLDAuMyAtNC45LC0wLjEgLTUuNCwtMS41IC0xMS43LC0xLjcgLTE0LjgsLTcgLTAuMSwtMC4xIC0wLjMsLTAuMSAtMC40LC0wLjIgLTAuNSwtMC40IC0wLjksLTAuOCAtMS40LC0xLjIgLTAuMiwwLjggLTAuMSwxLjYgMC4yLDIuMiAxLjUsMS42IDMuMywzIDUuMSw0LjQgNS42LDMuNCAxMiwzLjkgMTguNiwzLjkgMTYyLjA5OTk5NywtMC4xIDMyNC4xOTk5OTcsLTAuMSA0ODYuMzk5OTk3LC0wLjEgMi4zLDAgNC42LDAuMSA3LC0wLjEgNSwtMC40IDkuNiwtMiAxMy41LC00LjkgMC4xLC0wLjEgMC4yLC0wLjIgMC40LC0wLjMgMC42LC0wLjUgMS4xLC0wLjkgMS43LC0xLjQgMSwtMC44IDEuNywtMiAxLjMsLTMuNiB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTE1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU2LjA4NzY2LDI5OS42NyBjIC0wLjEsLTAuNCAtMC4zLC0wLjkgLTAuNiwtMS40IDAsMC45IC0wLjIsMS42IC0wLjQsMi4zIDAuMywtMC4zIDAuNywtMC42IDEsLTAuOSB6IG0gLTUzMi43OTk5OTcsMS4yIGMgMC4xLDAuMSAwLjMsMC4xIDAuNCwwLjIgLTAuNSwtMC44IC0wLjksLTEuOCAtMS4yLC0yLjggLTAuMywwLjUgLTAuNSwxIC0wLjYsMS40IDAuNSwwLjQgMC45LDAuOCAxLjQsMS4yIHogbSAyLjEsNC4yIGMgMC42LDAuNSAxLjMsMC45IDEuOSwxLjMgLTEuOSwtMS40IC0zLjYsLTIuOCAtNS4xLC00LjQgMC42LDEuMiAyLDIuMSAzLjIsMy4xIHogbSA1MjkuMzk5OTk3LC0xLjYgYyAtMC42LDAuNSAtMS4xLDAuOSAtMS43LDEuNCAwLjYsLTAuNSAxLjIsLTAuOSAxLjcsLTEuNCB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTE3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY0LjU4NzY2LDI4Ni4wNyBjIDAuMiwwLjYgMC40LDEuMiAwLjUsMS44IDAuMiwtMS40IDAuMiwtMi44IDAuMiwtNC4yIDAsMC4yIC0wLjEsMC40IC0wLjEsMC42IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTE5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY1LjE4NzY2LDI4NC4yNyBjIDAuMSwtMC4yIDAuMSwtMC40IDAuMSwtMC42IC0wLjEsLTIuNCAtMC41LC00LjkgLTEuMiwtNy40IGwgLTAuMyw4LjEgYyAwLjMsMC42IDAuNiwxLjEgMC44LDEuNyB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDEyMSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NS4xODc2NiwyODcuODcgYyAwLjksNS4xIC0yLjQsOS4yIC01LjQsMTMuNCA2LjUsLTUuNSA4LjksLTE1LjIgNiwtMjIuMiAwLDEuNSAtMC4xLDMuMSAtMC40LDQuNiAwLDEuNCAtMC4xLDIuOCAtMC4yLDQuMiB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDEyMyIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NS4yODc2NiwyODMuNTcgYyAwLjMsLTEuNSAwLjQsLTMuMSAwLjQsLTQuNiAtMC40LC0xIC0xLC0yIC0xLjYsLTIuOCAwLjcsMi42IDEuMSw1IDEuMiw3LjQgeiBtIC0xLjEsMy43IGMgMC4xLDIuOSAtMC43LDUuNiAtMS44LDguMiAxLjUsLTIuNCAyLjMsLTUgMi43LC03LjYgLTAuMSwtMC42IC0wLjMsLTEuMiAtMC41LC0xLjggLTAuMSwwLjQgLTAuMiwwLjggLTAuNCwxLjIgeiIKICAgICBjbGFzcz0ic3Q2MiIKICAgICBpZD0icGF0aDQxMjUiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZThlOGU4IiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjQuNTg3NjYsMjg2LjA3IGMgLTAuMiwtMC42IC0wLjQsLTEuMSAtMC44LC0xLjcgMC4yLDEgMC4zLDEuOSAwLjQsMi45IDAuMiwtMC40IDAuMywtMC44IDAuNCwtMS4yIHogbSAwLjYsMS44IGMgLTAuNCwyLjcgLTEuMiw1LjIgLTIuNyw3LjYgLTAuOCwxLjkgLTEuOCwzLjggLTIuNyw1LjggMi45LC00LjIgNi4zLC04LjMgNS40LC0xMy40IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTI3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMzguNDg3NjYzLDQ3Mi4zNyBjIDEuNSwwLjQgMy4yLDAuMSA0LjksMC4xIDE2My43OTk5OTcsMCAzMjcuNTk5OTk3LDAgNDkxLjI5OTk5NywwLjEgNiwwIDExLjQsLTEuMyAxNi42LC00LjIgMS42LC0wLjkgMy4xLC0xLjkgMy44LC0zLjUgLTAuMSwwLjEgLTAuMywwLjIgLTAuNCwwLjMgLTYuMywzLjkgLTEzLjEsNS4zIC0yMC41LDUuMyAtMTYzLjQsLTAuMSAtMzI2LjksLTAuMSAtNDkwLjI5OTk5NywwIC03LjMsMCAtMTMuOSwtMS4zIC0yMC4xLC01LjEgMyw1LjMgOS4zLDUuNSAxNC43LDcgeiIKICAgICBjbGFzcz0ic3Q2MSIKICAgICBpZD0icGF0aDQxMjkiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojYmRiZGJkIiAvPgogIDxwYXRoCiAgICAgZD0ibSA0My43ODc2NjMsNDcwLjQ3IGMgMTYzLjM5OTk5NywtMC4xIDMyNi44OTk5OTcsLTAuMSA0OTAuMjk5OTk3LDAgNy40LDAgMTQuMiwtMS40IDIwLjUsLTUuMyAwLjEsLTAuMSAwLjMsLTAuMiAwLjQsLTAuMyAwLjMsLTAuNyAwLjUsLTEuNCAwLjQsLTIuMyAtNi42LDQuNCAtMTMuNyw1LjkgLTIxLjcsNS45IC0xNjMuMiwtMC4xIC0zMjYuNSwtMC4xIC00ODkuNjk5OTk3LDAgLTgsMCAtMTUuMSwtMS41IC0yMS43LC01LjkgMC4zLDEuMSAwLjcsMiAxLjIsMi44IDYuNCwzLjcgMTMuMSw1LjEgMjAuMyw1LjEgeiIKICAgICBjbGFzcz0ic3Q2MSIKICAgICBpZD0icGF0aDQxMzEiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojYmRiZGJkIiAvPgogIDxwYXRoCiAgICAgZD0ibSAyMS44ODc2NjMsNDYzLjk3IGMgLTMuMSwtMi43IC01LjQsLTYgLTcsLTkuNiAxLjQsNC41IDMuOSw4LjMgNy4yLDExLjcgLTAuMiwtMC42IC0wLjMsLTEuMyAtMC4yLC0yLjEgeiBtIDU0Mi4yOTk5OTcsLTEyLjUgYyAtMS43LDQuOCAtNC4yLDkuMSAtOC4xLDEyLjUgMC42LDIuNSAtMS41LDQgLTMuMyw1LjQgLTQsMi45IC04LjYsNC41IC0xMy42LDQuOSAtMi4zLDAuMiAtNC42LDAuMSAtNywwLjEgLTE2Mi4xLDAgLTMyNC4zLDAgLTQ4Ni4zOTk5OTcsMC4xIC03LDAgLTEzLjcsLTAuNiAtMTkuNSwtNC41IDEuMSwwLjkgMi4yLDEuOCAzLjQsMi43IDQuMiwxLjcgOC41LDIuMSAxMywyLjEgSCA1MzUuMjg3NjYgYyA0LjcsMCA5LjIsLTAuNSAxMy42LC0yLjMgMS45LC0xLjQgMy43LC0yLjkgNS44LC00IDIuNywtMS42IDQuOSwtMy44IDYuNiwtNi41IDEuOSwtMy4yIDMuMSwtNi42IDIuOSwtMTAuNSB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTMzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjEuODg3NjYzLDQ2My45NyBjIDAuMSwtMC40IDAuMywtMC45IDAuNiwtMS40IC00LjQsLTQuNyAtNy4zLC0xMC4yIC04LjYsLTE2LjUgLTAuMSwzLjEgMC4zLDUuOCAxLjEsOC40IDEuNiwzLjYgMy44LDYuOCA2LjksOS41IHogbSA1NDIuMjk5OTk3LC0xMi41IGMgMCwtMC45IC0wLjIsLTEuOSAtMC40LC0yLjkgLTIsNS4xIC00LjUsOS45IC04LjMsMTMuOSAwLjMsMC41IDAuNSwxIDAuNiwxLjQgNCwtMy4zIDYuNCwtNy42IDguMSwtMTIuNCB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTM1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTU0LjY4NzY2LDQ2OC40NyBjIC0yLjEsMS4xIC0zLjksMi42IC01LjgsNCAtNC4zLDEuOCAtOC45LDIuMyAtMTMuNiwyLjMgSCA0Mi42ODc2NjMgYyAtNC41LDAgLTguOCwtMC40IC0xMywtMi4xIC0xLjIsLTAuOSAtMi4zLC0xLjcgLTMuNCwtMi43IC0wLjMsLTAuMiAtMC42LC0wLjQgLTAuOSwtMC43IC0xLjMsLTEgLTIuNywtMS45IC0zLjMsLTMuMiAtMy4zLC0zLjQgLTUuOCwtNy4yIC03LjIsLTExLjcgLTAuOSwtMiAtMS42LC00LjIgLTIuMSwtNi40IC0wLjYsMS45IC0wLjEsMy45IDAuNCw1LjkgMS44LDguMSA3LDEzLjggMTMuNCwxOC42IDEyLjIsMy43IDI0LjcsMi44IDM3LjIsMi44IEggNTEzLjU4NzY2IGMgMTIuNywwIDI1LjQsMC45IDM3LjksLTIuOCAxLjQsLTAuOSAyLjgsLTEuOSA0LjEsLTIuOCAyLC0yLjUgNC4xLC01IDUuNywtNy43IC0xLjcsMi42IC0zLjksNC44IC02LjYsNi41IHoiCiAgICAgY2xhc3M9InN0NSIKICAgICBpZD0icGF0aDQxMzciCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZDRkNGQ0IiAvPgogIDxwYXRoCiAgICAgZD0ibSAxMy44ODc2NjMsNDQ2LjA3IGMgLTAuNSwwLjYgLTAuOSwxLjMgLTEuMSwyIDAuNSwyLjIgMS4yLDQuNCAyLjEsNi40IC0wLjcsLTIuNiAtMS4xLC01LjQgLTEsLTguNCB6IG0gNTE4LjM5OTk5NywyOC40IGMgMi4zLDAgNC42LDAuMSA3LC0wLjEgNSwtMC40IDkuNSwtMiAxMy42LC00LjkgMS45LC0xLjQgMy45LC0yLjkgMy4zLC01LjQgLTAuMywwLjMgLTAuNywwLjYgLTEsMC44IC0wLjcsMS42IC0yLjIsMi42IC0zLjgsMy41IC01LjIsMi45IC0xMC42LDQuMiAtMTYuNiw0LjIgLTE2My44LC0wLjEgLTMyNy42LC0wLjEgLTQ5MS4yOTk5OTcsLTAuMSAtMS42LDAgLTMuMywwLjMgLTQuOSwtMC4xIC01LjQsLTEuNSAtMTEuNywtMS43IC0xNC44LC03IC0wLjEsLTAuMSAtMC4zLC0wLjEgLTAuNCwtMC4yIC0wLjUsLTAuNCAtMC45LC0wLjggLTEuNCwtMS4yIC0wLjIsMC44IC0wLjEsMS41IDAuMiwyLjEgMS4zLDEuNCAyLjcsMi42IDQuMiwzLjkgNS45LDMuOSAxMi41LDQuNSAxOS41LDQuNSAxNjIuMDk5OTk3LC0wLjEgMzI0LjE5OTk5NywwIDQ4Ni4zOTk5OTcsMCB6IgogICAgIGNsYXNzPSJzdDUiCiAgICAgaWQ9InBhdGg0MTM5IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2Q0ZDRkNCIgLz4KICA8cGF0aAogICAgIGQ9Im0gMjMuMjg3NjYzLDQ2NS4xNyBjIDAuMSwwLjEgMC4zLDAuMSAwLjQsMC4yIC0wLjUsLTAuOCAtMC45LC0xLjcgLTEuMiwtMi44IC0wLjMsMC41IC0wLjUsMSAtMC42LDEuNCAwLjUsMC40IDAuOSwwLjggMS40LDEuMiB6IG0gNTMyLjc5OTk5NywtMS4yIGMgLTAuMSwtMC40IC0wLjMsLTAuOSAtMC42LC0xLjQgMCwwLjkgLTAuMiwxLjYgLTAuNCwyLjMgMC4zLC0wLjMgMC43LC0wLjYgMSwtMC45IHogbSAtNTMwLjY5OTk5Nyw1LjMgYyAwLjMsMC4yIDAuNiwwLjQgMC45LDAuNyAtMS41LC0xLjIgLTIuOSwtMi41IC00LjIsLTMuOSAwLjYsMS4zIDIsMi4zIDMuMywzLjIgeiIKICAgICBjbGFzcz0ic3Q1IgogICAgIGlkPSJwYXRoNDE0MSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNkNGQ0ZDQiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NC40ODc2Niw0NTAuNzcgYyAwLjIsMC44IDAuMywxLjUgMC40LDIuMyAwLjQsLTEuOCAwLjUsLTMuNiAwLjUsLTUuNSAtMC4xLDAuMyAtMC4xLDAuNiAtMC4yLDEgLTAuMiwwLjYgLTAuNCwxLjQgLTAuNywyLjIgeiIKICAgICBjbGFzcz0ic3Q2MiIKICAgICBpZD0icGF0aDQxNDMiCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZThlOGU4IiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjUuMTg3NjYsNDQ4LjQ3IGMgMC4xLC0wLjMgMC4xLC0wLjYgMC4yLC0xIDAsLTIuOCAtMC41LC01LjcgLTEuNCwtOC40IC0wLjEsMy4yIC0wLjEsNi40IC0wLjIsOS41IDAuMywwLjcgMC41LDEuNCAwLjYsMi4xIDAuNCwtMC43IDAuNiwtMS41IDAuOCwtMi4yIHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTQ1IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTY1LjM4NzY2LDQ0Ny40NyBjIDAsMS45IC0wLjIsMy43IC0wLjUsNS41IDAuNSw1LjggLTIuNiwxMS4yIC05LjMsMTYuNyA3LjksLTMuNCAxMC40LC0xMC41IDExLC0xOCAwLjMsLTMuNiAxLjksLTcuOSAtMC45LC0xMS4yIDAuMSwyLjMgMC4xLDQuNyAtMC4zLDcgeiIKICAgICBjbGFzcz0ic3Q2MiIKICAgICBpZD0icGF0aDQxNDciCiAgICAgaW5rc2NhcGU6Y29ubmVjdG9yLWN1cnZhdHVyZT0iMCIKICAgICBzdHlsZT0iZmlsbDojZThlOGU4IiAvPgogIDxwYXRoCiAgICAgZD0ibSA1NjMuOTg3NjYsNDM5LjA3IGMgMC45LDIuOCAxLjMsNS42IDEuNCw4LjQgMC40LC0yLjMgMC40LC00LjcgMC4yLC03LjEgLTAuNCwtMC40IC0wLjksLTAuOSAtMS42LC0xLjMgeiBtIDAuMiwxMi40IGMgMC4yLDQgLTEuMSw3LjMgLTMsMTAuNSAxLjcsLTIuNiAyLjksLTUuNyAzLjYsLTguOSAtMC4xLC0wLjggLTAuMiwtMS41IC0wLjQsLTIuMyAwLDAuMiAtMC4xLDAuNCAtMC4yLDAuNyB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDE0OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDU2NC40ODc2Niw0NTAuNzcgLTAuNiwtMi4xIGMgMC4yLDEgMC4zLDEuOSAwLjQsMi45IDAsLTAuNCAwLjEsLTAuNiAwLjIsLTAuOCB6IG0gMC40LDIuMiBjIC0wLjYsMy4yIC0xLjksNi4zIC0zLjYsOC45IC0xLjYsMi43IC0zLjcsNS4yIC01LjcsNy43IDYuNywtNS40IDkuNywtMTAuOCA5LjMsLTE2LjYgeiBtIC01MjIuMTk5OTk3LDIzIGMgLTUuNywwIC0xMSwtMS4xIC0xNi4xLC0zLjUgMy44LDQuMyA4LjksNC4yIDE0LDQuMiBIIDUzNi43ODc2NiBjIDUuMywwIDEwLjYsMC4yIDE0LjcsLTQuMiAtNS4xLDIuNCAtMTAuNSwzLjUgLTE2LjEsMy41IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTUxIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Ik0gNTEzLjU4NzY2LDQ3NS4yNyBIIDYzLjc4NzY2MyBjIC0xMi40LDAgLTI1LDAuOSAtMzcuMiwtMi44IDUuMSwyLjQgMTAuNCwzLjUgMTYuMSwzLjUgSCA1MzUuMjg3NjYgYyA1LjcsMCAxMSwtMS4xIDE2LjEsLTMuNSAtMTIuNCwzLjcgLTI1LjEsMi44IC0zNy44LDIuOCB6IG0gMTkuNiwtMTYzLjUgYyAtMTYyLjgsLTAuMSAtMzI1LjYsLTAuMSAtNDg4LjM5OTk5NywwIC02LjQsMCAtMTIuNCwtMSAtMTguMiwtMy41IDMuNywzLjMgOC4xLDQuMiAxMi44LDQuMiBIIDUzOC41ODc2NiBjIDQuNywwIDkuMiwtMC45IDEyLjgsLTQuMiAtNS44LDIuNSAtMTEuOCwzLjUgLTE4LjIsMy41IHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTUzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTMzLjE4NzY2LDMxMS43NyBjIDYuNCwwIDEyLjQsLTEgMTguMiwtMy41IC0xMi40LDMuNyAtMjUuMiwyLjggLTM3LjksMi44IEggNjMuNjg3NjYzIGMgLTEyLjQsMCAtMjUsMC45IC0zNy4yLC0yLjggNS44LDIuNiAxMS44LDMuNSAxOC4yLDMuNSAxNjIuODk5OTk3LC0wLjEgMzI1LjY5OTk5NywtMC4xIDQ4OC40OTk5OTcsMCB6IE0gNDQuNzg3NjYzLDYzLjk3IGMgLTYuNCwwIC0xMi40LC0xIC0xOC4yLC0zLjUgMy43LDMuMyA4LjEsNC4yIDEyLjgsNC4yIEggNTM4LjU4NzY2IGMgNC43LDAgOS4yLC0wLjkgMTIuOCwtNC4yIC01LjgsMi42IC0xMS44LDMuNSAtMTguMiwzLjUgLTE2Mi44LC0wLjEgLTMyNS42LC0wLjEgLTQ4OC4zOTk5OTcsMCB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDE1NSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJNIDUxMy41ODc2Niw2My4xNyBIIDYzLjc4NzY2MyBjIC0xMi40LDAgLTI1LDAuOSAtMzcuMiwtMi44IDUuOCwyLjYgMTEuOCwzLjUgMTguMiwzLjUgMTYyLjc5OTk5NywtMC4xIDMyNS41OTk5OTcsLTAuMSA0ODguMzk5OTk3LDAgNi40LDAgMTIuNCwtMSAxOC4yLC0zLjUgLTEyLjQsMy43IC0yNS4xLDIuOCAtMzcuOCwyLjggeiBtIC00NjguNzk5OTk3LDgyLjkgYyAtNi40LDAgLTEyLjQsLTEgLTE4LjIsLTMuNSAzLjcsMy4zIDguMSw0LjIgMTIuOCw0LjIgSCA1MzguNTg3NjYgYyA0LjcsMCA5LjIsLTAuOSAxMi44LC00LjIgLTUuOCwyLjUgLTExLjgsMy41IC0xOC4yLDMuNSAtMTYyLjgsLTAuMSAtMzI1LjYsLTAuMSAtNDg4LjM5OTk5NywwIHoiCiAgICAgY2xhc3M9InN0NjIiCiAgICAgaWQ9InBhdGg0MTU3IgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2U4ZThlOCIgLz4KICA8cGF0aAogICAgIGQ9Ik0gNTE0LjI4NzY2LDE0NS4yNyBIIDY0LjQ4NzY2MyBjIC0xMi43LDAgLTI1LjQsMC45IC0zNy45LC0yLjggNS44LDIuNSAxMS44LDMuNSAxOC4yLDMuNSAxNjIuNzk5OTk3LC0wLjEgMzI1LjU5OTk5NywtMC4xIDQ4OC4zOTk5OTcsMCA2LjQsMCAxMi40LC0xIDE4LjIsLTMuNSAtMTIuMSwzLjggLTI0LjcsMi44IC0zNy4xLDIuOCB6IgogICAgIGNsYXNzPSJzdDYyIgogICAgIGlkPSJwYXRoNDE1OSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNlOGU4ZTgiIC8+CiAgPHBhdGgKICAgICBkPSJtIDQwLjI4NzY2MywzOTEuMDcgaCAxLjYgYyAxLjEsMCAyLjIsLTAuMiAzLjMsLTAuMiBIIDUzMi43ODc2NiBjIDAuOCwwIDEuNiwwLjEgMi40LDAuMSAxLjEsMCAyLjIsLTAuMSAzLjMsLTAuMSAwLjYsLTAuMSAxLjIsLTAuMyAxLjgsLTAuNyBIIDM3LjY4NzY2MyBjIDAuOSwwLjYgMS44LDAuOSAyLjYsMC45IHogbSA0OTguMTk5OTk3LC0wLjEgYyAtMS4xLDAuMSAtMi4yLDAuMSAtMy4zLDAuMSAxLjEsMC4xIDIuMiwwLjIgMy4zLC0wLjEgeiBtIC00OTQuMzk5OTk3LDAuNyBoIC00IGMgMS4zLDAuMyAyLjcsMC4xIDQsMCB6IG0gNDkzLjc5OTk5NywwIGggLTQuMiBjIDEuNCwwLjEgMi45LDAuMyA0LjIsMCB6IgogICAgIGNsYXNzPSJzdDY0IgogICAgIGlkPSJwYXRoNDE2MSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNjZmNmY2YiIC8+CiAgPHBhdGgKICAgICBkPSJtIDQ1LjE4NzY2MywzOTAuOTcgYyAtMS4xLDAgLTIuMiwwLjEgLTMuMywwLjIgSCA1MzUuMDg3NjYgYyAtMC44LDAgLTEuNiwtMC4xIC0yLjQsLTAuMSAtMTYyLjQsMCAtMzI0LjksMCAtNDg3LjQ5OTk5NywtMC4xIHogbSA0OTQuNDk5OTk3LC0wLjEgYyAwLjIsLTAuMiAwLjQsLTAuMyAwLjYsLTAuNiAtMC42LDAuMyAtMS4yLDAuNSAtMS44LDAuNyAwLjQsMCAwLjgsMCAxLjIsLTAuMSB6IG0gLTUwMS45OTk5OTcsLTAuNSBjIDAuMiwwLjMgMC41LDAuNSAwLjcsMC42IDAuNCwwIDAuNywwLjEgMS4xLDAuMSBoIDAuOCBjIC0wLjgsMCAtMS43LC0wLjMgLTIuNiwtMC43IHoiCiAgICAgY2xhc3M9InN0NjQiCiAgICAgaWQ9InBhdGg0MTYzIgogICAgIGlua3NjYXBlOmNvbm5lY3Rvci1jdXJ2YXR1cmU9IjAiCiAgICAgc3R5bGU9ImZpbGw6I2NmY2ZjZiIgLz4KICA8cGF0aAogICAgIGQ9Im0gNTM4LjQ4NzY2LDM5MC45NyBjIC0xLjEsMC4yIC0yLjIsMC4yIC0zLjMsMC4xIEggMzkuNTg3NjYzIGMgLTAuNCwwIC0wLjcsLTAuMSAtMS4xLC0wLjEgMC41LDAuNCAxLjEsMC42IDEuNywwLjggSCA1MzcuODg3NjYgYyAwLjYsLTAuMSAxLjIsLTAuNCAxLjcsLTAuOCB6IgogICAgIGNsYXNzPSJzdDY0IgogICAgIGlkPSJwYXRoNDE2NSIKICAgICBpbmtzY2FwZTpjb25uZWN0b3ItY3VydmF0dXJlPSIwIgogICAgIHN0eWxlPSJmaWxsOiNjZmNmY2YiIC8+Cjwvc3ZnPgo= mediatype: image/svg+xml install: spec: clusterPermissions: - rules: - apiGroups: - apps resources: - deployments verbs: - create - delete - get - list - patch - update - watch - apiGroups: - apps resources: - deployments/finalizers verbs: - update - apiGroups: - apps resources: - replicasets verbs: - get - apiGroups: - apps.m88i.io resources: - nexus verbs: - create - delete - get - list - patch - update - watch - apiGroups: - apps.m88i.io resources: - nexus/finalizers verbs: - get - patch - update - apiGroups: - apps.m88i.io resources: - nexus/status verbs: - get - patch - update - apiGroups: - "" resources: - configmaps verbs: - create - get - apiGroups: - "" resources: - events - persistentvolumeclaims - secrets - serviceaccounts - services verbs: - create - delete - get - list - patch - update - watch - apiGroups: - "" resources: - pods verbs: - get - apiGroups: - monitoring.coreos.com resources: - servicemonitors verbs: - create - get - apiGroups: - networking.k8s.io resources: - ingresses verbs: - create - delete - get - list - patch - update - watch - apiGroups: - route.openshift.io resources: - routes verbs: - create - delete - get - list - patch - update - watch - apiGroups: - authentication.k8s.io resources: - tokenreviews verbs: - create - apiGroups: - authorization.k8s.io resources: - subjectaccessreviews verbs: - create serviceAccountName: default deployments: - name: nexus-operator-controller-manager spec: replicas: 1 selector: matchLabels: control-plane: controller-manager strategy: {} template: metadata: creationTimestamp: null labels: control-plane: controller-manager spec: containers: - args: - --secure-listen-address=0.0.0.0:8443 - --upstream=http://127.0.0.1:8080/ - --logtostderr=true - --v=10 image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0 name: kube-rbac-proxy ports: - containerPort: 8443 name: https protocol: TCP resources: {} - args: - --metrics-addr=127.0.0.1:8080 - --enable-leader-election command: - /manager image: quay.io/m88i/nexus-operator:0.5.0 name: manager resources: requests: cpu: 100m memory: 20Mi terminationGracePeriodSeconds: 10 permissions: - rules: - apiGroups: - "" resources: - configmaps verbs: - get - list - watch - create - update - patch - delete - apiGroups: - "" resources: - configmaps/status verbs: - get - update - patch - apiGroups: - "" resources: - events verbs: - create - patch serviceAccountName: default strategy: deployment installModes: - supported: true type: OwnNamespace - supported: true type: SingleNamespace - supported: true type: MultiNamespace - supported: true type: AllNamespaces keywords: - nexus - sonatype - maven - docker - ci - continuous integration - continuous delivery - repository - repository manager - dev tools labels: name: nexus-operator links: - name: Documentation url: https://github.com/m88i/nexus-operator/blob/main/README.md - name: Nexus Operator source code repository url: https://github.com/m88i/nexus-operator maintainers: - email: nexus-operator@googlegroups.com name: m88i Labs maturity: alpha provider: name: m88i Labs version: 0.5.0 ```

What did you expect to see? All RBAC resources are created according to the CSV and the operator is installed successfully.

What did you see instead? Under which circumstances? The RBAC resources are not created and installation fails.

I dug around a bit and I believe the most relevant fields are the following annotations:

      olm.operatorGroup: test-operators
      olm.operatorNamespace: test-operators

This OperatorGroup exists and is the only one present in that namespace:

❯ kubectl --kubeconfig /tmp/kubeconfig -n test-operators get operatorgroup
NAME             AGE
test-operators   75m
❯ kubectl --kubeconfig /tmp/kubeconfig -n test-operators get operatorgroup -o yaml
apiVersion: v1
items:
- apiVersion: operators.coreos.com/v1
  kind: OperatorGroup
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"operators.coreos.com/v1","kind":"OperatorGroup","metadata":{"annotations":{},"labels":{"operator":"test"},"name":"test-operators","namespace":"test-operators"}}
      olm.providedAPIs: Nexus.v1alpha1.apps.m88i.io
    creationTimestamp: "2021-01-14T12:20:15Z"
    generation: 2
    labels:
      operator: test
    managedFields:
    - apiVersion: operators.coreos.com/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:kubectl.kubernetes.io/last-applied-configuration: {}
          f:labels:
            .: {}
            f:operator: {}
      manager: kubectl-client-side-apply
      operation: Update
      time: "2021-01-14T12:20:15Z"
    - apiVersion: operators.coreos.com/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:olm.providedAPIs: {}
        f:spec: {}
        f:status:
          .: {}
          f:lastUpdated: {}
          f:namespaces:
            .: {}
            v:"": {}
      manager: olm
      operation: Update
      time: "2021-01-14T12:20:46Z"
    name: test-operators
    namespace: test-operators
    resourceVersion: "1408"
    selfLink: /apis/operators.coreos.com/v1/namespaces/test-operators/operatorgroups/test-operators
    uid: 14d88ad1-1e6d-4006-92f6-2e441111e664
  spec: {}
  status:
    lastUpdated: "2021-01-14T12:20:15Z"
    namespaces:
    - ""
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

If I'm reading the OperatorGroup docs correctly, this should suffice for this operator to be a member of the test-operators group. And if I'm reading the RBAC section of the docs correctly, being a member o the OperatorGroup should suffice for the appropriate ClusterRoles to be created following the policies defined in the CSV.

However, these ClusterRoles don't get created:

❯ kubectl --kubeconfig /tmp/kubeconfig get clusterroles | grep -ci nexus
0

Which ultimately causes the deployment to fail as the CRD is installed, the ServiceAccount is present, but the policies are not satisfied by any role:

  status:
    conditions:
    - lastTransitionTime: "2021-01-14T12:20:46Z"
      lastUpdateTime: "2021-01-14T12:20:46Z"
      message: requirements not yet checked
      phase: Pending
      reason: RequirementsUnknown
    - lastTransitionTime: "2021-01-14T12:20:46Z"
      lastUpdateTime: "2021-01-14T12:20:46Z"
      message: one or more requirements couldn't be found
      phase: Pending
      reason: RequirementsNotMet
    lastTransitionTime: "2021-01-14T12:20:46Z"
    lastUpdateTime: "2021-01-14T12:20:46Z"
    message: The operator is running in test-operators but is managing this namespace
    phase: Pending
    reason: Copied
    requirementStatus:
    - group: apiextensions.k8s.io
      kind: CustomResourceDefinition
      message: CRD is present and Established condition is true
      name: nexus.apps.m88i.io
      status: Present
      uuid: e8b9e900-0a5c-4543-af3b-019fda6c8976
      version: v1
    - dependents:
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: namespaced rule:{"verbs":["get","list","watch","create","update","patch","delete"],"apiGroups":[""],"resources":["configmaps"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: namespaced rule:{"verbs":["get","update","patch"],"apiGroups":[""],"resources":["configmaps/status"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: namespaced rule:{"verbs":["create","patch"],"apiGroups":[""],"resources":["events"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","delete","get","list","patch","update","watch"],"apiGroups":["apps"],"resources":["deployments"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["update"],"apiGroups":["apps"],"resources":["deployments/finalizers"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["get"],"apiGroups":["apps"],"resources":["replicasets"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","delete","get","list","patch","update","watch"],"apiGroups":["apps.m88i.io"],"resources":["nexus"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["get","patch","update"],"apiGroups":["apps.m88i.io"],"resources":["nexus/finalizers"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["get","patch","update"],"apiGroups":["apps.m88i.io"],"resources":["nexus/status"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","get"],"apiGroups":[""],"resources":["configmaps"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","delete","get","list","patch","update","watch"],"apiGroups":[""],"resources":["events","persistentvolumeclaims","secrets","serviceaccounts","services"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["get"],"apiGroups":[""],"resources":["pods"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","get"],"apiGroups":["monitoring.coreos.com"],"resources":["servicemonitors"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","delete","get","list","patch","update","watch"],"apiGroups":["networking.k8s.io"],"resources":["ingresses"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create","delete","get","list","patch","update","watch"],"apiGroups":["route.openshift.io"],"resources":["routes"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create"],"apiGroups":["authentication.k8s.io"],"resources":["tokenreviews"]}
        status: NotSatisfied
        version: v1
      - group: rbac.authorization.k8s.io
        kind: PolicyRule
        message: cluster rule:{"verbs":["create"],"apiGroups":["authorization.k8s.io"],"resources":["subjectaccessreviews"]}
        status: NotSatisfied
        version: v1
      group: ""
      kind: ServiceAccount
      message: Policy rule not satisfied for service account
      name: default
      status: PresentNotSatisfied
      version: v1
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

Environment

0.16.1

❯ kubectl --kubeconfig /tmp/kubeconfig version
Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.1", GitCommit:"c4d752765b3bbac2237bf87cf0b1c2e307844666", GitTreeState:"clean", BuildDate:"2020-12-18T12:09:25Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.1", GitCommit:"206bcadf021e76c27513500ca24182692aabd17e", GitTreeState:"clean", BuildDate:"2020-09-14T07:30:52Z", GoVersion:"go1.15", Compiler:"gc", Platform:"linux/amd64"}

Kind v0.9.0

Additional context

Digging into the olm-operator pod logs, I found:

time="2021-01-14T12:20:46Z" level=info msg="csv in operatorgroup" csv=nexus-operator.v0.5.0 id=W7Gfw namespace=test-operators opgroup=test-operators phase=Pending

So it is indeed a member of the expected group. This was followed by:

time="2021-01-14T12:20:46Z" level=info msg="requirements were not met" csv=nexus-operator.v0.5.0 id=W7Gfw namespace=test-operators phase=Pending
time="2021-01-14T12:20:46Z" level=info msg="couldn't ensure RBAC in target namespaces" csv=nexus-operator.v0.5.0 error="no owned roles found" id=7ckY6 namespace=test-operators phase=Pending
E0114 12:20:46.872746       1 queueinformer_operator.go:290] sync {"update" "test-operators/nexus-operator.v0.5.0"} failed: no owned roles found
time="2021-01-14T12:20:47Z" level=info msg="csv in operatorgroup" csv=nexus-operator.v0.5.0 id=D8bUy namespace=test-operators opgroup=test-operators phase=Pending

Full log output

I am facing this issue while I test a new release using these tests, though I'm not sure if this is relevant.

exdx commented 3 years ago

Hi @LCaparelli, thanks for the detailed writeup. I believe we had a bug that we addressed that fixed an issue very similar to this, I believe @dinhxuanvu looked into it. May be the same thing and is already fixed in master. Could you maybe try the same installation but off master and see if the same issue comes up?

LCaparelli commented 3 years ago

EDIT: tried out with minikube v1.16 this time around, btw, not kind

Hey @exdx thanks for the reply! I pulled the repo and ran make run-local while checked out at the master branch.

Installation went fine, so I followed the steps in this guide, though I have created the Subscription at the operators namespace instead of default:

apiVersion: operators.coreos.com/v1alpha1            
kind: Subscription
metadata:
  name: my-nexus-operator-m88i
  namespace: operators
spec:
  channel: alpha
  name: nexus-operator-m88i
  source: my-test-catalog
  sourceNamespace: olm

Which I believe should be enough for the operator to be part of the global-operators group, which is the only one present at that namespace:

❯ kubectl get operatorgroup -n operators
NAME               AGE
global-operators   15m

Indeed the annotations are correct:

❯ kubectl -n operators get csv nexus-operator.v0.5.0 -o json | jq '.metadata.annotations' | grep "  \"olm"
  "olm.operatorGroup": "global-operators",
  "olm.operatorNamespace": "operators",
  "olm.targetNamespaces": "",

So far so good, but still we run into the same issue, no ClusterRole gets created:

❯ kubectl get clusterroles | grep -ci nexus
0

And the CSV's status says we got the CRD and the ServiceAccount, but no roles to satisfy the policies.

Not sure if this is relevant, but I created the catalog image keeping only the operator we're interested in:

❯ kubectl -n olm get catalogsource my-test-catalog
NAME              DISPLAY   TYPE   PUBLISHER   AGE
my-test-catalog             grpc               23m
❯ kubectl get packagemanifests
NAME                  CATALOG   AGE
nexus-operator-m88i             24m

I also deleted the operatorhub CatalogSource for good measure, just to avoid any possible conflicts.

Taking a look at the olm-operator logs they also seem to reflect the same issue: correct OperatorGroup, but fails to ensure RBAC at target namespace.

time="2021-02-09T02:01:25Z" level=info msg="couldn't ensure RBAC in target namespaces" csv=nexus-operator.v0.5.0 error="no owned roles found" id=I9cot namespace=operators ph
ase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="done syncing CSV" csv=nexus-operator.v0.5.0 id=I9cot namespace=operators phase=Pending
E0209 02:01:25.408107       1 queueinformer_operator.go:290] sync {"update" "operators/nexus-operator.v0.5.0"} failed: no owned roles found
time="2021-02-09T02:01:25Z" level=debug msg="copying CSV" csv=nexus-operator.v0.5.0 id=8kxW0 namespace=operators phase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="copying csv to targets" csv=nexus-operator.v0.5.0 id=8kxW0 namespace=operators phase=Pending targetNamespaces=
time="2021-02-09T02:01:25Z" level=debug msg="checking annotations" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-system
time="2021-02-09T02:01:25Z" level=debug msg="checking status" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-system
time="2021-02-09T02:01:25Z" level=debug msg="checking annotations" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-public
time="2021-02-09T02:01:25Z" level=debug msg="checking status" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-public
time="2021-02-09T02:01:25Z" level=debug msg="checking annotations" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-node-lease
time="2021-02-09T02:01:25Z" level=debug msg="checking status" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=kube-node-lease
time="2021-02-09T02:01:25Z" level=debug msg="checking annotations" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=default
time="2021-02-09T02:01:25Z" level=debug msg="checking status" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=default
time="2021-02-09T02:01:25Z" level=debug msg="checking annotations" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=olm
time="2021-02-09T02:01:25Z" level=debug msg="checking status" csv=nexus-operator.v0.5.0 operator-ns=operators target-ns=olm
time="2021-02-09T02:01:25Z" level=debug msg="syncing CSV" csv=nexus-operator.v0.5.0 id=CoaRM namespace=operators phase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="annotations correct" annotationTargets= opgroupTargets=
time="2021-02-09T02:01:25Z" level=debug msg="csv in operatorgroup" csv=nexus-operator.v0.5.0 id=iKgFv namespace=operators opgroup=global-operators phase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="no intersecting operatorgroups provide the same apis" apis=Nexus.v1alpha1.apps.m88i.io csv=nexus-operator.v0.5.0 id=iKgFv namespace=operators phase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="checking if csv is replacing an older version"
time="2021-02-09T02:01:25Z" level=debug msg="unable to get previous csv" error="clusterserviceversions.operators.coreos.com \"nexus-operator.v0.4.0\" not found" replacing=nexus-operator.v0.4.0
time="2021-02-09T02:01:25Z" level=debug msg="perm.ServiceAccountName: default"
time="2021-02-09T02:01:25Z" level=debug msg="perm.ServiceAccountName: default"
time="2021-02-09T02:01:25Z" level=debug msg="permissions/requirements not met" minKubeMet=true permMet=false reqMet=true
time="2021-02-09T02:01:25Z" level=debug msg="checking if csv is replacing an older version"
time="2021-02-09T02:01:25Z" level=debug msg="unable to get previous csv" error="clusterserviceversions.operators.coreos.com \"nexus-operator.v0.4.0\" not found" replacing=nexus-operator.v0.4.0
time="2021-02-09T02:01:25Z" level=info msg="requirements were not met" csv=nexus-operator.v0.5.0 id=iKgFv namespace=operators phase=Pending
time="2021-02-09T02:01:25Z" level=debug msg="opgroup is global" csv=nexus-operator.v0.5.0 opgroup=global-operators
time="2021-02-09T02:01:25Z" level=debug msg="perm.ServiceAccountName: default"
time="2021-02-09T02:01:25Z" level=debug msg="perm.ServiceAccountName: default"
time="2021-02-09T02:01:25Z" level=debug msg="lift roles/rolebindings to clusterroles/rolebindings" csv=nexus-operator.v0.5.0 opgroup=global-operators
time="2021-02-09T02:01:25Z" level=info msg="couldn't ensure RBAC in target namespaces" csv=nexus-operator.v0.5.0 error="no owned roles found" id=CoaRM namespace=operators phase=Pending

So yeah, looks like there is no change from my original report, unfortunately. I'll also attempt to perform the same tests using the bundle format instead when I get some time, do you think that may help? Any other pointers I could try following?

I took a look at the code, and it seems that this is the only place this "lift roles/rolebindings to clusterroles/rolebindings" log can come up in:

https://github.com/operator-framework/operator-lifecycle-manager/blob/2294bcc907c834c160c5b99fbf15988d0706853c/pkg/controller/operators/olm/operatorgroup.go#L445-L448

Which is where the final "no owned roles" error comes from:

https://github.com/operator-framework/operator-lifecycle-manager/blob/2294bcc907c834c160c5b99fbf15988d0706853c/pkg/controller/operators/olm/operatorgroup.go#L456-L464

What I don't understand is why does this section attempts to "upgrade" existing Roles into ClusterRoles. Are namespaced RBAC resources created before in all installations of Operators which watch all namespaces? Should we actually be investigating why these aren't created first instead?

ricardozanini commented 3 years ago

@J0zi @mvalarh looks like we might have a bug in the OLM. That's why our PR can't pass the CI? Can you guys give us a hand or any advice? It's been a month :cry:. Our operator is there waiting to be released on k8s. We already merged the OCP counterpart.

exdx commented 3 years ago

It's not entirely evident on our end what the issue is exactly from the logs, but I think you're right in pinpointing the no owned roles found error message. The packaging format of the operator bundle shouldn't be affecting this however.

Could you say whether you supply the SA and the role in the operator CSV, and how they look like? I can see how conceptually we lift roles to clusteroles to enable cluster scoped operators to function. If you specify a single namespace installation (via the target namespace field on the operator group) and the install the operator, do you hit this same error? Could be useful to check this.

J0zi commented 3 years ago

OK, we are waiting for a fixed OLM version.

LCaparelli commented 3 years ago

Could you say whether you supply the SA and the role in the operator CSV, and how they look like?

We don't supply either, and we never did on past releases which work fine.

But I'm confused, aren't these supposed to be generated by OLM based on the CSV and OperatorGroup membership? It's what seems to happen on our previous releases.

In case you want to have a closer look at the PackageManifest and what not, check out operator-framework/community-operators#2933

If you specify a single namespace installation (via the target namespace field on the operator group) and the install the operator, do you hit this same error?

I created the following OperatorGroup:

apiVersion: operators.coreos.com/v1alpha2
kind: OperatorGroup
metadata:
  name: my-operatorgroup
  namespace: default
spec:
  targetNamespaces:
  - default

And the following Subscription on the same namespace:

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: namespaced-test
  namespace: default
spec:
  channel: alpha
  name: nexus-operator-m88i
  source: my-test-catalog
  sourceNamespace: olm

And the result is the same: CRD present, SA present, no role satisfying the policies.

exdx commented 3 years ago

Potential solution:

LCaparelli commented 3 years ago

Full InstallPlan

So, the status' conditions point to a failure:

❯ kubectl -n operators get installplan install-s8q4j -o yaml | yq -Y '.status.conditions'
- lastTransitionTime: "2021-02-24T21:59:53Z"
  lastUpdateTime: "2021-02-24T21:59:53Z"
  message: the server could not find the requested resource
  reason: InstallComponentFailed
  status: "False"
  type: Installed

Taking a look at individual components (removed the manifest for readability):

❯ kubectl -n operators get installplan install-s8q4j -o yaml | yq -Y '.status.plan[] | del(.resource.manifest)'
resolving: nexus-operator.v0.5.0
resource:
  group: operators.coreos.com
  kind: ClusterServiceVersion
  name: nexus-operator.v0.5.0
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1alpha1
status: Present
---
resolving: nexus-operator.v0.5.0
resource:
  group: apiextensions.k8s.io
  kind: CustomResourceDefinition
  name: nexus.apps.m88i.io
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1beta1
status: Present
---
resolving: nexus-operator.v0.5.0
resource:
  group: monitoring.coreos.com
  kind: ServiceMonitor
  name: nexus-operator-controller-manager-metrics-monitor
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: ""
  kind: Service
  name: nexus-operator-controller-manager-metrics-service
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: rbac.authorization.k8s.io
  kind: ClusterRole
  name: nexus-operator-metrics-reader
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1beta1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: ""
  kind: ServiceAccount
  name: default
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: rbac.authorization.k8s.io
  kind: Role
  name: nexus-operator.v0.5.0-default-7ff78f79d
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: rbac.authorization.k8s.io
  kind: RoleBinding
  name: nexus-operator.v0.5.0-default-7ff78f79d
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: rbac.authorization.k8s.io
  kind: ClusterRole
  name: nexus-operator.v0.5.0-568f6bddd8
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
---
resolving: nexus-operator.v0.5.0
resource:
  group: rbac.authorization.k8s.io
  kind: ClusterRoleBinding
  name: nexus-operator.v0.5.0-568f6bddd8
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown

Oddly enough, it says the SA status is unknown, even though it's there:

❯ kubectl get sa default -n operators
NAME      SECRETS   AGE
default   1         22m

And even though the CSV status deems it present as well:

❯ kubectl -n operators describe csv nexus-operator-v0.5.0
(...)
    Group:      
    Kind:       ServiceAccount
    Message:    Policy rule not satisfied for service account
    Name:       default
    Status:     PresentNotSatisfied
    Version:    v1

I'm not sure what caused the installplan to enter a failed state. Any ideas? Shouldn't we be seeing a failed status for at least one of the resources as well?

Is it possible the installplan enters a failed state incorrectly, causing the controller to give up reconciling the remaining resources prematurely? Would explain why the roles never get created, leading to the "no owned roles" message and the failure to lift roles into clusterroles.

I've been having a look at the code myself and would love to potentially work on a fix if this confirms there's a bug somewhere, but could use some pointers on what to check. :-)

benluddy commented 3 years ago

The resources in an InstallPlan are applied sequentially, so I am interested in the first one that doesn't say Present:

resolving: nexus-operator.v0.5.0
resource:
  group: monitoring.coreos.com
  kind: ServiceMonitor
  name: nexus-operator-controller-manager-metrics-monitor
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown

Is the ServiceMonitor API available on your cluster? I just tried to install your latest downstream bundle on a vanilla cluster and it also fails on the ServiceMonitor step. The catalog-operator logs show:

time="2021-02-25T06:58:30Z" level=debug msg="execute resource" kind=ServiceMonitor name=nexus-operator-controller-manager-metrics-monitor
time="2021-02-25T06:58:30Z" level=info msg="could not query for GVK in api discovery" err="the server could not find the requested resource" group=monitoring.coreos.com kind=ServiceMonitor version=v1

That's consistent with the InstallComponentFailed Condition:

- lastTransitionTime: "2021-02-25T06:58:30Z"
  lastUpdateTime: "2021-02-25T06:58:30Z"
  message: the server could not find the requested resource
  reason: InstallComponentFailed
  status: "False"
  type: Installed

That failure message could be much better.

Oddly enough, it says the SA status is unknown

Unknown is the initial status for all of the steps in the InstallPlan -- they're updated as the plan executes, but this one terminated before it reached that step.

ricardozanini commented 3 years ago

@LCaparelli @J0zi looks like the Community Operators CI needs to have the Prometheus CRDs available, or we can work on an install script to not install our manifests if ServiceMonitor is not available in the cluster. That's why the CI passed in OCP (which should have Prometheus Operator installed), but not on k8s.

@LCaparelli for now let's just remove the ServiceMonitor from our bundle to unblock this release.

@J0zi this can be a problem for others as well.

That failure message could be much better.

Can we use this issue to update this message? Many thanks @benluddy !!!

benluddy commented 3 years ago

You may want to specify ServiceMonitor as a required API in your CSV spec (https://github.com/operator-framework/operator-lifecycle-manager/blob/master/doc/design/building-your-csv.md#required-crds), which would cause OLM to attempt to automatically install an operator (e.g. Prometheus) that provides it. If you don't want the dependency automatically satisfied, you can also use nativeAPIs to declare a GVK that you expect to be available on the cluster (https://olm.operatorframework.io/docs/tasks/creating-operator-manifests/#nativeapis-recommended). That should cause your CSV status to reflect the missing API.

LCaparelli commented 3 years ago

Ah, this makes more sense, thanks a lot @benluddy!

From v0.4.0 to v0.5.0 we updated the sdk and this sort of "sneaked in". This whole thing was driving me crazy hahahaha

I'm not sure we want to add it as a hard dependency, the operator works just fine without servicemonitors. It's more of a "if it's available, use it. Don't worry if it isn't" sort of scenario. From what I can tell, either option (required API or nativeAPIs) will not successfully install if the GVK isn't present in the cluster, right?

Is there a way to declare a "weak" dependency? It looks like this was brought up before (#819), but I'm under the impression that this still isn't supported.

If a user installs our operator by simply applying a manifest with all we wanted to have, it might fail to apply the ServiceMonitor, but the operator itself will still be installed and available. On the other hand, it seems we can't do that with OLM, which we were hoping to be the "canon" way to install our operator. As suggested in that issue, we may document this and suggest users to install these resources manually, but that's not ideal. OLM allows management of operators to be a no-brainer task, it shouldn't require users to find "missing" parts (even if not fully required) in upstream docs IMO. What do you think?

LCaparelli commented 3 years ago

Also... Shouldn't this have been marked as failed then? Not unknown? :thinking:

resolving: nexus-operator.v0.5.0
resource:
  group: monitoring.coreos.com
  kind: ServiceMonitor
  name: nexus-operator-controller-manager-metrics-monitor
  sourceName: my-test-catalog
  sourceNamespace: olm
  version: v1
status: Unknown
LCaparelli commented 3 years ago

Anyway, thank you all very much for your support, closing the issue the original problem was fixed. :-)