From 2c014209c54d08f640faa3e6d7c6c0e6e767f934 Mon Sep 17 00:00:00 2001 From: lizayugabyte <77016159+lizayugabyte@users.noreply.github.com> Date: Fri, 19 Feb 2021 12:53:26 -0500 Subject: [PATCH 1/2] Updated YB Platform files --- .../install-software/airgapped.md | 55 ++++++++++-------- .../install-software/default.md | 39 +++++++------ .../install-software/kubernetes.md | 42 +++++++------ .../security/enable-encryption-in-transit.md | 13 ++++- .../images/replicated/application-config.png | Bin 0 -> 29206 bytes 5 files changed, 91 insertions(+), 58 deletions(-) create mode 100644 docs/static/images/replicated/application-config.png diff --git a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/airgapped.md b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/airgapped.md index 509961586620..59917d7e2a0f 100644 --- a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/airgapped.md +++ b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/airgapped.md @@ -39,89 +39,91 @@ showAsideToc: true ## Install Replicated -On a machine connected to the Internet, perform the following steps. +On a computer connected to the Internet, perform the following steps: -Make a directory for downloading the binaries. +Make a directory for downloading the binaries by executing the following command: ```sh $ sudo mkdir /opt/downloads ``` -Change the owner user for the directory. +Change the owner user for the directory by executing the following command: ```sh $ sudo chown -R ubuntu:ubuntu /opt/downloads ``` -Change to the directory. +Change to the directory by executing the following command: ```sh $ cd /opt/downloads ``` -Download the `replicated.tar.gz` file. +Download the `replicated.tar.gz` file by executing the following command: ```sh $ wget https://downloads.yugabyte.com/replicated.tar.gz ``` -Download the `yugaware` binary. Change this number as needed. +Download the `yugaware` binary and change the following number, as required: ```sh $ wget https://downloads.yugabyte.com/yugaware-2.1.2.0-b10.airgap ``` -Change to the directory. +Switch to the following directory: ```sh $ cd /opt/downloads ``` -Extract the `replicated` binary. +Extract the `replicated` binary, as follows: ```sh $ tar xzvf replicated.tar.gz ``` -Install Replicated. If multiple options appear, select the `eth0` network interface. The `yugaware` binary will be installed using the replicated UI after the replicated installation completes. +Install Replicated. If multiple options appear, select the `eth0` network interface, as follows. ```sh $ cat ./install.sh | sudo bash -s airgap ``` -After Replicated finishes installing, make sure it is running. +The `yugaware` binary is installed using the Replicated UI after the Replicated installation completes. + +After Replicated finishes installing, ensure that it is running by executing the following command: ```sh $ sudo docker ps ``` -You should see an output similar to the following. +You should see an output similar to the following: ![Replicated successfully installed](/images/replicated/replicated-success.png) -Next, install Yugabyte Platform as described in step 2. +The next step is to install Yugabyte Platform.. -## Set up HTTPS (optional) +## Set Up HTTPS (optional) -Launch the Replicated UI by going to [http://yugaware-host-public-ip:8800](http://yugaware-host-public-ip:8800). The warning shown next states that the connection to the server is not private (yet). We will address this warning as soon as you configure HTTPS for the Replicated Admin Console in the next step. Click **Continue to Setup** and then **ADVANCED** to bypass this warning and go to the **Replicated Admin Console**. +Launch the Replicated UI via [http://yugaware-host-public-ip:8800](http://yugaware-host-public-ip:8800). Expect to see a warning stating that the connection to the server is not yet private. This condition is resolved once HTTPS for the Replicated Admin Console is set up in the next step. Proceed by clicking **Continue to Setup** **>** **ADVANCED** to bypass the warning and access the **Replicated Admin Console**, as shown in the following illustration: ![Replicated SSL warning](/images/replicated/replicated-warning.png) -You can provide your own custom SSL certificate along with a hostname. +You can provide your own custom SSL certificate and a hostname, as shown in the following illustration: ![Replicated HTTPS setup](/images/replicated/replicated-https.png) -The simplest option is use a self-signed cert for now and add the custom SSL certificate later. Note that you will have to connect to the Replicated Admin Console only using IP address (as noted below). +It is recommended that you start with using a self-signed certificate, and then add the custom SSL certificate later. Note that in this case you connect to the Replicated Admin Console using an IP address, as shown in the following illustration: ![Replicated Self Signed Cert](/images/replicated/replicated-selfsigned.png) -## Upload license file +## Upload the License File -Now, upload the Yugabyte license file received from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form). +Upload the Yugabyte license file that you received from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form), as shown in the following illustration: ![Replicated License Upload](/images/replicated/replicated-license-upload.png) -Two options to install Yugabyte Platform are presented. +Two options to install Yugabyte Platform are presentedas, shown in the following illustrations: ![Replicated License Air-gapped Install](/images/replicated/replicated-license-airgapped-install-option.png) @@ -131,16 +133,23 @@ Two options to install Yugabyte Platform are presented. ## Secure Replicated -The next step is to add a password to protect the Replicated Admin Console (for Replicated use only and differs from the Yugabyte Platform console). +Add a password to protect the Replicated Admin Console, which is different from the Admin Console for YugabyteDB used by Yugabyte Platform, as shown in the following illustration: ![Replicated Password](/images/replicated/replicated-password.png) ## Preflight checks -Replicated will perform a set of preflight checks to ensure that the host is set up correctly for Yugabyte Platform. +Replicated performs a set of preflight checks to ensure that the host is set up correctly for Yugabyte Platform, as shown in the following illustration: ![Replicated Checks](/images/replicated/replicated-checks.png) -Clicking **Continue** above will bring you to the Yugabyte Platform configuration. +Click **Continue** to configure Yugabyte Platform. + +If the preflight check fails, review the [Troubleshoot Yugabyte Platform](../../../troubleshoot/) to resolve the issue. + +## Set the TLS Version for Nginx Frontend + +Specify TLS versions via **Application config**, as shown in the following illustration: +![Application Config](/images/replicated/application-config.png) -In case the preflight check fails, review the [Troubleshoot Yugabyte Platform](../../../troubleshoot/) to identify the resolution. +The recommended TLS version is 1.2 or later. \ No newline at end of file diff --git a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/default.md b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/default.md index 67b65e93144b..4ba22a960bee 100644 --- a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/default.md +++ b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/default.md @@ -39,25 +39,23 @@ showAsideToc: true -YugabyteDB universes and clusters are created and managed using the Yugabyte Platform. The default option to install Yugabyte Platform on a host machine that is connected to the Internet. +YugabyteDB universes and clusters are created and managed using Yugabyte Platform. The default option to install Yugabyte Platform on a host machine that is connected to the Internet. ## Install Replicated -Connect to the Yugabyte Platform instance and do the following. - -1. Install Replicated. +Connect to a Yugabyte Platform instance and then install Replicated by executing the following command: ```sh $ curl -sSL https://get.replicated.com/docker | sudo bash ``` -**NOTE**: If you are installing Replicated behind a proxy, you need to run the following: +If you are installing Replicated behind a proxy, you need to execute the following command: ```sh $ curl -x http://: https://get.replicated.com/docker | sudo bash ``` -After the Replicated installation completes, verify that it is running by running the following command: +After the Replicated installation completes, verify that it is running by executing the following command: ```sh $ sudo docker ps @@ -67,27 +65,27 @@ You should see an output similar to the following: ![Replicated successfully installed](/images/replicated/replicated-success.png) -## Set up HTTPS (optional) +## Set Up HTTPS (optional) -Launch Replicated UI by going to [http://yugaware-host-public-ip:8800](http://yugaware-host-public-ip:8800). The warning shown next states that the connection to the server is not private (yet). You will address this warning as soon after setting up HTTPS for the Replicated Admin Console in the next step. Click **Continue to Setup** and then **ADVANCED** to bypass this warning and go to the Replicated Admin Console. +Launch the Replicated UI via [http://yugaware-host-public-ip:8800](http://yugaware-host-public-ip:8800). Expect to see a warning stating that the connection to the server is not yet private. This condition is resolved once HTTPS for the Replicated Admin Console is set up in the next step. Proceed by clicking **Continue to Setup** **>** **ADVANCED** to bypass the warning and access the **Replicated Admin Console**, as shown in the following illustration: ![Replicated SSL warning](/images/replicated/replicated-warning.png) -You can provide your own custom SSL certificate along with a hostname. +You can provide your own custom SSL certificate and a hostname, as shown in the following illustration: ![Replicated HTTPS setup](/images/replicated/replicated-https.png) -The simplest option is use a self-signed certificate for now and add the custom SSL certificate later. Note that you will have to connect to the Replicated Admin Console using an IP address (as noted below). +It is recommended that you start with using a self-signed certificate, and then add the custom SSL certificate later. Note that in this case you connect to the Replicated Admin Console using an IP address, as shown in the following illustration: ![Replicated Self Signed Cert](/images/replicated/replicated-selfsigned.png) -## Upload the license file +## Upload the License File -Now, upload the Yugabyte license file that you received from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form). +Upload the Yugabyte license file that you received from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form), as shown in the following illustration: ![Replicated License Upload](/images/replicated/replicated-license-upload.png) -If you are asked to choose an installation type, choose `Online`. +If you are prompted to choose an installation type, choose **Online**, as shown in the following illustration: ![Replicated License Online Install](/images/replicated/replicated-license-online-install-option.png) @@ -95,16 +93,23 @@ If you are asked to choose an installation type, choose `Online`. ## Secure Replicated -The next step is to add a password to protect the Replicated Admin Console (note that this Admin Console is for Replicated and is different from Yugabyte Platform, the Admin Console for YugabyteDB). +Add a password to protect the Replicated Admin Console, which is different from the Admin Console for YugabyteDB used by Yugabyte Platform, as shown in the following illustration: ![Replicated Password](/images/replicated/replicated-password.png) -## Preflight checks +## Preflight Checks -Replicated will perform a set of preflight checks to ensure that the host is setup correctly for Yugabyte Platform. +Replicated performs a set of preflight checks to ensure that the host is set up correctly for Yugabyte Platform, as shown in the following illustration: ![Replicated Checks](/images/replicated/replicated-checks.png) Click **Continue** to configure Yugabyte Platform. -If the preflight check fails, review the [Troubleshoot Yugabyte Platform](../../../troubleshoot/) to find a resolution. +If the preflight check fails, review the [Troubleshoot Yugabyte Platform](../../../troubleshoot/) to resolve the issue. + +## Set the TLS Version for Nginx Frontend + +Specify TLS versions via **Application config**, as shown in the following illustration: +![Application Config](/images/replicated/application-config.png) + +The recommended TLS version is 1.2 or later. \ No newline at end of file diff --git a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md index 50158ac6daaa..c511ce2c3073 100644 --- a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md +++ b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md @@ -39,14 +39,14 @@ showAsideToc: true ## Prerequisites -Before you install Yugabyte Platform on a Kubernetes cluster, make sure you: +Before you install Yugabyte Platform on a Kubernetes cluster, perform the following: - Create a yugabyte-helm service account. - Create a `kubeconfig` file for configuring access to the Kubernetes cluster. ### Create a yugabyte-helm service account -1. Run the following `kubectl` command to apply the YAML file. +1. Run the following `kubectl` command to apply the YAML file: ```sh kubectl apply -f https://raw.githubusercontent.com/YugaByte/charts/master/stable/yugabyte/yugabyte-rbac.yaml @@ -59,9 +59,9 @@ serviceaccount "yugabyte-helm" created clusterrolebinding "yugabyte-helm" created ``` -## Create a `kubeconfig` file for a Kubernetes cluster +## Create a `kubeconfig` File for a Kubernetes Cluster -To create a `kubeconfig` file for a yugabyte-helm service account: +You can create a `kubeconfig` file for a yugabyte-helm service account as follows: 1. Run the following `wget` command to get the Python script for generating the `kubeconfig` file: @@ -83,33 +83,35 @@ Generated the kubeconfig file: /tmp/yugabyte-helm.conf 3. Upload the generated `kubeconfig` file as the `kubeconfig` in the Yugabyte Platform provider configuration. -## Install Yugabyte Platform on a Kubernetes cluster +## Install Yugabyte Platform on a Kubernetes Cluster -1. Create a namespace using the `kubectl create namespace` command: +You install Yugabyte Platform on a Kubernetes cluster as follows: + +1. Create a namespace by executing the following `kubectl create namespace` command: ```sh kubectl create namespace yb-platform ``` -2. Apply the Yugabyte Platform secret (obtained from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form) by running the following `kubectl create` command: +2. Apply the Yugabyte Platform secret that you obtained from [Yugabyte](https://www.yugabyte.com/platform/#request-trial-form) by running the following `kubectl create` command: ```sh $ kubectl create -f yugabyte-k8s-secret.yml -n yb-platform ``` - You should see output that the secret was created, like this: + Expect the following output notifying you that the secret was created: ``` secret/yugabyte-k8s-pull-secret created ``` -3. Run the following `helm repo add` command to clone the [YugabyteDB charts repository](https://charts.yugabyte.com/). +3. Run the following `helm repo add` command to clone the [YugabyteDB charts repository](https://charts.yugabyte.com/): ```sh $ helm repo add yugabytedb https://charts.yugabyte.com ``` - A message should appear, similar to this: + A message similar to the following should appear: ``` "yugabytedb" has been added to your repositories @@ -121,7 +123,7 @@ Generated the kubeconfig file: /tmp/yugabyte-helm.conf $ helm search repo yugabytedb/yugaware -l ``` - The latest Helm Chart version and App version will be displayed. + The latest Helm Chart version and App version will be displayed: ``` NAME CHART VERSION APP VERSION DESRIPTION @@ -130,15 +132,21 @@ Generated the kubeconfig file: /tmp/yugabyte-helm.conf 4. Run the following `helm install` command to install Yugabyte Platform (`yugaware`) Helm chart: -```sh -helm install yw-test yugabytedb/yugaware --version 2.3.3 -n yb-platform --wait -``` + ```sh + helm install yw-test yugabytedb/yugaware --version 2.3.3 -n yb-platform --wait + ``` + +5. Optionally, set the TLS version for Nginx frontend by using `ssl_protocols` operational directive in the Helm installation, as follows: + + ```sh + helm install yw-test yugabytedb/yugaware --version 2.3.3 -n yb-platform --wait --set tls.sslProtocols="TLSv1.2 TLSv1.3" + ``` -A message is output that the deployment succeeded. +A message output will notify you whether or not the deployment is successful. -## Delete the Helm installation of Yugabyte Platform +## Delete the Helm Installation of Yugabyte Platform -To delete the Helm install, run the following `helm del` command: +To delete the Helm installation, run the following `helm del` command: ```sh helm del --purge yw-test -n yb-platform diff --git a/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md b/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md index 8e2bf9b779ab..db5d86a69179 100644 --- a/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md +++ b/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md @@ -254,4 +254,15 @@ X509v3 Basic Constraints: 3. Verify that certificates and keys are in PEM format (as opposed to the DER or other format). If these artifacts are not in the PEM format and you require assistance with converting them or identifying the format, consult [Converting Certificates](https://support.globalsign.com/ssl/ssl-certificates-installation/converting-certificates-openssl). -4. Ensure that the private key does not have a passphrase associated with it. For information on how to identify this condition, see [How to Decrypt an Enrypted SSL RSA Private Key](https://techjourney.net/how-to-decrypt-an-enrypted-ssl-rsa-private-key-pem-key/). \ No newline at end of file +4. Ensure that the private key does not have a passphrase associated with it. For information on how to identify this condition, see [How to Decrypt an Enrypted SSL RSA Private Key](https://techjourney.net/how-to-decrypt-an-enrypted-ssl-rsa-private-key-pem-key/). + +## Enforcing TLS Versions + +As TLS 1.0 and 1.1 are no longer accepted by PCI compliance, and considering significant vulnerabilities around these versions of the protocol, it is recommended that you migrate to TLS 1.2 (default) or later. + +You can set the TLS version for node-to-node and client-node communication. To enforce minimum TLS versions of 1.2 and 1.3, add the following flag for T-Server: + +``` +ssl_protocols = tlsv12 tlsv13 +``` + diff --git a/docs/static/images/replicated/application-config.png b/docs/static/images/replicated/application-config.png new file mode 100644 index 0000000000000000000000000000000000000000..922f0f10477874a186721b5c9742f5eab4e0d29d GIT binary patch literal 29206 zcmbTe2{hIH8!x&mX&2Qdp(2!!%*h;4GGvI%nWr+(W2TTYL=i%igb+e9Qz1#HBxEX* zWS&B%``Q2hId`pl*1GH5d#v~E?Pc%nH+;X(^O>Gs_(e5^-MbF%A`l3>l@!lu5(r!I z*Ddx$@_$Y>B+%eL+uY=ow1`Av?+^9w1Oh8T>71;V_k)RkFK;dF0kIjk-i4$ODjW`) z#Ifyi5~t4)kDR-+eLqd;{_Fkmk6EiCDhvMod2FuVRm=B2ca3zHgH`cvr7V$+BKD4) zFMpg;)}UnB+D7?!wU5T#_;A@@t1D+udQF`k?fc==wlr|5C@PAYfqp^Mmp)U5pNX#oqUwJ*SM`S&kqALfY*FVk z7~=L(ytWr{W8%E4=*UhJdQn+9f|V$eqDl%K8Zr+I42)%WdSbtO_ioQBql`~|ibssQ zy1VZuBqSs!zn}N>@$qqTD%8nio{-x@@O!gcJ4cs>;`Nw&fnL$$k`lMxmktuCQ=^&n z#Sx8dvJQl!OQv*B(plG18TwP(+HV(E())k_1{ z_!7s%In!{3mwmR+SK=3rrd@L!sP?fft$h4=Xs9t#EV@vy=*W>H=FcN33FV7ECkX=7 zCoSLIIc4|N-OFowuZ0rHYh{4{{?em&BT6vv+ z+$GXR-CSKifBtN4VWIv|nwOFwOA?E&7x)lY>#e=nkgqe|?=_fu|9-i3Yx2jB7h~BK zZXX=+tcq7Y);=#59hvAYv`C8Nw*FN2bg*f@+B^Eb!KS(4V)0yv&92~&0|OhYgPXNk zS- zA(zNTbCHz1ygXHoIO9T@z>Vsb5jkQwuT+13zr4J>RQn0Kh{unQBv>^THYC%ry>RG# zx#O_6>GVL2ZK(k%bZTm9ezbkZjvf0bG_(0*3nwpxyx=Tgcxm8t?!on}IvlXOn4wvJI5?eC6#v>yla96#HTdhwfskFAX zjCCeD#>v!#_4Tj+rQQoqOe*P4xg;};V7QgM>c&FV>VIQ`Pn(xLGS z78VxQu2t3lAPpZQ5WH`64G{Dam`_@(`1<N95Uc3-yYD!5-xze7Nf0657_Jg>% z`B9lopZc)f3eik9j*iAT~q6v&;K*^+R)WlBkohwzjsu zzP`Qv#Mk`G`Uws;HamCkPL=Sm_4M?#v9WP*aIm)im2)YZ`^1S=nLoCr-)`L^1_o}n zB=XlS4@HiD&ClS3%k0%Xg%Z*Ul?*Blum99zDA9&|gGQu&Ai$(+}rz z!-C@CVyq5rU0nryoj?Eg?_c9e_nh)_F<##M+}uAX2YBh_m-crR+3}0bHL%u9E?si_ zJJIv}`SZ<{hnqS1`TGauNpiugFG@>OPhS&}kr}iXF)4RW&(3bL6gnj=Oh-?zmMom} z^5x6&@@`WBznRxNcJAD{xVVV5-qX`_Lg(34dwVIjUr}n=*CvXZNOHoeq9P(kLjR19 zx4eHJ%`8d3Z{NN{hayRp^KFt3{r~DmJg&u}4hsvrfB!yq*gj6RGn)d0SCQ59gyiI8 z>ks$MN_wzh0~da4l=ZG-1?t;Brm>q3+?anD$En`d+Get`rlH!uFC$Y(T9NpalhW)K7{X1l@CWR4F8YHDh0 z$0sF)lW12x1gZC3Q$2h3>?&vM-Mef=ISq|ZC{|do((4NyFJFqdT)pERU}p9M-$Y~j z*4s-XhsBdNCqRAl??=aPFOKu^@f|&S^wg>67ruAnuxAxB+r6~3Xi`K(gd98OUP>h|9=a;PIalQx3Kw7pdLF`OBBSd@dD+LP=4>V(3UzxGjuf>0IyI z+uPk*#GtoxAN0fcQGb($!@QLP0svh&l&`t)ztX6r=3=pSzloG>eJBB zm^Ep=4s`bL=M92sS#P%b!-7uRGKXFrU0uMc?k`_npcOuT{1|`722{20GJbA)y?65K zRpG$3VHO&>-ZCczVt9s3BJX7#Bcs%mlqy`A=;4ViGJi!;U41VVRY~t80K%>tN4U5YNfcMNZzXsqGK5{nDHa-5#Ac28ul~Ie78c>* zrKR;H?esOFlP5=8Q<~(!^2K^>8eI*GBjQWr-SeH-^iv*xna= zn764S7|VX>;6dYSlci0#J|TOhNqcKoex;;{It48MxM>owGJ;|qu>%$ArFrA7QiJ|Y zzJG(!SB|7y`N}A-F_agxJP5?YndU9GmRnLXk4AighbJ_^ln_*ADq4H&N$+HIOw1L= ztlHXvONrqva+a2s_Yx8uyPun(yYH1*69_Zg*x0~wCvQyLr-;bN_Ebp*5=p>ost-J1 z_Q$`z3OAG)vFN78Mr>peQBlCc<>loQx&>lPdy=!1Vwt4J)HEU%y!(s@1yX!-uGtnCXcLDUUx|Dk{`XF6L}im6e*8E)5S2 zk>qp>43G2hQ199`B-VCS_|Kwm(OrcH9P~6a8YU)AWxcEFOOq25QNTG75ueB0Z~x~@ zExW_KsG*^O{n#-j_E>;4aDZ2@&d8FeDMOZX+5WO$V2>>?FGruOt(A^=92*yR;>3x@ z^Z97*OikDuU%R`Xe!5D}YY;jtrrJ?97_bTmiVf9)<|Qm8wMMyFLm-^Nh6*CNR`mz7 z8g@GK7yQ=O(eeEKF71?RSDe9kNgSm~iZQs7#%F4<{_#kzC zL*YlSnk)+0JM71^j^0(28W%;y_AJt*laFO@a^Xvi92OIFNzTgD%qd^ks@fr}dWr6s zn&?@g&%s2LIGclP?6tPHZp-krM4adeXKAdK(l_yFaV$$27Mm?Hl6pPq*&)okL6>%} zq0OwlX`{@oGhdLpe%=pA#mQ;G#b#--HTW*S=4ezwF9((YKp{9556!UecN@WPIssh5v4E8&Rdz|CWodkmEBU$qQ zvy7ywnI;T-AO6d|g%D)2kDmf;&E0@kNrU(|4}H*NFTO)vFLfek3m9?fjM_dD^$-QV z&-|MLJ%(jFzD@9>1A8XSXpr#dD~11l?*HZo_Y$`e+UMUa^6o?%?RR7lwcXLhIz`7% zeB-h4T&jJq`&|N|jPlJ@Vc%nHVP+q!-4qpXwOSARYrK6Tw+JKzMZ{(J zZO`Q2U%#wVT7S7#I5Tl7eI|orzMJ)IIx66GfQP&&y2{GMdOX%8J&t9)lb+cfO0iEm z#_lPy6WLN)&uiSP|6$7bcEnYQofd?E?h$rUfMN)2C0lcDV zR`s(h74wX{RuF?pk)b5oy%7gyrJPC)fP>UMtNN+yZz+Xm(w@+XY#efz*coi9pFpPE z&vZ^i4>N{^k4%h@yGf*iA|LSiOw$rYqQ$>MKDA|Kx;(Ve!#a7|ek^}BFZWD(rj4S3 z1_T5+IXPKcJ~^LZbM>mTM5?*1`4*-sK9||4PDRuEdrR zcM0Y_JDObR9m1y}AB6AYvSO=xIn=6|*3J$?G| zsxY{mHu%)ltH05nezm0@B9XvA-@ku<@ZdoX)#P&;TC%d&b@Cbo$N~!((rNTS1%)Pb zgr&*erB~bbk|;DZHC^X^Hp@rSe-h@6Ypz|JYeBzbqz=QUgzVT0PMJ0e_I%iHMmF@K zi;Ih_>}${|@n|X{Q7mv{?RCfwApSfp?%kAU?d--mANmd1Y`zx2MZqVotgd!-bv=~! z_x-OjQ(QcU_YOD3u!z{}nVGS*&oeb`r=eYtRa8_Y?%m5kkzP?D&dSQl!^0yitd;TUoPxrk+iw99lrukrxaMkchrIsoE}_k> zedY|IrC3Qx3H?vp|KAI_bnHeV71ddyyn@0dI$+Py>FH^AiBkt}*VP4jdcM@j>wjUh zFM9aKjT`ilBUok-77m>DebHmTXYXEhWo4m*w*m3b-rN)40x4#3d3IPK=5XtW50?5O z?Cj^#FHZDToaE$GNWW;0>$*Ji14PvP;mwwjf56Xb52aI6Q~NtQ0CUYt4b&fq3EF;n z3d#(o5X-(a(E}P9N2VuR+vk02jMFcwq)KS#>rD5QjN;x<*FTW-a>V+=**KO}WoM6K z;V|$S5_j#QrC|FHDQ1!O1Fd!d0zpkt&YYWXm)W~}x2l?&HRG?hoBdk|b)Ew~dxJ)O zn3@{1XwydP-@H+b?JIZ5FvwR!NxyKxt-=sDj)C8JVr=YgvnBfHs82}`k1+}o)Eq%- zI|qkMF6C!)|72F6=%G%vKM=o^@#(_@@whCTkk=nSeM;BN;pXNJ+sne2*mB{*g|l*U z(5gU|eojxz;A8<5)U#i7+kW}>&G+X!nhHZT(m8zcg$pgIUIXapcuT2)!=_5Bb%_>t zs+5nAY6mYbFRDOub2E`Gm=z$z)zx)qc(|pdrIGT*pFe*<2eBcKhTc;?CQIT=w1b3( zcVH(9B~27mO_?*E&-ip}49WvGZv*3vY{-|`ZGi4yFor5M3=c1ei}L2@X*IkmzTX~xn)VtOo_^we2IBgRjb1> zG8@1fxp{d?v49I$0Jk8|P*eAnTv0bMd5A5j+JRGcEOTSZzQ_fYZNayu`#A5*{>YVF ztz0yk#|@Vy_-6WvAi_98JXGPTv!YafzM64{DYq>mhV zoSPdlT>kOnM~ES)vh?)yX<{yNDuyJAvR>ZA76*~b*RHK*siwTN@6j|c;7$=7Gm&nPb@-W2D-5P*VO|S-E}i6t|!tnSOj1bL`C3 z9=dphx?VB1!No8~>#&sf%=I0I^@=USwYdGq^UFwb6tW=Z>M0_-+3*TT27pORkW&EC zjjB8W*s-K)(QJ0zcw=64%jj8}`LNhPclRyQpUKI|KYzIS`LQ9F4>?r>@TqXbozKwV zqQg2y{a{ymSz2m!<;qFwkm2%{5eQLKyLX><`=z3(`5C(!i#skh7BJ%`iB>Y8vFZ|c zd{Z=Y6(mJaVQ%6Z$Vk{A^*>O{?h9E(cnithVs9Sn04bHO$;%rj%Lh_EbH6`jKm@TA z(no6m$L%gs(f9%hf4X*cimV>tFw)b_P%E%k%!BM59mzBbAJW(>g}!+2_$6H02Wq1O zHP^Zdj824|nQf|@4Rj~G;w7}adpDyjHzY=%s&=KMhi=#QdV!%5-g*Hjg|?;dM_gSL zqab^*+}XcN-o(TNG9&0`0-sR?$#=SD34)W)+VU*;e@ZI{)cpMO8R$vF<){ob#;C-N zi96Fqq47TS9twxfij%rTXH}#J4$$w2_78LtcxxMWdnW!jM{DThsg`08cZia`XwY_c zC*%~RDhdnRp|?V-ojU8Q((U7;!~+Jq-Dg zy8feZey6R2ND6SmJ^cxz8L6O18L)<-X7p$BiU0}e7^9;w8+jj(wg6$Ww09EVXV1;E z9B~!>j_u1wZlA9gh|-%b;W;6~=d(4Y(^ebD$jF(gIp!?(#kN$eTKPjTE79f7e!{CJ zA6~*Osa8pu<=GwWqdpseHw?YSMtohMw%lK1WjxcnIrv0&D`kFOovs`F;p_*}YOYw` zCgjWnT|YiC@rqEA^yZpd`#Z&1%fyybkp7-LVNcFNaoSj49UmWW?7BN%w`3Q1>@ZD= zBUsqN=EmUWzC7=${#wiCSa3Pe=#A+UGWWl!4~(gAY!C=0zeWf%CvRD-K!uA`L&Sx<3@z9XXx0owgosZY9f>{_EkJx@g_w zi@;535-^=^ZTq`}OMyTj?G7N2!l@Y7qWF|u2%p>EY54uCeOsC)sJLyNF$lP0MGcP68^R3VI{}cKyFuXa9eGFlPYes_lpK zM`7NAiD?gE)yPAF8>at;M9laSFZBIl0L@UJQzO86<7rV#5#c>~@)GW~AzyaKSo}SC zVbvH$L33amOH*`R&Sx`ubmQBmV zB!+YlaLTw)ff%2Va9Adwx}@Y%c87wb`|M_wF@DGPEb3vYYCwIB?(q z$REB01qHEKMFYHWM0s;>4iTDMAU-fPflD_wH9_K;`-Hjxi-D|?ptPWI18UFBxk7G& zxCOio0lqcubQKT_bfTi7yJq(VE#7KrYePZ&Hu?7^OMrKC>@jp->k=RQ1y+|ipJ&zj zNTSJ}J$pnLsj29Byhq}7p{_!haCLJ-UAZ=z>SbK+46n*gI2l%9R#w(_D*A=R#r|c$ zl~?)iskQ_?eu}jUxvH|V61|U+%^h6|LO@?%-~JOiVocG4&{v4*kg4B~%t5fvPV=<| zN&;}-9A?>6>{x*EQ|>RE0!oz#2yrxmOQIez_`^ZfSz1RWZ3&k*!p7%5C zrrR7mJkP4DrTF>zg@lT8a(1#k`E(V!-76Qv%a>DLn?Bd$G3SGEgL}F6^uovHI8IUf zZd2idG;-jK9VgDjT7slEu>{%+AIw%savd%MZ7vhwuii2v#X?IfWcT$MSWrQExt^bO z*O)so9q0)%ROm$=9UTjcqv+0~Gb|f3JMwi>l9FshQg#O8vc;-!^g_}DEun#J0&g}D z;Qo+^{nMPBbkNVAo>has;z^a?u=M^4UhVc`X+qUVXT zQvC7CUK8DHi7lWYd7ZY*dlcN=Ul`;YS9{N*X+iQ`9Ls*#mMXb~-U+wo_xSj}ardGG zbrlsbLlAWk6e;9>hLa8Lie3cNX504=De=7}Oo}E@`h)I*F4cr-K2G|BQQ%yw$ zc8+Z+pTUb;WESt8)--EZ^T;rMB4z|7^7{@nnl*cfOY!jl_cRnma31g7qr3Wg2kPpp z?>h)IEycmCci4BT&q7*hDc4Uc{gJ~$AOx5_KgdN6CrnFu%}Wh_{(L05`9IYR<*HF! zC8UvR%NZv3O_+>XnVGUw(gea9dgur1`5i2N7xnbSZVA4k+VZHZY$^TbVR#AX)?J6o zp$DD8q6yqw9mKVeNL34FrOc!@CK3RdP(%&#=?`yiA$*shp%8TceNje6rmA0BZ_6u5 zyDhKTd2ldJciF|yT;?+7yjp}~`G1N+b>|2uTg%O!d@j7=pf9vbaVrP-Olkq$TuxVz zqZNl{2(RYXP!|J)2or;KgY!#3iKEV90mhz?^wJzc0|gk!6`S?o%zp3pEiIt17h-<` z0_|m%V2@YsdZr&@)(v>Ydsh+WC=55JB0XaW$xtkC(jcwS2Ohu&lai9cM);h00iW8~ z*ciB6&mw%V75uf_Z^acb*Q$j+rS)rP=OU1P;9{pP6f_FiXP3*=xZ@prUrv619pYK# zzy5C#cxeFX17=#yJ9jT1 zdX;qYN<*u$TB^k2`xAvcu#iC+-jX2}%B9remrJOOF;P(}7cN{bwT*xHa1fZVqoV^f z*8lsfEukL)0RcWgSeGpSbS&u+i(dUVUI<3GHdDX%=FOXSrQh%ZnYnjI(alimgIS+s zXK${w2e!4eNCvDeqa%Rrg_6)Z(%>}v`K_V+Lhpew|L@(=m?##R4dBvk>r`m0tv06H z&VYA<0P5-8?{@^fe$2&v4HMT4b~Aax1$MpzhSjj_z5I!KItFDOL_hSlCK@9!NavSn)e zjD0><)@yX>($T~gLFzm>)1t9o#@rFlc%TZKL=+?@loUM-&>A>ZFJd5gk4_ z@*Eb79CsD3CX-DITmytd4ut9B7Lb!6W{hx!c!_f8^u~qQDX^`ltLLNjsPj7C7u%bf zvbGd^^?P(-MKvy<9PFThi9#9odt#z`b*c(-LhWWJ8Ws>c-L4x3`3Z{bus5uXjQSy~ z_@v2r&zRzzL10kE7k%MO%Q$~OgW}=nSkTRd)-dR@{$f*VVu@(BpcPzGXmEgt}{Kr2L~!jyOWj~mRdl`mYt0^y$e8IXGL&>?h4 zap+fe4?4bmtAy!KbpLGeZVYxGS5HX$H;wQhAc1<;&_V{zJ-|?Y@NA5C>PCjlJ zJE$VqVAsHan#Pw$bf(UKf53U_a`cn&UAPK^cW$JmZWEl+7jX-+ULVUY?lbq(u4^Mj z!~rG*fc_%W^>3(t=R)=owr<-tKQ~w4@&?VGQ|-aBMZ5!t4} z5FA|xb`mxxEl!1*brmEA7F#DOvUkPN0JjomEUE=|DduQFNIs;#1NwDD{g3ZH0i@o{ zni)#8Zm-F2@yW>&D0SU55Yqx^!^|K%VgKW*hm;?C!f<{ITj+%6HFI-wUtbCLqOE|V zv`Z8Nl^%JoO&J?TtsyjrlIjKa+}xI6u#FHj&eo=RuoVm`73c)Ec6aI?$}t7LB2=|ue9`lV_Aprq_fzBXH}1V7EG9i;%7bf z^!x~*S(oVZ(3kY!C)ciB%h$=%V~A8*Gzl>vfohC-R;~W~2aUR3piAF7dbq&9xcmlt zy#PGP!LB|6yn zEyZw{*p;yKqW6`VX4y!Hi|c21fU?Iv=87I>r`=gE@E=Eua{qth0LUn%wCWfeZ^TJ< zqHGr4@X9?IJ?xz(%19j^9*!RB_j41{2V|M^qy`)?IhcjKMr~y!d|9es5kn6LY-lLV-rZp{@tfTqX69NU#l!Pq%-z$=tNp$p0+}CDME5q$uC4i1^#?RD zdqEt(Vr>oi8EOOE!GpKoA`bvIhJqO#9gUaWkh`0ZAOie9xb{obw`Rap;GJbLhyYBT z+vm5f!x+09=Czfe6f3N{IptLs856VFVzTk37@{Mz1}I3`9TkQJfE(~BP+niYc!35F zB8Nz0T(fuD6@3v2iEm@>P-1|qLC*B@bzE-SC$_*AM-VS%)rgNlPBG)tM`6|fz?v8) zaavm1$2xf~Ow*H-@2#qLoE8_!Q18vqNvDQQAFT)5#`b^QZq|v*}L)c z@%{4IfO+o&n$+)DW?UF^`!<4I(B4%Q6+v>m2K~!4bKq>T5@%fztVvQqbgmGNMdW2F z5(Qfphe%H(3wG;)g9m-F5|fh;mh`A-pbw0SsTFqZqxdv1P>yK*%Im-o4 z)2Py2DZAtLfs^FS!^Gw2+qap8EN>}i(o)5k0Yh-dM`VqG^0uakvYht4mo)}Y2S&EK zAVMN$?H9laLIe)p7ERj~X7=gRC#)qa#`EbHf4f)W4Jj&FHXT{8OKKNBUw|3~ag`iG z!__UeZao;Ue9Gc2bu2sT1;kUBYPWB%BRB;MiVW{SdQl|60-)ZIQ89%7BX{iwYyBH; z(dguPfU9C7fqPT$-OCSc-`@VG7$4xJh{((I^y^kVWILRa61K;`fB)bzVod}f4Th}? zo+uVAdg>H%nE^=U?7Hz7i@l~M)k+^ZnNovE&uiM+od}r$4;k|50vn)kEcp5(GG$zd zEC@Wa`-XgVvk%cg94QBSXk$lL-oIC#HA}MU0SIsu#gzDgEMVd{El&{5|tAT^iE7oX2S)Q}uFq@uE5d}}Fm;P&~*M!Aj` zuT7D(ge&w)fJabJgClNd@ORIuQRIj0y7(Hy%uo$JrrKt3Sk1Ktkm-(Mfw z(}QSGSGQ^0aQV}xTyf1m$1KVNsOwD`DdAv$*Kv)c2pVs2dC)y1(+zt$==JF3j^u_m zOF%**eF!w@ha;t;gaj*_cQuBdAvUym1)cj}n97JP!S_4AG|KkJ?JB zt6eqgj*gK{?VBP_y>0vdN|?6wF7|!;gfbkCwE?3$Gb<}1atxu{%$yv^iAqD_K==SY zAnb_BkgdDiTnQ`;oxIkTmX7g7up5XPU&j}*J{J~Fmc4iZUr;Yo6Et&WWhH!v42b=; z>6)@l*H*mlu(+$Gv-9(QM~Dc4CMGO$S6>Hj*UWK0Gkp-(X+P!P-9fCkpfyM@d_2qI zzo2p90+rm;vNA7dyO5~T++dfqw$?zt9`G4uh9lmw0GJ9Lb_L{mMrsqG+YhOdqI`Ug zNNNwQ2&;l4%>#9}zk9d*J0qqc1R2HCu0L;;zdK1brm<~Js=Ys13bBQ%a9l!~0~TBQ zUqG~&>$?e*A+JpZzI^@qZ*>)VL+D3zQ)##v8_a`n{`PyB;bx0PBc5o;5qCUZIbON5 zzaNy)UBU>u#PV7+36L|6Llu{*8)OXInRTtj$` zA}J1MrWtS<IXRZiRZ~ z!n6cNCM+ttcY${sV8xptbr~4807@2Q=7eVGiF^rQ5KLj2Yk%!^biRVNG?Jsa`T^>EA0caXXzfty z06`*GcP?e?Jlgpl) z^|qx@P*9?U#l)p|H#L2Pme*qs(*@84ydN_I*ndn-KxM!RXxWCfeo3si4xF@pH-a|I z7T1j8iEKshB!D72I|Um6CoDZfzEPjr$B*Aw3X##5XaLyi_x)%t&b~z_>9R6Bv5)<`pZe-BZ7yG|uD&ndyNc zz^!l+N^02oJmgZ;A(ri-ARinlZpuwm%dA5C#ma;dFlnA_&=K!kFIwy%-4a!N4I~!(b40{ zS(Bct{Myb00;8X?-Yzuip;y5 z*;KoBTb(#JzU$pedUy8Ao2!4W&8W_Nte&{zB4vSGa6KW@v z7z8co_d)(dlLH11W_9=Q;5B%`#l`g-V*KBsAw~48lk;+fTM-eyP~edOqdRW1BWzW&fA?N)~8M8iJ#Z|y=t1TPwwS&)sTm$)3<bjmGbg6$lM-1AGO@^ za07|%)xW(?M?*a)ziD5-yqYbu-u%P)=jbT8Sd5JD>K7ws#0ETuECxgzC|i1!?l#DM zs;Q~@`u>BPAnG(Ag*d$`oFe0DF;32#W{eAG{RzJ}3ogL7t@fG6YdGVTfeh!C>NaZ% z3kz{r2>l~svH$>vU=X>+f9>jmI0|!b9{f&pBZaJ$A@%*L{^s7mxn@qpHlUu|tR45- zzxmw<(X=>ranA`oD2g2&8C~P^^YhS;QGj4Uq-$}*;PCyoF!t)zE6M5Vk{2)N*zO^h zX8L+-h2i1DhojB9(fG*d9vmrC6S|9Eb_e;>)Z+697H3tlzU2 zHv{sTLdOEiVl6_fEkIV_*1?Z}vXc@1fx(Ye5M~BQ`@#C8+`GZSLGz*ollX)60!&S?G%d`{ zjRV&g5%-UH9JYr!f^a>FV@1qgCsKf~h!-$05V8IjZKvy5RH zbf>I8FwWk{c=in7>rbobpgr`b!b0*oXcR)K0e7wp79aRdeooHpkP}L*C~x5;@qC9n z#5Z&zCnx?eGeF?;8AX_o0rSN;3hEIWJsftE;J6aF)(Z*)kAoP75fUbn+f`*pA|2h^wBx7Fs3&^3%Kzn8|@zWslzU#x~ z=Z^dkYn$}MecA}bhZd=ZJ>~*F!o}1t?{{QsT6M~RwsauuwSWqDJT1j*jLW&uhM!wY zFk@^VB(kNA+9cB-${_}uGUAQY^%Szs6^2B%ry%CiZ&J2=Z$eLi3`@3B;p8GM1p{?k z>QS_;hYJ_}tHe2$UFJ(Xt8jv>MFym^#n6U736vx^HQ62Q!(T)+WrREeg?J@c}NT+PPpFBJ_*8A0lGvM=I_!HOP|*PvY5iA!lP9*5$~F*35rAk#-hOKH1EzFH*HTBzI-R@;I6#p8ubuwX&RTF4wYcoUOBBu1_#OMA~eQp?WZvIVBumJG{2$nH?LC?T&?Irb+U zaRKU*9(#a!h{LHuR?5gLwOSwg_zV}pu=f>Z(4$AJ)b%eN`*SaHfgMXqNHml_st2&F zs@frJhePQSdAA$uQCsz*S4o?nP8R9i6Ct4r+1&k$P zdO`v{B$+L(U>dJVciVH$++jPr=de^as62eFsjYR_mK8jTo6+4-&O|k2Xdyd2H%?#2 zCFV3^{E9h9Gzuf`_&r}eO^IwgM~~K@*oiE0bo8DCtD0DxPv08>Y7D00XhZZ?kMg%| zyT~065q3a%H_r7;h}k3ZqGQF?`=67=|GRiZp(@3&&%kA+{ue-m9_m{NWz;w`>iVrA z!7doY4R!pK8RUJvtk>Q%Wj6%6?_a;)AYeu7WS8|ic&1Fgy;NmG!#?IDAjZ5$Z*mX8 z*=|OSaOeG#)BQ%v-+68SQGM5=-$|@@F?*gk1K3zNqsjR^h$I|^qb=MOwH5V?Wu#Q& zj0{Fl60A<&{v{TMPa8Y8$h6t)s2y#wb0{$KeG!lBhI8|F*>dhuJK-MqDgnKlvD4W& z$+9O~s4+LqrJZ}fTP)%+#TGM0SMk<4yi($W#2XB*tjAADkj@8{o*_F3hhu^0kF5 zOmZ6LyZz<+WymaL5E~pbH z0|E^48s(JONo1G(C4Q@;Xq=S2_XW3-D=7j=DhaX4o>LQLjA2cUoa`LOFla=bPSq%% z&&w+o<|3tVmrgcTsvY?+wsT7Cbn=Z2Z{rh<-jF!%Dj%b@G1r_MDZU`a2Z@Pv=iHH% z_5z7u0TP_ z*cR&4ZP(VqvY#9YWfXOrnmE8XyOU5}y4#fSUEDbHtCp^D!ijrBG&k#|-M%tKk0{b2 zNS?~fyy`i9@#z=kcp=`?ajZ%;b%B%df4(LEc|OCoGhB(OX+J}1Nw0&LtjdFXoVxEe z{pTo}W);s!wYON#xeRj-QMhdMVa|$M=j*+5Sei|Up(iL?@wTcmM6{_U3zZfYmi_dj zk=H;@*mi?ivaVY>R?FA(WlrAs%gtoGM`843UFe7W>O>ws4;_5bnqrG!kU!qY??uUcoyP9?;ch2IOXJBv#aXG7H>zQQUzS(91n+) z#AP4F5(xi&EhS=vtHlw#PQ_huRkQ>P)8c z4Ym)qMfZ%Wo&PLrb;+Eq0B_%>PnO3F( z2d_OE-Tsv8Wy|0FPQbIRxVAB&9O##?ow;TpBK066q6-Uz?`6E zV17etDVAzC$|(@?@Pb@7zbX0X_xpI|w2?j@Nhzy_(nBuJOygJWdh4by#2ct;AW)2h^Q0J|jJ7dq@4Xl-(a1rR$t8C?ene`2*`%5sMi(T-!7+kBtDkn zhqG9NT|9UE`3y7tmtFRVZs+#?@R1haD$j0esMo~fA1=Q+LrDm|!#cBBcC6nmnw6-l zO0jSAL|Z*=-FmwQ^}brWAsT)Lio^BJf_Ci0`^$f4jEXl`McXYl#Wy!U{GEF+zdjuN zDzNO&d}qD_d6K5={uamKw*qSll$SQTzx_)y{kVCVx~XW>tu65JyQQ;j+PeOmrkgQ? zGSOxqC$o#G^xw9l>v;L`w-vzox>GWEeozb^Ar6r`W`QHu?eMUb-}^ejTde z_%DtI|M}Lj0Vc{_i${?!iFhS&5kN;{fSQn|ab}1mnDy3brMDne=*3M6q>A?z^fb>` zUtvgoc%A&%h{lF~N3Ts`pR}bZ?sVf#jG26wKo$l?o}NAovILUN!B+agtjGnG6c_(< zqUsCWerqG}+FEznkOIbcQd1{$l3{azwHM^x6OZl~a|d?bXA!jAseNGG^cde^Xz>ud z2M1+%c~#RdT3TB}UP~LrtRG@Lx6fy&W$$yNJNlqyq>`KJhh*A4o8-R~Pc}>hspIg` z6<;SkBg=j{i%HoSuZ|-B_^{P(%c~#GD)$B0An_C|(!y zG`S452@F~AH@RS>dY;HL#fo^;X5cli!^{dE9J|)|v^zT^eKpGdHpcR{#PT-BIvj9f zENM`aW2BvUP95p9_rV7 zVD?CJf_=y{|B^2$m6!XCjCyOPW9+=>1gwjm?_6Jx7SHa?tu)e>=qvnFRW{98snt@f zrM>@kh})FAghOxJh$}`rX|)4KfBizXfk zn0;YpPjhp}v+ds9%Dj1QJEIG#$Bk-ZCs@F&B)w8wZHd&EJb8!)V(5dB8U~3`SE?GP z92ea#{|O70;Rlfxq;$Cl{A}l>c8*mBjAbTbkTP;KeNBli6qg7_AoHG^-5BVt$;hY| zZp9=^#>tqAL$u)+vUC5)t=C{e?KS1~6n&z$TuSBcaFDW|qz1N}HFZel2WFw z-Q=Z6obSXjhB-W|mr#mey|(tzySLg$!I^j8tj7ciu4by5%-?Q{hpT;~j26W_GAlph zacg)8ykjEC)4^uI3EF4df2eKcO#JGt@Uiu6&X&t&oszsX)?e0~Ly zjY~On7SAvU`@?x*X=yJtwS8Z?M(mSBlK>xA*H}%x5+cF5mVRRAnb;>|V`K1<3cGr{ zy2`G8I#SkqT39%g^sUTk5P3%AzM-HzP|LoQqjlvVSpR>C;fsK{pJvv=FQ{(bmq)wN+JZ1*ZkQw6Mr<=&dY3+6rpSs$VTa zD85pMF_<^&J>VPtVEzp2_eEc%cF8#_MBtzRksU>G*C!Ypx3~W=y=3Au5+6{v3Bm2~ z!Gqt*T`WKgiO3v)pnm4S zz~?S<31eyj2@6q7JL&3T{vUo#b8|_4B@~wFemTk@@EAM;q0I+Uw31S|LvN8@lptBj zH{??w;z=Qu1??X`AlUOz^I-V7;+|(V$q|pcUrx@ikmQoHYG7Js*>HdcAGzByLMPvY z;qo;mUj)`Hg^sud3+m9xcf3eTOPif_QMN%`izDvGgGj>;80Xr$Mo_S|b#yqCVy*OJ z+2H}hnmQJzB(L%I?OSLGbn@_M4XQjRzkK;pacMHlY;B04jz}2-@d4bzP3^e0_Nl}c zW{6+6MF-wlmmr6R1qjKFg;k|vVRikb!`{7nM_t8Zn(D<9*^kFHqx)-dXXfU5za!PR z;UwMCnk_LmFYp$(8w1hZ7(hp!y6uYJAp&8Jo`*n^3%hxfMy}bi7_*CA9!6cmv*qkc zp(N!To)#FjxED}Yp-wYe_)@Z+OBlhH-zSG$JfxU&qu!N!p0LAi2l~SEDO#gFx$ zD|YO!#1lc@6{`>ru&|gEnUlwU9D2!O&-#>?sKYmQ376~+AB-?#d;yBxCFKJaNT5{~ zh>D7Kb#@*IlReJN$asrjC zH|)`Vd75n2G&Sn_S66OLV)`7zKaJ)u9ah%^+Eyke>}_n0vsrq2>M&J^jjZ+Kp;K7R zUp;Ct>2O!^e%A3hnaAsE-QHYuP>zorF~*jI;svStv8s!eW)2;67Xp2Q93?@x@a@+% zhWQKr;rHIH#qtE|)L)?6x=;I6+dayb=^G^4)U2z9)%2?oyU)2wZPGY#ZxPwNGsj!K z_iyE<)YmuVNooftEzVnmOsxQJw@2yL^Q1MZk4!&u8U;U_2`T&{tVg*gPB0s^&cDK z|NIBMA6!4K(4P3+9$E8K^qsD1vs2*LuIXi(i+h02=y&BmdnVP+AvWsf=9Z*#9&_*= z#XUT1=ej&J<`dlTyrc11Z>WV_nYf*T^taDzYwvF?ArGK&jZXE*cNKC)Sm{r57~nX) z6{uz?K6Z62;n`RL2>B;x9gi?i{#6*Tn0M?#LLam-RD|TLb?kG!8sAbgMzYAiZLieF zZ{Oeo#tit)x4v{(T3A2|=QrX=Q^?k$)(bFFQ*6btMHMNs&`m6uu|269d2S0u!?YVhMwYSn^92r3bFsCa<)1V#-l86g`|4J}LBidVo!Ab;{ zcTtAKNX@;2-dYW5wQeP)P8`05s%XDEg5>09-rW1lAGp#2TYKXTL#+S|4HRzFKeUOB zg>0D`*!WiZnBE|#A<3fe!?mBBkldhVJzSr-!h)v+1gL&z`$YwNZGfD3A*a8d>*jBKv)08uja1mn)z=OP| z>ozyYBjEQw16IR=CjVw~Ake|#G#)fz#z1T)<+XNTwn6ne}!YMoNM_!7+wW6yb4AcnQz9d6s!yMZ zu^c?hjq81Px1NVb>EQGr?!0c@zfL@>D5|Lb$NjXlufmf!XcsOz@^i2(g)SuU$PyP9 z7CyALA~*>+02>o3V`9r9fCs)V|6i?L`8(8m*q+L%q0JVfgt29rH1?TnHQA%=8I^2V zLYA2d32Bm;$datdSfV4cL}WQxCYmvd4hhMUNkq0J%e>E=_b+&_>+OfGt})y9+voFn zp8J08`#h-zeWYxBC#IvTQmfB?XBln8Im}6ZfQozkkQA*XvR@FB0cN&RO(LWIwSf z$;c2hvIdcT)j%myBD3gTVxp}%#EV=cf`ak2i&bxRXD757;G*y#0TAm5-l>D%fbIWs4m%c0V)3$fsV1n{h~t_OQelw<-Xv^cx+&6~+HNQnUU3S9JNh4R z?Cc=cOaCBGk_U6xmA^<(URZ{w8;#7 zi{#r?-7PLu-Xg)4k0Z}#n{UiU`Z&P%F=7AVvAV> zWaA4(>qB2kKX=u?oBOzVT}k!VZ1+xt)jO5%8;gX#Z6SY)I)}Ul=!ing@*}~;q8JCs zUbp$dX$pN+g(Gu(9;_3rDKcv$h)iCB!-?i6OHdGrKZpxFMt+;U2-Yy@{2`d&gc$ongem6gHZ0A3ud@Q3*VfFun~&8|oe%=Y7G)wQ+pk|4$cEjbd60u?0$Gl2UU z9L{Y4FaU$ZAkV?8Cr-2i^7{N?lWXe$zzFKd`2?R#IPn;sRhMh8!`ZcybZ`qo(mry) zcS}w$OnH39*Vvd&Tz=dh{5<>~%2pcYWe0K-&nHycEAlam^jkV}?e zoF7o1V*n~0jEK zfHXB2jRQ)6bLZ)IIAzaL-a*}g3^TxPwSEKA-@_XZnsYRkAqAib+;mB%FNbGCbU~S| zO0j|f5sV0o#Lj}+AgfXv0I{F1@Ac^p#`?8|!Y+kE5TZeUpPrRvYkvjw*5Tpe=;~{8 z&h(FvcLTLyatDf-255|*077!59@v;n6{mqE7wk)@QE=hh)*Lks4Y`Fp2`&MgFj5r` zJ+C$iZQKm1Qb(>Q3Z4dHOql5TY3XQb$@l1c`Lj!ZG!Gx*s+gvi^}#v=O+E~jqz@V@ z?$h*Q9o2d_G7^A_iG`N#=O{UE+p$g7ezfqe?d6TXoLaFEQVM-Lpmv}m0P50KJ_*yo z=DgW=HUN~$FEGmdNDy^)m+Sx1XO5gnE`aH5*5!I12rz(?6S5;=DS~dg5);4svoM~U z)2FK&&Q(3kfsr6;=a*XtxAE_4?ErwV+}}H;frh-S^ZmT&0l&T}a$0JtE(8(*1@qP` zVscInOJA_Pp<$^5^0(GeXw$*X!N;=|%r*MCr;`idZmcgnY;FLZYLeM zl7f;FTnsn%24bStBbsC7VqCw~tNhw8CI%L5Im);CM~tuG`XlSVU~dQ;LCLA{2b997 z#IYq34?&hr6*2LR(5~%@g%Ez{RuLWs;Xd^A!5_e3RXCP{2Ka$_5KGJ*$UJkQZHUjO zR=j5yIn$AUS8a>Ydczd2I@~tWN?u&Nws{&Mj*dvkut1H68_ZsPWpv@lgclF*;;XgQ z>tDNal|To3lye5M060#`1*-;1aWsXvkep`8YmoJIXWa4!JMoUqQBE(o;Mcn#FCurS zTk-+OYGbCeimJi)p;L#eI^Ip%g~%seU&TbfN2~5DTsYGPn$B%dW zySh*4duQ0IMwr0^!2LVmOy%jWr^C-_wwd5;!cB2$^0QOyo|aQC6K^m z>8~#4=J`QtNe6rnDcpzL>nT}f=R+kc+4P^D1MSJPmnH3x@ik^@$)fc&|pp7 zMJo@TgM3x~o?=Wbd=;mXj%a&WiizQ8Q>_N_-=c)bf6!mX3Lr)4OKSqZO6QP#jZfg9 z8?#=a(ZDGR5hdWIbv#=&i#TE7st$J{V0?)p$r2lXa>&Lxd+_VxrZkEjJ4jWhbQf^u zP2^W)Hf84)&ix(?Sbg+~=(uz9JsW2U5ml{Xf*extywRt4$Wwj%A_`|R#PZJcA4CS3 z%T-uqVi-tRA6L%5LFw4H&*0II40?^fWiJxc z4_4;wPx~V?_b~8maUr)1`IcClxcApXwA3t9TrA`|^-rXtWGGTBF*XuymJF@jn=ha) zEDTfe8mMU%EU8#@DCa7ID-}4;dQrRw!RXpPJy_)Dq@QxO0;}hRK!p9rJvTT z|A;(QdWMB3nViZW3|ov~I!rTyt*&Od2xJrZ&1kRCl#ex*$O_C(cZ^xG!U3N_z}rPW zYIG4WyV%+;f-f-ko{=p7^vk(j6f_Gt=LLYwM0Hkj&Kz^>cZiv;=!fIlgEN_srwR2NMYYfP^;BXDZHNc^J z0o+w-KA&n1EAye-rpR>nio$#MKs3P>m;&fiEOgu8oe!cF+{D>c=)Q=}O!EP43IHgs zmJEb9pr!*sd~q?-9h25Alm(0#_)?&d0}%m(e=vT4stis!ApH)ERZiD$f&($)>eXLB zfZE#IhsSXVuGneCzUM;ymT6ys1;c7t*jfuy`Q4dENjdEa1AbTGfJy{q>blcWL{#&+ zYG?SfT28Cwn0DYp_ak;3T>yb5onD-g`HXS z48p8YyC6yvNUo5^&v1-G89b>{R{&P-{r3b3z)u0A?sh=ldUG zh|mVTfX)MM1$=2}0PO9#DlAjk1*Up;HGGfS+P!=B0IUVF5kya{P>jTdz7GHlK*w{f zecu^y8d;|n1r1a}cLYKSxVu~erQWraSOtF3To4_?*MSh*t}kC6V;K6m<%NYt_V(sJ z;3WhJKCsXwC1AdwrB0G>z+5D?2QsO^kn*9wzZt+uMDxfLSpvM%0Es}STJr;b3S269 zUI2L=K3fBpNU*5DgEr|kwO;o2Glo}fe+VLUv4l?a!%MZM&<1L5Ks*8P!l#}9$ptu&9i$_B8hK+^|NIIuM;^7F?l87i<( zOEX}$QtL*YgFseO zAsLbYVDbV14dk@)6>A_)FFxbqW88G>CD{^vS~ z7}r+jIEkF!dy|&otOSJ*qHN05JygLq=CEIrUeVHhyd z%{e6rS!kf(0|`B6;RwfV@G5L^S;0{7p$grlAQ3=9Ls!T>TR(n8(La6-cBKM+1vIO! z#OXpCSYjMakO1iGJ3~(iIgQ-p&;DiDgXE(d-JJFA%p!QZ8*76j35L?;4GV7}Qviz+ z#w$~-Abi+3pZ4iFhB4M+o}Aj;QHde3VE2NZH~0E%9WdSyU0z#X|A&4cK$y20ydLrG zwD%B4abqIM1UP*8Lx;GmNgys9lyBfN1C4zRASM`%Eti)10kIiJlT9&e#kNW9Aebf>z?sFJ9Kj56jMoL;!?}C~ z$dm^k&ll7o(Wy3&eRSy(klx^H9vaFno7U9S;GFwZOUjT1bc^)hqUm z=)5*OT3^N`{{PUmn^g7nFJ~6P;$_20qab|A$LHqg1%$r2h~KVb5Lr`+0i!?9)|+sY zK@2Zw<{-djSv_~vLM;R0!V-I@3R2_Tj=+AHo1JZ%sbrJ^Zh^VCg}izO6YOum(3e3y zfzk8p*8rWtPT2^D)_=cppbVA?-|g)?b|@<;f!9}KzY%g6sNKKMl$ zB9}Yo1L^ReKVeULSKpo33l3_4xJN)r4Q~e#F<=k{-8evU7^c9$LlT8DebNgLJ_K|N z;lCclvf^SOtMtQ`zQJUttp5AcGZ$`XitmXZR*d3eI5yxEhA0M@196$`A`}~W zn*daFRaF&jr-Y>B%Gw6C0=OpYc*kB1>mBz<5_@2v1Q*Jsd53}Kgiz(!3L)#yE|7>S z%(r_l)bCNKY`$f6lb|;TL%b6=@4kU@A4X^(5Qp0r(>e;3ov%kUm9>nkXs}U!UH{4D?FC*U*yZ(}<;D$w@Q_HuvqJUo*GpWev2#&=c z0)3O+8cd&QFUUu`P$Zl<^gRtVuBcUBr2#(&i@cDRdT z-^9+oS0kxRVDA>%L5MGvz+|5~18nCdq1T9FbxmmvwcQByXMoJDqez2OQtwn|jl9={D5*|ZD ziTsRrktD2smPGUTfO0fM=%vi||Kq6T@R$Dl-$qKl>jGPS{kI}i9^d9g41M@9AzVAD z5_Xr-48aqZZS0PVKmV{F@ntJ93h|HS@W1bx)@w|%o7_V9LL#yBKj)ru`VAg!j90ad zHhsLa4WWPpnt!Ivd$}**_eMk;b1~rAv7iZsg%9WEGrpzJ>R2?~j>Vi`B z;R(FSt}o)N2W?LN?5;_|8jHJ96pX1dbOA!FjE7p84W@C$ECn?lrIhn(?gcJjXK47I z@3w{7joqx7Sk+(6wmPegPVwir*e{eM7sq$vo(3x4i(u=tArknH2OqPElPh$z*(zA% z<%YPv_7CX6=05GPm%kk(Y*(l=_;)Yf_QBNVT|=)2oRt)_X2Wx-*tROIH^@2#W8_8u z%W6$(-#*!ihWN`D@|OyZT`|=@tX#5$C&dg)GH?fNr1LqK6lNd)4jB9!OQ3vtvYj?g z!si5KxWonZd7dJuX`Mip@TgNP;8N6HZyy)WJDONo(XzI9Grb*u!j#@&)|uUoC5WT7 z<#_V5yUL4|BSLX~{Nx{Ev2qp%fFG`Jc&q)W?+u$A7gTq078Ar_yHI5)0>Rb%J3 z5XLpTBApPJ5JcfO@xF0;E>QOTkF>qa0+Y!lD!f~eL#TM;d?{|DYE0zFtD!?BcI1V0 z7agzD2D!(CbX8IlK+Q_wSB<2r}J(D5|TG5q?Rw%%)-JN!Y=jjRVtHvh>1c?5rM?2PnCV!#`8a z=e@ER0_^K1V=-M0JlT@vd-Z~6?98>BgF?n4%Sy#hdvoyOoWUBtte}LDB+LWhl9fg+ zL2b-lxufH+oRq_gZ1sYE%pH9yffs12mSH%Bd%t z&wN{|Gfa{$`;`3dIwtF-9$k^;7M)~xKmO6F6&I>d%<@d<&oh1h4)-};!k)rPSbAF? z@6NoRg|2R53iUHj^p-HbNAEGm5jcH%bx(Ungidja=ThTsa&MLGsY~i=8q}+h{gS3Q zk1O!H<0f=>rk<}nRQ~WS0Y2P=dg(hOijmDLALi(u`C=PWH@{ganP7vhYzp3K?)yAd zJs&u?MD;Y|>1KX)V#IyAr9!p3rm<)`Qj$S!sw{{NYUAfCPB#3x&_l~z%E>gJ{HZfp zj;*wO^sPJHM>zs#DW2Ye3Zf{OCw_18d{|{ZDiSQra3sXKXcm|{KmA=eRQ-C_WQjdV zpx5G4f{mCERc@v0JN?$k|eN`yZq;|sXEXgR z&N{R>ob;%ReS5hDfBM(O2T>Ew1(#CfwKJYL%PGa&DIh*lfls4W3E zB`;??^VqH^gj4dNGMUzWM0vjW?fVc1TDprNulxl0Lmq{nsz8q)GH1ET%=@|jBi7H< zy!goNP8&`dB|z0VIaF@aL+ssCBG~fHuFv8?-`IWjFTrONypEUY4&q z&?BGt&sjSyU7me~H!)gfB`e=BT0WJ)e{|7)=L;JL-+gU(h+!Qf7QPh4^An7R(uP0$ z`&cTWm@ss2kIC)q_)MltU91o5Q)TX?w0zQi!DMQxzc14o^SWOfq2LId&Vp{1%hXg4 zBjDFQ(Z$f(ZsGCQsgJtE&`(;#B4zT7djFJO7K=I9$1F3|k`gFC5$CboI$9m?QcFmD zQ&~Z+Sh0J1&)Tlaf~9Co9DZbRAhTVgwS}sq(C43k-}^GPY-%FU+gLu`MYwCf%>0Z; zAIf4%&Heb3w5s4D zy%a5*qQe5&T^T|?GMRnjc;AW(mXoC;iHA&V>IClycM`=IHK;_dU0L%+`pe7SMF9>c zke#U9%-%ch10k$Tv+1v}_#fc~7_5S2TcS*w>ZyxeHyw+Za?Ju=4FcUo7Fo=bJg(HL z4CV**y|$dGX5>|=?^1TJnPWqfPHi2QV(BiOma=;_J^gQd(y*2-ZVWMl}k=OlL~1w;=S^gyLPs0wJQGk{a^O0pHZ5_ zjbohk8c(xr?g331)wo)G3(^dw-X=$FPejS21SQ<3sNxr$^sDZ5z9bj>f|zb*IA6b+W47ruo2{obaeDZ|=8KQUk5>K;KVqgDv4&5f5!d_D zM#50irc4fUiX1m}`fzr{4p++kapo2m-MQrq|IcJo9`ZNJPLB~%J$zquT_|5p5~2O`LE9Xw z9C=$LMwrvBJ=mZZ^StEZ^R4~-h`^heV~EF1-{-v~uIxBz7s;RY*Nt3kpKWJ_SML32 z#*trnAUJB@%G^o-n!CCvv2tRy*6!tV(awv?&uPvx+qNKt<8EjCMUf+xIp2FKS^yjf tLKL131NHwOwbF5JkN*GvRv$P!4ykHOo!Z+8vkU~n%;=P18Nns`e*kx)YQX>i literal 0 HcmV?d00001 From 83cb47f369e426ebd3341e6961f24f0109ef05fb Mon Sep 17 00:00:00 2001 From: lizayugabyte <77016159+lizayugabyte@users.noreply.github.com> Date: Fri, 19 Feb 2021 14:27:28 -0500 Subject: [PATCH 2/2] Deleted refs to TLS 1.3 --- .../install-software/kubernetes.md | 18 +++++++++--------- .../security/enable-encryption-in-transit.md | 6 +++--- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md index c511ce2c3073..26eb5e8228e0 100644 --- a/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md +++ b/docs/content/latest/yugabyte-platform/install-yugabyte-platform/install-software/kubernetes.md @@ -46,7 +46,7 @@ Before you install Yugabyte Platform on a Kubernetes cluster, perform the follow ### Create a yugabyte-helm service account -1. Run the following `kubectl` command to apply the YAML file: +Run the following `kubectl` command to apply the YAML file: ```sh kubectl apply -f https://raw.githubusercontent.com/YugaByte/charts/master/stable/yugabyte/yugabyte-rbac.yaml @@ -74,13 +74,13 @@ You can create a `kubeconfig` file for a yugabyte-helm service account as follow ```sh python generate_kubeconfig.py -s yugabyte-helm ``` - -The following output should appear: - -``` -Generated the kubeconfig file: /tmp/yugabyte-helm.conf -``` - + + The following output should appear: + + ``` + Generated the kubeconfig file: /tmp/yugabyte-helm.conf + ``` + 3. Upload the generated `kubeconfig` file as the `kubeconfig` in the Yugabyte Platform provider configuration. ## Install Yugabyte Platform on a Kubernetes Cluster @@ -139,7 +139,7 @@ You install Yugabyte Platform on a Kubernetes cluster as follows: 5. Optionally, set the TLS version for Nginx frontend by using `ssl_protocols` operational directive in the Helm installation, as follows: ```sh - helm install yw-test yugabytedb/yugaware --version 2.3.3 -n yb-platform --wait --set tls.sslProtocols="TLSv1.2 TLSv1.3" + helm install yw-test yugabytedb/yugaware --version 2.3.3 -n yb-platform --wait --set tls.sslProtocols="TLSv1.2" ``` A message output will notify you whether or not the deployment is successful. diff --git a/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md b/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md index db5d86a69179..871390e78d14 100644 --- a/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md +++ b/docs/content/latest/yugabyte-platform/security/enable-encryption-in-transit.md @@ -258,11 +258,11 @@ X509v3 Basic Constraints: ## Enforcing TLS Versions -As TLS 1.0 and 1.1 are no longer accepted by PCI compliance, and considering significant vulnerabilities around these versions of the protocol, it is recommended that you migrate to TLS 1.2 (default) or later. +As TLS 1.0 and 1.1 are no longer accepted by PCI compliance, and considering significant vulnerabilities around these versions of the protocol, it is recommended that you migrate to TLS 1.2 (default). -You can set the TLS version for node-to-node and client-node communication. To enforce minimum TLS versions of 1.2 and 1.3, add the following flag for T-Server: +You can set the TLS version for node-to-node and client-node communication. To enforce the minimum TLS version of 1.2, add the following flag for T-Server: ``` -ssl_protocols = tlsv12 tlsv13 +ssl_protocols = tlsv12 ```