Forbid privilege escalation for containers (#1201)

* Set allowPrivilegeEscalation to false in container's securityContext

* Make generate

charts/gardener-extension-admission-aws/charts/runtime/templates/deployment.yaml

@@ -59,6 +59,8 @@ spec:
         {{- end }}
         - --health-bind-address=:{{ .Values.healthPort }}
         - --leader-election-id={{ include "leaderelectionid" . }}
+        securityContext:
+          allowPrivilegeEscalation: false
         livenessProbe:
           httpGet:
             path: /healthz

charts/gardener-extension-provider-aws/templates/daemonset-custom-mtu.yaml

@@ -32,6 +32,7 @@ spec:
         command:
         - /mtu-customizer/mtu-customizer.sh
         securityContext:
+          allowPrivilegeEscalation: false
           capabilities:
             add: ["NET_ADMIN", "SYS_TIME"]
         volumeMounts:
@@ -40,6 +41,8 @@ spec:
       containers:
         - name: pause
           image: {{ include "images.pause" .  }}
+          securityContext:
+            allowPrivilegeEscalation: false
       terminationGracePeriodSeconds: 2
       volumes:
         - name: mtu-customizer

charts/gardener-extension-provider-aws/templates/deployment.yaml

@@ -93,6 +93,8 @@ spec:
         - name: IMAGEVECTOR_OVERWRITE
           value: /charts_overwrite/images_overwrite.yaml
         {{- end }}
+        securityContext:
+          allowPrivilegeEscalation: false
         livenessProbe:
           httpGet:
             path: /healthz

charts/internal/seed-controlplane/charts/aws-custom-route-controller/templates/deployment.yaml

@@ -54,6 +54,8 @@ spec:
         - --target-kubeconfig=/var/run/secrets/gardener.cloud/shoot/generic-kubeconfig/kubeconfig
         - --leader-election=true
         - --leader-election-namespace=kube-system
+        securityContext:
+          allowPrivilegeEscalation: false
         livenessProbe:
           failureThreshold: 3
           httpGet:

charts/internal/seed-controlplane/charts/aws-ipam-controller/templates/deployment.yaml

@@ -59,6 +59,8 @@ spec:
         - --node-cidr-mask-size-ipv4={{ .Values.nodeCIDRMaskSizeIPv4 }}
         - --node-cidr-mask-size-ipv6={{ .Values.nodeCIDRMaskSizeIPv6 }}
         - --log-level=info
+        securityContext:
+          allowPrivilegeEscalation: false
         livenessProbe:
           failureThreshold: 3
           httpGet:

charts/internal/seed-controlplane/charts/aws-load-balancer-controller/templates/deployment.yaml

@@ -184,6 +184,7 @@ spec:
         command:
         - /controller
         securityContext:
+          allowPrivilegeEscalation: false
           {{- toYaml .Values.securityContext | nindent 10 }}
         # start provider-aws-specific
         image: {{ index .Values.images "aws-load-balancer-controller" }}

charts/internal/seed-controlplane/charts/aws-load-balancer-controller/values.yaml

@@ -45,7 +45,6 @@ securityContext:
   #   - ALL
   readOnlyRootFilesystem: true
   runAsNonRoot: true
-  allowPrivilegeEscalation: false
 
 # Time period for the controller pod to do a graceful shutdown
 terminationGracePeriodSeconds: 10

charts/internal/seed-controlplane/charts/cloud-controller-manager/templates/deployment.yaml

@@ -60,6 +60,8 @@ spec:
         env:
         - name: AWS_SHARED_CREDENTIALS_FILE
           value: /srv/cloudprovider/credentialsFile
+        securityContext:
+          allowPrivilegeEscalation: false
         livenessProbe:
           httpGet:
             path: /healthz

charts/internal/seed-controlplane/charts/csi-driver-controller/templates/csi-snapshot-controller-deployment.yaml

@@ -38,6 +38,8 @@ spec:
         - --kubeconfig=/var/run/secrets/gardener.cloud/shoot/generic-kubeconfig/kubeconfig
         - --leader-election=true
         - --leader-election-namespace=kube-system
+        securityContext:
+          allowPrivilegeEscalation: false
 {{- if .Values.csiSnapshotController.resources }}
         resources:
 {{ toYaml .Values.csiSnapshotController.resources | indent 10 }}

charts/internal/seed-controlplane/charts/csi-driver-controller/templates/csi-snapshot-validation-webhook-deployment.yaml

@@ -32,6 +32,8 @@ spec:
           - --tls-cert-file=/etc/csi-snapshot-validation/tls.crt
           - --tls-private-key-file=etc/csi-snapshot-validation/tls.key
           - --kubeconfig=/var/run/secrets/gardener.cloud/shoot/generic-kubeconfig/kubeconfig
+        securityContext:
+          allowPrivilegeEscalation: false
         ports:
         - containerPort: 443
 {{- if .Values.csiSnapshotValidationWebhook.resources }}

example/controller-registration.yaml

@@ -4,7 +4,7 @@ kind: ControllerDeployment
 metadata:
   name: provider-aws
 helm:
-  rawChart: H4sIAAAAAAAAA+09a3PbtrL9rF+Bo6TTJBNSLz96NeM717Gd1NPG0bV90num0/FQJCSxpkiGIOWoaf773QVAEiApUXQcuTlHaCcWwd3F4rW7WCzAqRU51KeRQT/G1Gdu4BthFCxcB7KsO9b57gFSF9Lh/j7/C6n4l//uDfZ6/f3+wQHm9/YPD/e+I/sPUXhdSlhsRYR8FwVBvA6u7v03mqY1/X8ys6LYXFpz7/5lYAcf7O2t7P/+oNj/h4c96P/uw1VzdfoP738rdN/TCPt9SBa9lhWG2WO7Z3bbLYcyO3LDmGcdk5+oNyc2DgoyCSISzyh5I4cQOf71iozk4CHZeGr51pwOSc1Aay3SYrsmlNt67Hb5T0l1898JbHMafFkZNfO/1wXdUJj/3cPebv5vI3U65Gp0+n/Ga9ejJ0G4jNzpLL6GwTAk/W5/j1wdj8jVGYGpbvn8wZpMXM+1YkrsYB5a/hJeOLkMsAM/jtxxEgcRa3U6rZT+L64Nw4sa5wAWuxOXRiBNQsueUaMP0x3gpsFwiiSQNJsRwybtsQU/nr45vjw9uzi7vPnp+OTnm9Pzy04KZ/DSAs+DwRrRqctiyIUhbCK+EQaOwaidRG68NKgP4sqmR2HkLqCqU+oQdZwTkzx9ZlsxMc0O/P/+7PLq/N3Fc/lIP1rz0KOdVcWheiSvLPs2CV8l9i2Nh0hSZJwBylI+My5F8feJoDTyLJ/yjNOLq0tqB5GDT0YUJDHdH5BzfxIBVpTYcRIJwF+D6BYaD362sdXICEqxplTKZOpbY48yojVmEoaBlNcy0/WnXHRDgRG1Y5JXjGgVa4Uq9Z1Q/vdLdfI/pjDyYRR9yUqguf1/eHjY39n/20ib9//NjHohGGlmHDZcC9To/36p//uwItjZ/1tJnz4ZxKET16ekjYZ6mxifP7fqjHXEoqD2EbalkvCsMfWYCcsI85YuBTH+kIxp5FMYR6YbdLAgjcYKEgvLSyRHnz4R17e9xMn4NIlEXMNIGbfIIFIZkhUQsnxeUrkWrg9Dx7cpRzcvqUctRs0LYK6Ss4w1dw4aVXBGCL5xJ2RmsVEE7z+SNptZ/f2DIRT7HouHohDejK0pyTDAivHjCWl/z/7ne1aEjGgYMBcMsOU6ElBHWkVweG+CUFml3sUO4RjQrF4Ij2nts/prdFMoImEE1FoQvUYZ4bRPBbtp2SbR0DbiO7QSVss2B1rLtQaxEdOy4LU8l0a/Q0MvWM7B1JbL6mwmsg6s8hW8BvJfVqGx+K/1//QO94ryv9ffrf+2kkpDXZuh4vdwYPa75mClxNYGKr6Ua4ilefsjl5T8FVDpdTUaj133XWpi/4FUYjGNYPUP/zLDC6ZTWEZu4hqus/9g4hfm//5gf2f/bSWp/t8JaCo/HruxKX7h1F30QAaARdK6dX1nSE7EIHjNB0FrTmPLsWJrCIpJmE1DrqJyQunw6sTLEAylNqPUaa+AMW0vSJwipPAe81equ2du+SB0+Bg1Vr1ssZDayJEcs/gTTB0rYjQaSo0LRuAFLwHGs8ySAAStPQPaBx5AixoiW8JElOeeYuVJHCUU8udWbM8EmjQSX6zi7MU6tl+0DMNofSsdw1zDiVxsIKUmvHrM/Rt0QBV7LyR731xDM98K2SyI/17tm3KVN+tjC7Vd2jg10P+BP3Gncys0bJgBwdyYx8lmG8N1+z+9ftH+3zsc9Hf6fxupsP8rZRzv6rdWqMk3KYeyzjeyESFfstCq8obwbLF6TUVk2d+CK9y/IBO3h8geQqfF8pJ4oe6fICIZSKC/uJB68o/O2PU7bNYS4jSIAB8tVCjuJrTiGTySp89gjeKQDluiBWsx1gHJBVISZSzxiMEdH885ASeQso/kdI6ePhtDPbB25Oknnfzn560cYUI8RgyvDAS1mkY0JMYHsnCjOLG8DCmeUT97wETtWUDYrRuGuEEjwXNmhir1zxomKjfX51JapImbM8fJ2jPLR4Md25MEE+LDTN+0BDcknuvfEgZN59CFBsTp9fYOurINfboT/99Quo/85+v9BbXjIDICsBzuIjema1RBnf9n72BQkP+Hvf3BTv5vI1U5Mt/zrn2X9qzwfjdUE9X++uqh81XVh/Ba3ujjFFUIlrOu1jo5xev62F32oOke879xNGCt/6fs/z3o7+/m/zbSQ03s7diCopRsCqPFgUt4/KtWBAaumY5iMxvYzJToheW2XOD3OJmsAaSvQDRFIuJhWgVpKenZngucAqQPIgTA0p2aYn66JLdsm4aYD4zF12CIMt5QEf2QuBF1SLuGvlkmQFyW4bfr+KvCz7ag7Dy3IVcKZjN2VMSMjw9h01YBjGblIkJW3jiJWNywRI7TrEyBoisUbqPHtpOOD1jrRKCQhpn9zRcuF+n0KxSBmKZEMTPIvGKAbsGsc+NlPbYETPkrD3UOPuaBbQKIxMG/MPptDVw2lQ/+nRXpN5o21/+ORecgRGn80P6f/kG3uP+zd7iz/7eTUPtOeAjvM/ohm8WZhkQfdKZKSRujTp+TZ34Ql0GjxI/dOZX+cVNEojrPcaILpXrKB9AVjbXVRBqTULY0dMdPY7uCa/MfmQEFlGilfnMGJNDqF9Dcv/2Lgr6aACHpxJCoCvdcxfvQRtxmYIoYn1H7liXzSleqZlk9424p8tS8lqWYr6CmI/RptVc7YqFr0HASAURQTq4DPK1S66oFbSLbBhOwEWD49EmugDKBwZbQz3Pjv7pdCTwLWHxB47sgus22DLibK/BoVGwLUAKTCbT9kFwEV9AwTuLlzitCghBRoGPI2UeXxUzBu6WgyE6AK9e2vGPHAbLvfG+5GXJe6NlHaifxBmW6vstNJcv15RaLILVikEokXFHqxnIhAMrUNHQwn8McVJuno1PulNygGWwa487tuY/xUKkSKvSx60FbUabmwwB1YEb+1r44u745Pn17ftF+SdpX/7q6uT5/e9b+PQNdBF4yp28DmNsagZrqY5ojEg7ZYbEuiqWpN2pOl0eMKORWt2cpPgqnZjR3fT7i3kQgF0YUhrFzRaFAB4zKfkutW0XhKytlp+sivS3XOsbz5NCJlXjx28ABaAyIBlsILKHHNYQa6P8spqypA2C9/u/twX8F/T/oDg53+n8bqUoVS3Wd9ffGXoANdTSPhlWdjlM/iOglZUES2elatKRBo/R9cf0u0IekjTqnrS+smjgZsJCZO50Z1sJyPSE3l3IumytLF5v1Ygs9sysiunCxTX9ycWm1/MWdu6B09vmb0APFxbS1mMw8QYkpOFljmNRU5UASwCM8dLqUbRd4nutP/xk6mcWCVD/+05d19fSlpf4ql6yQf5VE0xIwzxRg97CLNvRBZ1K4bEZh5EGla/k+VtXq7Y3VBpYWlruG0bXes3swuxFb0sDP+ovGkWszaaFf2ZHFtxsVJNAAADSjSRatD7OrIsi9vQKDIc18RqZAT1IVSCQL2GBhgNV0feUMmiGXEiuo42E2yY9eoxGeclO5KvVJ0Q72hbmKcYzFaR2kXOQRMiAhPS+4o85m+A6M8WYYYTIGOWBImMbYkbvAQ5Eboa+WZ4EBaAabgb5jRiFEKLZDY29vkFOuEUY/pk2vLioK071mAZl3XsViRBkDq8iUsPRoez3+vtF6pzS6sJFcmx7bNgryi/WKkguIlcuKtWirzeEqsFHieaMAxpXu/5NB29nLuuVI3ZGgHNQwhONvzI/CGqAeUL7BGiWCIWFEaIbbrkfZke6NlJOfmSq2mWNeLX2bqVzmJVE8Y3vfgjhyfTn87O59ymCpj3sdfSHQjQmQOurQ2O5UDwAp+DvKPkiRDJYc4rHi5ryq2HUMg3CL+Hnl5sVkqJuXkY004U83PoQbUE+RTjjO/46uNqfPvfRNS3iVuvY3K+POcmMDJVWQNC7qV8C9FqjFAmfU8uIZNz2ad42CXNc5ABrFY2rFRmbyH62y+MkKTCBO7wweS7SwPDysjyv0NcwJPJPjnUs0ua4vFeNqZ+ebt4WOX9ccYhFiCB8SSorc0l1ZAEd5l2IcZwhF2nf8yH/zGgi8Os7v6Bh0/W0qgup7cx22VIEG2mgqWxJM7KaaEkraa3X0MDS5lhyNitTua2ZokhTb8UhVSC+zKalPc5chmZR9dtR+0dYAcq3Jt+iOBDu6paqZIjpdlR2lHeTrfLuage31B1jUpP2yvYpWxmOZ0K/y1QoqFWucQivrlrhWvHxljME2NCzHAQuUHQ1XWvHrCs3l3Gpq4n0VI5klI89GHlVZkfKdikv9RdlX+MvZ8enZ5c3ZL2cn1+fvLm4ujt+eXY2OT84U1x8/Rvwa1jC623DiUs+5pBM9V+YLx2m6fDazWXnfRXPK7/nb4zdn74HZd5c3796fXf56eX5d4nVIOvzCDyVsqlMZR7Wukzx3AS3J2CgKxlSt4yyOwzc01qsdCkex6LU/9Vd8vVfbtZgYqC6s5U/X1yPVe+y7sWt5p9SzlpkbuNfNICJqOW5jXhFruRVW91tqARUe61RqSjdUTi5bYYyKnG0iQvnKOw7swBuS65NRMSYg0j12aVvKzGFFdECO8Rfx5Rqx160Ih8BUvfeQVlkoCIVVdb+h1oL+0mm0Ko6xipnSVFLgcAzh7pW2YVYxnfDWJR9DOJSR4ByDIjsuvSBZNMppEsFSX+6uwa9zbnDIbLH/pUQlierxRfyV5n1UaoV+yLOPIQpb3YWXovPNubr7FgpY6s7buV96ySVSqSgsbINbG1SEOAgDL5guf0Ye2/pdDrh3yQdJ9d7QikFXuR+0cZhcmrR9ob2+6l7YeGRuNi6b81s3ztfwvgvy+RbS5vt/IHDASowSfhXkOHGmdNONwLr4/4NuMf5/F/+zraTu/4XcEZjvAI4C5zTr8Ve8xx96K7DZDl3qRS7uXPW+fMdMSltG5wsM+p2HVgTQ/31Eemb/wOgCwokSS2H+DNpDtpv5Xl0qJL4w+ZbQeGewyMWmS72vx96dtWTH6Dr/24RBbj7/I1gGp3sizSIA6uL/9nv94v5/f+9gN/+3kUT8XwMnSfHIPA4L00riWRC5f4pbI+WtL/lxAkHlMvDo5gcK8j3AJhIiSjy02gw8DvAmCpJQnolXDgHo+10tbcWCoKq3h5VzOjBe4kS8yHxBxcccCKTJWBJG8clNbJeJH3copFriyH76K+Fb9OUKrNqvK/MvbpFwslydCRtWHNyCa8YPrx5I2CrW7ACqLOOtZN+XueKyfzUvyAPJmSBfWkqaz5WNvBZBEWsGAOJPrjPwYAdvj7IozFzO1T25qrPa7TJrjEJ15YACi9qPH75jvmhmvoIMWBZ+9QkKRUmfV9poazhtZQdyFBGyIV8sGf8BvculgSBype3PPowBI/X4Y6vxe6dm+v9+HwKo0f/7vZL+7+0f7O5/2koS+r9BQP8WbYC/te7PgwdcWpGjg/IYAP1BBZBXq8kHZRe+Iqeh/YH3Sar7mJV5KrjYNNR+76yZnTVj8OhgOYLT5lyntwHBmbvcT6xdKa8ChK4yN5UXSpyakjsPfLyEFnNhkNMAN7vn5VbLtDYrPHYm0OAehvQXrDDdOMtctBJKhijKKZYFRZeeO8y2PCrJcUODqQ+WsDq0CY/GUCljLAwxkZ9DlF79EYzFjzBw8h8dcc0XtFYS83v+5T6PrZ5jlmXyAwtp6/HLPN38rewD7hNy9arIjmDpQJSxmVz+Cjgomk4Sj0Gbkifk+t3pu2cRSBz/z1v6fEgugcKCknjmMmJNYvxyTDIFZvgXJ8yvPsPnlj1zfWoyK+RCp3LutSUU362nrK1lKr2uvyg+UgHwdesDEzDAsadNl0J1gAN+XgqGSAoupsHXZU14FMvsVPiSv/HlUFNb5Wsvg7a7/Hl0N+Yu3TNtvv6Twv8eS8Ca9d+g1yue/+oPerv7/7aSKu9/kZLi4Td7Ssd/NjmRMAELA2MgPcfAUw48Aob88Nundhqc0h62r09G7ZdtfNcebhbk8vn3H5pxwE9FUOoY4nSLAcMG1ZYhj0JojBX50EPbXhY5vxcvaczPOj621UBZ7xvpNpzkQNmHg3ILQRdadBvwKIi2oYFKiIXyUH0CAj+k0m7EKX4UjCvljNM84hWa0MWTefmipFUViFF1WnHz44mF8IiKAvTLF3DPE37FaMszM41hOb6zgIcgwdxiCOu6rczDBluZ2YGWwndPUh6MOY/6aKNBqdRLiWKtwbewEsYMF1dlMnrz3PtA5wO3bboaNJiHYc6c99WDDRZdDDXpqs5P97PFGVJp3J1jOGC+m73Zcc8sLtAoxyDWxl7rQX48VIrLlEYxg4+tyHbpXqmx/Sf9GE3MwLr4n0Hp/p/Bwe77n9tJ6+y/dKX4qDE/qBZ4NK3O1HVwS/HCfgvUzU723D81mP/ikjjuEHvQ+J9ed/+wOP8Hu/i/7SRpH2149xcpXAWcXhxYdKRdiXx+jLpafDS4xLCZybf5vSHCT2jAiHf9BZj+jiGciJm1xldU73kk+NnH0PJFnXmgPm8WfEbjrqY6CiyyKELLpX9RBE7XEChhIBmw6qGF0q9+CAtyGg5aJZO3iiL17WgZxqldmz0qhmr1p/Eee7ju0gOnzeX/IrTuF/5Ra/8d9or3P/f2dvGf20kFYYGdrCx5tduhSttMubx/L7eXRoFznG0vbR5KBqVuaDvmFywJoS5Dq1vydEt61k3sWYpsI38hruT44YVwF5H8yhlHVB+3Jj/A3zi9UVCsg7MzmlWXZWF+6cKsunM1ACB0jcq/yClpBOwSFdjM4R5AONfNf3H66p4TX6aa+b/X6x4U5n+3d9Ddzf9tJHGTDJ9R6Ud+h4QmURBSwwlsvD8gvJ2aDl3kN8DAAMGtxY64rijL7+R+007hapjYmg4JVyM4N0LlRprzyUUQj/BrYzBtWuKQMQz/z60nMN3E10cxAOUJEVdC8oeWel8anv4onwfJLyrb736PCOn2M5KGGTXkVg+Xc9nRy/Uzsn3M/ZMtxZU/JD92f+y28jO+PKPXaimn9ZGQGkOWiSr1SgZxwle5jmYtFMtPbVZCqOFia8CyaLE1MISULlERp22KL16J29OrcJS7Soakj6NBjz5bU7yIP1sDoNxXsh5KxD0NiVwRlK8PGZJBF9+uvJQj9TW0yncuDMlvv7cKNyjwvMJWQUbiCak6zYlfNIBxLr9YMuS/tftQjUyR8XeECLqXysyduvEsGWNgVCd3uqs/x14w7swtdDR3xonrOeLjvJ1TPtfx/iFJW5UHUztCdT8NgqlHb/JbqwSuYc2dgz2Jxmd6e2B22zJjkSrMntnrmR+/7Vr1SrUS+yq9vnhhmmarpXnJxS3Tmct9SPb2BjIrPZTf6/b3uzAonpB0K4J/y0wKmpeEmlOTsPSavvGS8F3IPO4KMFOphKUBHSHZslv2Ulz+MhN86cV/Uv617Izf6u9WVH21AowgFMQI1PmDBX5mh2VfkKiE4N926MmL1OSHF3oDfMw/g1D4CIJdvpFNLOONicXiFCj70EF//40rM7Wlur4ThbGTdJzeXVaxMEfZ9TqIXrvAItScwfv0dgVlzSzaL2Vr2FKHBy6lxRsvFf4TkEQg996gOuT6iPAeHWqyk3/ERDSEcnVeOkDy89tVm1bq6e5MyQnRAzNAi+oetiqBnqy9CU/8SC/E60M/PrYVs0u7tEu7tEu7tEu7tEu7tEu7tEt16f8BovfInACgAAA=
+  rawChart: H4sIAAAAAAAAA+09/XPbtpL9WX8FnpJOk0xIfVi2e5rxzTm2knraODrbL703nY6HIiGJNUUyBGlHTfO/3y4AkgBJiaLjyM17wmRiEdxdLL52F4sFOLMih/o0MujHmPrMDXwjjIJb14Es6451vnuA1IV0uL/P/0Iq/uW/e3uDXn+/f3CA+b39w8PBd2T/IQqvSwmLrYiQ76IgiNfB1b3/RtOspv9P5lYUm0tr4d2/DOzgg8FgZf/394r9f3jYg/7vPlw1V6f/8P63Qvc9jbDfh+S217LCMHts98xuu+VQZkduGPOsY/IT9RbExkFBpkFE4jklb+QQIse/XpKxHDwkG08t31rQIakZaK3btNiuCeW2Hrtd/lNS3fx3AtucBV9WRs3873VBNxTmf/ewt5v/20idDrkcn/6f8dr16EkQLiN3No+vYDAMSb/bH5DL4zG5HBGY6pbPH6zp1PVcK6bEDhah5S/hhZPLADvw48idJHEQsVan00rp/+LaMLyocQZgsTt1aQTSJLTsOTX6MN0BbhYMZ0gCSbM5MWzSnljw4+mb44vT0fno4vqn45Ofr0/PLjopnMFLCzwPBmtEZy6LIReGsIn4Rhg4BqN2Ernx0qA+iCubHoWRewtVnVGHqOOcmOTpM9uKiWl24N/70cXl2bvz5/KRfrQWoUc7q4pD9UheWfZNEr5K7BsaD5GkyBgBylI+My5F8feJoDT2LJ/yjNPzywtqB5GDT0YUJDHd3yNn/jQCrCix4yQSgL8G0Q00HvxsY6uRMZRizaiUydS3Jh5lRGvMJAwDKa9lpuvPuOiGAiNqxySvGNEq1gpV6juh/O+X6uR/TGHkwyj6kpVAc/v/8PCwv7P/t5E27//rOfVCMNLMOGy4FqjR//1S//dhRbCz/7eSPn0yiEOnrk9JGw31NjE+f27VGeuIRUHtI2xLJeFZE+oxE5YR5g1dCmL8IZnQyKcwjkw36GBBGo0VJG4tL5EcffpEXN/2Eifj0yQScQ0jZdwig0hlSFZAyPJ5SeVauD4MHd+mHN28oB61GDXPgblKzjLW3AVoVMEZIfjGnZK5xcYRvP9I2mxu9fcPhlDseyweikJ4M7ZmJMMAK8aPp6T9Pfuf71kRMqJhwFwwwJbrSEAdaRXB4b0JQmWVehc7hGNAs3ohPKa1z+qv0U2hiIQRUGtB9BplhNM+FeymZZtEQ9uI79BKWC3bHGgt1xrERkzLgtfyXBr9Dg29YLkAU1suq7OZyDqwylfwGsh/WYXG4r/W/9M7HBTlf6+/W/9tJZWGujZDxe/hntnvmnsrJbY2UPGlXEMszZsfuaTkr4BKr6vReOy671IT+w+kEotpBKt/+J8ZXjCbwTJyE9dwnf0HE78w//f39nf231aS6v+dgqby44kbm+IXTt3bHsgAsEhaN67vDMmJGASv+SBoLWhsOVZsDUExCbNpyFVUTigdXp14GYKh1GaUOu0VMKbtBYlThBTeY/5KdfcsLB+EDh+jxqqXLRZSGzmSYxZ/gqljRYxGQ6lxwQg85yXAeJZZEoCgtWdA+8ADaFFDZEuYiPLcU6w8iaOEQv7Ciu25QJNG4otVnL1Yx/aLlmEYrW+lY5hrOJGLDaTUhFePuX+DDqhi74Vk75traOZbIZsH8d+rfVOu8mZ9bKG2SxunBvo/8KfubGGFhg0zIFgYizjZbGO4bv+n1y/a/4PDvf5O/28jFfZ/pYzjXf3WCjX5JuVQ1vlGNiLkSxZaVd4Qni1Wr6mILPtbcIX7F2Ti9hAZIHRaLC+JF+r+CSKSgQT6iwupJ//oTFy/w+YtIU6DCPDRQoXirkMrnsMjefoM1igO6bAlWrAWYx2QXCAlUcYSjxjc8fGcE3ACKftITufo6bMJ1ANrR55+0sl/ft7KEabEY8TwykBQq1lEQ2J8ILduFCeWlyHFc+pnD5ioPQ8Iu3HDEDdoJHjOzFCl/lnDROXm+lxKizR1c+Y4WXtu+WiwY3uSYEp8mOmbluCGxHP9G8Kg6Rx6qwFxer3BQVe2oU934v8bSveR/3y9f0vtOIiMACyHu8iN6RpVUOf/GRzsFeT/YW9/byf/t5GqHJnvede+S3tWeL8bqolqf3310Pmq6kN4La/1cYoqBMtZV2udnOJ1fewue9B0j/nfOBqw1v9T9v8e9Pd3838b6aEm9nZsQVFKNoXR4sAlPP5VKwID10xHsZkNbGZK9MJyWy7we5xM1gDSVyCaIhHxMK2CtJT0bM8FTgHSBxECYOlOTTE/XZJbtk1DzAfG4iswRBlvqIh+SNyIOqRdQ98sEyAuy/DbdfxV4WdbUHae25ArBbMZOypixseHsGmrAEazchEhK2+SRCxuWCLHaVamQNEVCrfRY9tJxwesdSJQSMPM/uYLl/N0+hWKQExTopgZZF4xQLdg1rnxsh5bAqb8lYc6B5/wwDYBROLgXxj9tgYum8oH/86K9BtNm+t/x6ILEKI0fmj/T//w4KDk/znY2f9bSah9pzyE9xn9kM3iTEOiDzpTpaSNUafPyTM/iMugUeLH7oJK/7gpIlGd5zjRhVI95QPoksbaaiKNSShbGrrjp7FdwbX5j8yAAkq0Ur85AxJo9Qto7t/+RUFfTYCQdGJIVIV7ruJ9aCNuMzBFjM+pfcOSRaUrVbOsnnG3FHlqXslSzFdQ0zH6tNqrHbHQNWg4iQAiKCfXAZ5WqXXVgjaRbYMJ2AgwfPokV0CZwGBL6OeF8V/drgSeByw+p/FdEN1kWwbczRV4NCq2BSiB6RTafkjOg0toGCfxcucVIUGIKNAxZPTRZTFT8G4oKLIT4Mq1Le/YcYDsO99bboacFzr6SO0k3qBM13e5qWS5vtxiEaRWDFKJhCtK3VguBECZmoYOFguYg2rzdHTKnZIbNINNY9y5PfcxHipVsjwvuBunIe8jBi1miZM8U8tjauVR9U9cD1qVMpUC0HBg7v7WPh9dXR+fvj07b78k7ct/XV5fnb0dtX/PQG8DL1nQtwFIAY1ATUNhWiASDu5hsdaKTao3f06Xx5Yo5Fa3fCmSqrb5Nm1AkHcL1+cv3kQgiMYU5o1zSYFvB6zYfkttooo6rGwbO12I6Vyt9cTnyaFTK/Hit4ED0BiBDcYXmF6a5dVA/2cxZU0dAOv1f2/QHxTX/3vdwU7/byVVqWKprrP+3tgLsKGO5tGwqtNx5gcRvaAsSCI7XYuWNGiUvi+u3wX6kLRR57T1hVUTJwMWMndnc8O6tVxPSMOlnFrmytLFZr3YQs/siojeutimP7m4tFr+4i5cUDr7/E3ogeJi2lpMZp6gHBScrDFMaqpyIAngER46W8q2CzzP9Wf/DJ3MYkGqH//py7p6+tJSf5XLS8i/TKJZCZhnCrB72EUb+qAzoVg2ozDyoNK1fB+ravX2xmoDSwvLXcPoWu/ZPZjdiC1p4Gf9RePItZm00C/tyOLbjQoSaAAAmtMki9aH2VUR5N5egcGQZj4jU6AnqUYikgVssDDAarq+cgbNkEuJFdTxMJvkR6/RGE+5qVyV+qRoB/vCXMU4xuK0DlIu8giZoTAHqLMZvgNjvBlGmExADhgSpjE2mCl4KHIj9NXyLDAAzWBz0HfMKIQIxXZoDAZ7OeUaYfRj2vTqoqIw3WsWkHnnVSxGlDGwikwJS4+21+PvG613SqMLG8m16bFtoyA/X68ouYBYuaxYi7bayK0CGyeeNw5gXOn+Pxm0nb2sW47UHQnKQQ1DOP4m/CisAeoB5RsY2REMCSNCq9gGc5od6d5IOfmZqWKbOebl0reZymVeEsUztvctiCPXl8PP7t6nDJb6uNfRFwLdmAKpow6N7U71AJCCv6PsgxTJYMkhHituzquKXccwCLeIn1duXkyGunkZ2UgT/nTjQ7gB9RTphOP87/hyc/rcS9+0hFepa3+zMu4sNzZQUgVJ46J+BdwrgVoscE4tL55z06N51yjIdZ0DoFE8oVZsZCb/0SqLn6zABOL0zuCxRLeWh4f1ccG8hjmBZ3K8M4kml9mlYlzt7HzzttDx65pDLEIM4UNCSZFbuisL4CjvUozjDKFI+44f+W9eA4FXx/kdnYCuv0lFUH1vrsOWKtBAG01lS4KJ3VRTQkl7rY4ehibXkqNRkdp9zQxNkmI7HqkK6WU2JfVp7jIkk7LPjtov2hpArjX5Ft2RYEe3VDVTRKersqO0g3ydb1czsL3+AIuatF+2V9HKeCwT+lW+WkGlYo1TaGXdEteKl6+MCdiGhuU4YIGyo+FKK35dobmcW01NvK9iJLNk5NnIoyorUr5Tcal/W3bd/TI6Ph1dXI9+GZ1cnb07vz4/fju6HB+fjBRPHD9G/BrWMLoXb+pSz7mgUz1X5gt3aLp8NrNZed9Fc8rv2dvjN6P3wOy7i+t370cXv16cXZV4HZIOv/BDCZvqVMZRreukB3BLe+4tdAZj4yiYUJXAPI7DN7Tgqw2FB1l0/J/6K75krB0dnG3QfthQP11djVW3su/GruWdUs9aZo7dXjeDiKjluI15RazlVljdb6kFVPigU8ErPVk5uWyRMi5ytokU5ov3OLADb0iuTsbFsIJId/qlbSkzhxUBBjnGX8SXy8xetyKiAlP1pkRaZaFjFFbVjYhaI/xLZ+KqUMgqZkqzUYHDMYQbYNqeW8WMxIubfIwCUUaCcwy68Lj0gmQBLacwhf2Z3KCDX2fcZpHZYgtNCWwS1eN+gEvNganUCl2Zo48hymvdC5ii8/29uisbCljq5t2ZX3rJhVqpKCxsg4sfVIQ4CAMvmC1/Rh7b+nUQuP3JB0n1bs+KQVe5w7NxpF2atJ2eQV/1UGw8Mjcbl835rRvna3jfxQl99bT5/h9IC7ASo4RfBTlJnBnddCOwLv7/oFuM/x8c7uL/t5PU/b+QOwLzHcBx4JxmPf6K9/hDbwU226FLvcjFnSsM3f3CHTMpKhld3GLQ7yK0IoD+7yPSM/sHRhcQTpQICfNnEP2y3cz36lIh8YW9toTGG8EiF5su9b4ee3fWkh2j8fu3CYPcfP5HsAxO90SaRQDUxf/t9/rF/f/+4GA3/7eRRPxfAydJ8cg8DgvTSuJ5ELl/ilsj5a0v+XECQeUi8OjmBwryPcAmEiJKPDS5DDwO8CYKklCeiVcOAej7XS1tuYGgqreHlXM6MF7iRLzIfEHFxxwIpMlEEkbxye1jl4kfdyikWuLIfvor4Vv05Qqs2q8r8y9ukXCyXJ0JG5YL3Pxqxg+vHkjYKtbsAKosw59k35e54rJ/NS/IA8mZIF9aSprPlY28FkERawYA4k+uM/BgB2+PsijMXM7VPbmqs9rtMmuMQnXlgAJz2I8fvmO+aGa+ggxY0331CQpFSZ9X2mhrOG1lB3IUEbIhXyyZ/AG9y6WBIHKp7c8+jAEj9fhjq/F7p2b6/34fAqjR//u9kv7v7R/s7n/aShL6v0FA/xZtgL+17s+DB1xakaOD8hgA/UEFkFeryQdlF74ip6H9gfdJqvuYlXkquNg01H7vrJmdNWPw6GA5gtPmXKe3AcFZuNzJq10prwKErjI3lRdKnJqSuwh8vIQWc2GQ0wA3uxflVsu0Nis8dqbQ4B5G2BesMN04y/yrEkqGKMoplgVFl547uI1FJTluaDD1wRJWhzbh0RgqZUyEISbyc4jSqz+CifgRBk7+oyOu+YLWSmJ+z7/cpLHVc8yyTH5+IG09fpmnm7+VfcB9Qq5eFdkRLB2IMjaTy18BB0XTaeIxaFPyhFy9O333LAKJ4/95Q58PyQVQuKUknruMWNMYvxyTzIAZ/sUJ86vP8IVlz12fmswKudCpnHttCcV36ylra5lKr+svio9UAHzd+sAEDHDsadOlUB3ggJ+XgiGSgotp8HVZEx7FMjsVvuRvfDnU1Fb52sug7S5/Ht2NuUv3TJuv/6Twv8cSsGb9t9fr9Urff+jt7v/bSqq8/0VKioff7Ckd/9nkRMIULAyMgfQcA0858PAV8sNvn9ppZEl72L46GbdftvFde7hZhMrn339oxgE/FUGpY4jTLQYMG1RbhjwKoTFW5EMPbXtZ5PxevKQBO+v42FYDZb1vpNtwkgNlHw7KLURMaNFtwKMg2oYGKiEWykP1CQj8kEq7Eaf4UTCulDNO84hXaEIXT+bli5JWVRRF1WnFzY8nFmIbKgrQL1/APU/4FaMtz8w0AOX4zgIeggRziyGs67YyDxtsZWYHWgrfPUl5MBY8ZKONBqVSLyWKtQbfwkoYc1xclcnozXPvA50P3LbpatBgHoY5c95XDzZYdDHUpKs6P93PFmdIpXF3hrF8+W72Zsc9s6A+oxxAWBt7rUfo8TgnLlMaBfw9tiLbpXulxvaf9GM0MQPr4n/2usXvP+wd7L7/uZ20zv5LV4qPGvODaoGHwupMXQU3NIsXf+xG/IZTg/kvLonjDrEHjf/pdfcPi/N/bxf/t50k7aMN7/4ihauA04sDi460S5HPj1FXi48Glxg2M/k2vzdE+AkNGPGufwumv2MIJ2JmrfEV1Xsexj36GFq+qDOPsufNgs9o3NVUR4FFFkVcuPQviqjnGgIlDCQDVj20UPrVD2FBzsK9VsnkraJIfTtahnFq12aPiqFa/Wm8xx6uu/TAaXP5fxta9wv/qLX/DnvF+596g13853ZSQVhgJytLXu12qNI2Uy7v38vtpXHgHGfbS5uHkkGpG9qO+QVLQqjL0OqWPJqSHlQTe5Yi28hfiCs5fngh3EUkv3LGEdXHrckP8DdObxQU6+DsjGbVZVmYX7owq+5QDAAIXaPyL3JKGgG7RAU2c7gHEM51818cnbrnxJepZv4Pet3i/a/d3kF3N/+3kcRNMnxGpR/5HRKaREFIDSew8f6A8GZmOvQ2vwEGBghuLXbEdUVZfif3m3YKV8PE1mxIuBrBuREqN9KcTc+DeIxfG4Np0xKHjGH4f249wWPC/OujGIDyhIiLHvlDS70vDU9/lM+D5BeV7Xe/R4R0+xlJw4wacquHy7ns3OT6Gdk+5v7JluLKH5Ifuz92W/kBXZ7Ra7WU0/pISI0hy0SVeiWDOJ6rXEezForlRy4rIdRwsTVgWbTYGhhCSpeoiNM2xRevxO3pVTjKXSVD0sfRoEefrSlexJ+tAVDuK1kPJeKehkSuCMrXhwzJXhffrryUI/U1tMp3LgzJb7+3Cjco8LzCVkFG4gmpOoqJXzSAcS6/WDLkv7VbTo1MkfF3hAi6F8rMnbnxPJlgYFQnd7qrPydeMOksLHQ0dyaJ6zni47ydUz7X8f4hSVuVBzM7QnU/C4KZR6/zW6sErmEtnIOBROMzvb1ndtsy4zZVmD2z1zM/ftu16pVqJfZVen3xwjTNVkvzkotbpjOX+5AMBnsyKz1R3+v297swKJ6QdCuCf8tMCpqXhJozk7D0mr7JkvBdyDzuCjBTqYSlAR0h2bJb9lJc/jITfOnFf1L+teyM3+rvVlR9tQKMIBTECNT5gwV+ZodlX5CohODfdujJi9Tkhxd6e/iYfwah8BEEu3wjm1jGG1OLxSlQ9qGD/v4bV2ZqS3V9JwpjJ+kkvbusYmGOsut1EL12gUWoOYP36dUIyppZtF/K1rClDg9cSos3Xir8pyCJQO69QXXI9RHhPTrUZCf/iIloCOXqvHSA5Ievqzat1KPZmZJLb9bQo7qHrUqgJ2tvwhM/0gvx+tCPj23F7NIu7dIu7dIu7dIu7dIu7dIu7VJd+n/Y1UIzAKAAAA==
   values:
     image:
       tag: v1.61.0-dev