From bf013cb6fed46d1788633c6102a302022f48f2d1 Mon Sep 17 00:00:00 2001
From: Glen Messenger <gmessenger@google.com>
Date: Tue, 29 Sep 2026 16:54:45 -0700
Subject: [PATCH 1/2] feat(helm): optional runtime AI inventory via k8s-aibom
 (default off)

Adds k8s-aibom as an optional, condition-gated OCI dependency of
litellm-helm, following the chart's existing postgresql/redis pattern.
Default off; when enabled, an unprivileged controller generates a
CycloneDX 1.6 ML-BOM for AI workloads in opted-in namespaces,
including the LiteLLM proxy this chart deploys. Chart.lock and the
bundled archive updated via helm dependency update.

Signed-off-by: Glen Messenger <gmessenger@google.com>
---
 helm/litellm-helm/Chart.lock                 |   7 +++++--
 helm/litellm-helm/Chart.yaml                 |   4 ++++
 helm/litellm-helm/README.md                  |   2 ++
 helm/litellm-helm/charts/k8s-aibom-1.5.1.tgz | Bin 0 -> 17019 bytes
 helm/litellm-helm/values.yaml                |   9 +++++++++
 5 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 helm/litellm-helm/charts/k8s-aibom-1.5.1.tgz

diff --git a/helm/litellm-helm/Chart.lock b/helm/litellm-helm/Chart.lock
index d626fbb472b..89cf3d2a7cc 100644
--- a/helm/litellm-helm/Chart.lock
+++ b/helm/litellm-helm/Chart.lock
@@ -5,5 +5,8 @@ dependencies:
 - name: redis
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 18.19.1
-digest: sha256:38962e231f6596b93f82a8412bbe4cf5de696caecf5775dfbbd163383eb1c009
-generated: "2026-07-28T10:21:22.511401-07:00"
+- name: k8s-aibom
+  repository: oci://ghcr.io/googlecloudplatform/charts
+  version: 1.5.1
+digest: sha256:d4621c5d49e4bb7a107e67a5272056fbd4037c262495d8c31abc150de5198cb4
+generated: "2026-09-29T16:54:10.796253-07:00"
diff --git a/helm/litellm-helm/Chart.yaml b/helm/litellm-helm/Chart.yaml
index a3cb388ffc6..3421e8f619a 100644
--- a/helm/litellm-helm/Chart.yaml
+++ b/helm/litellm-helm/Chart.yaml
@@ -39,3 +39,7 @@ dependencies:
     version: "18.19.1"
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: redis.enabled
+  - name: k8s-aibom
+    version: "1.5.1"
+    repository: oci://ghcr.io/googlecloudplatform/charts
+    condition: k8s-aibom.enabled
diff --git a/helm/litellm-helm/README.md b/helm/litellm-helm/README.md
index bf4089404db..028b228a991 100644
--- a/helm/litellm-helm/README.md
+++ b/helm/litellm-helm/README.md
@@ -132,6 +132,8 @@ Set `billingMetrics.caSecretName` only when the collector is a private or test o
 | `postgresql.auth.*`       | If `db.deployStandalone` is `true`, care should be taken to ensure the default `password` and `postgres-password` values are **NOT** used.                                                                                                                                                | `NoTaGrEaTpAsSwOrD`                                                                        |
 | `postgresql.image.*`      | If `db.deployStandalone` is `true`, the image for the bundled Postgres. Pinned to a `docker.io/bitnamilegacy` build because Bitnami retired the versioned tags under `docker.io/bitnami`.                                                                                                 | `bitnamilegacy/postgresql:16.2.0-debian-12-r6`                                             |
 | `redis.image.*`           | If `redis.enabled` is `true`, the image for the bundled Redis. Pinned to a `docker.io/bitnamilegacy` build for the same reason.                                                                                                                                                            | `bitnamilegacy/redis:7.2.4-debian-12-r9`                                                   |
+| `k8s-aibom.enabled`       | Install [k8s-aibom](https://github.com/GoogleCloudPlatform/k8s-aibom), an unprivileged controller that generates a CycloneDX 1.6 ML-BOM per AI workload at runtime (model, runtime, image digests, each with evidence and a confidence tier). Namespace opt-in: also label the namespace `aibom.k8saibom.dev/enabled=true`. | `false`                                                                                    |
+| `k8s-aibom.*`             | If `k8s-aibom.enabled` is `true`, configuration passed to the k8s-aibom chart. See its [values](https://github.com/GoogleCloudPlatform/k8s-aibom/blob/main/charts/k8s-aibom/values.yaml).                                                                                                    | See k8s-aibom [values.yaml](https://github.com/GoogleCloudPlatform/k8s-aibom/blob/main/charts/k8s-aibom/values.yaml) |
 
 #### Bundled Postgres image
 
diff --git a/helm/litellm-helm/charts/k8s-aibom-1.5.1.tgz b/helm/litellm-helm/charts/k8s-aibom-1.5.1.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..8445119b8ea12cc1357886147f9e22d0f94f40f5
GIT binary patch
literal 17019
zcmdp+Ly#^^u%;WQZQHha+O}=mwr$(CZQHhOoHoAs@7>RCR+CZjE^3jRtcuKx=Ou`S
zL<Rbv0MG(CIZ*-`N+>ZJOUSazcyh5Bv8XYcD6?5=DRZ&QtEsWes@qr@+L?H&DBAN%
znA+F^-Sm39<8U+)=JkImuN0o)OLtzK2_tx4==(XFN<Lm}dDW0on6q<m0Cx)_7vG5?
z1f<PycAE2#_znG#dPB$iCG3)tZD!ukOXeGA$I_z)2&on-#CNMNQP_+m-#w;4qRmJk
z`@dxJ_v+QVck}~P=Y7rqcL?yWeOCmq@bGW?eLkJ*Usdb-*DtUAL3yALWc-~fB0j6$
zZu-u_PW*sHep1;^;;2UzcwQi4RGef5*=NN84-V2OxsD7t!6ilvnOXGh5!#Z<5@F6M
z3C_}A!V5MwsrwT|zZW1N9|=jJaEGB`p2EsYJ$~Q`QJ#=WrA%D6Zj`cp1kWYk=?~Jf
zai;m=>Wm5|49WI_T{=O@lm%`F>P^zni0~(_f^I2=Em=tEZpbPe%ZAoGyE5A30i}-j
zyPK06$hf%!&biVekh*7;#*jLJfu40TT2x&@V=2;9T~YGgFFnQ!Hd%_Jhq$?&kT^~5
zLShtJ)ea?8T2w+QMa%Sc?@wIL5}u^S`-+5^a^VgF57Ox=z-w@D!M&(TSdi()G2-4S
z3AIvHMMyCVVD^*?_gMuBe_X{Q3_MDXhi&=-Q6g=Wb_LV>4ZaQdR>JN1BPQP|@m?}V
z`Gf4wfYa~(J>IK6_OJiK_3euuF@WIah2tCWb^y?Jm}$;5NUjVLw0D3ETO9g&8{bQ7
z2fK%Jk0+ETp%##>Jbk{Kq}M<P3NC=y-Y768aCOu3)@D5BA~gZ0QcsYEwwfZ1(Ub}F
zgS9M6a1P^{G!k1%7y?yRRv`Nx*beH~MD!_vlnxY_XvTVQY{f$?MG~VAhqc?d<>TS`
zBSM1Xz~mSt<+h)Xm#?>zV<j0{?;~MMO$PZHp96(GXmPf&Kv{;E3~>N5A)<gCcocCT
zY!FqNtefCdgC9|_hb|&RJt)>$C7U)JH>m}h2O?SM>;h`ef#>1u;_TLZZ9Dj8-tOP~
z?Ete+psP=yyOWo@H*m^^tFM=nvzw=@w=;0s?%?vs;o<J)*aVYONrfiBZwB&s4uUC1
z66-K$M_Eh6cxLuuA|}jkMl?d2dtxGFICNhrp~)Q>6BQzP(upjA?Wv8}9HRNr$XPM)
ztRX~>iUuLbLZ7+RHDrPfouY&yD@6pIY9m<T0i=mPuFhk2Xai|}3{zM4CzVwde*j%)
zPnk$Vr1Vbl4KzyTz;KEzG$KwCpT^+KF`|nm<%seD2nV5Xd2wLw-!)RULZv}Acrp;T
zlN2~axG*zxFyY0`9|!5XiV&HF1Tj=er1Q~NN#z8UTPuSk;R)qT3Ka=RNoXu-8i^*-
zNi?ic7TGBt^#mj|IY&Pj6(s)P*#?1=(+Uoc&UJpy9TEsu9?Y9%3;X-|@RGMAT-aCf
zUf^9Ef`66()A#fA@D`4OaERlF2UUBQh4T8(@Grb(Om$D({RIUDvhauDc&(YP&Xs4T
zxnqw*ami6$m`g>>Cmz*~0&NFl%1|lX{xVjOHax^-#FLbB$3G;{g#{vu6QE!9M3jle
zXU$;ZrE!s8;UZo*hbA+D!lLCx@k8bN|GwIlt5oUQkIxeoaIs+KF41#h*@_cYh`_XU
zSTiGX?m(CVGD4taD+OYR((P<_RsxEklxU0M0qe@7Vx+7n&uR%OmuLtuuHXt_qn3lY
z6`UJnK+@Q9M8X!#B!#1|Ta7u>(Qp34mSSh*nqCmw_VM;^hk<crIs3O37s%o$iz-aW
z(wH!LK#K}8`oKDI;}hLCdze<A!70`O$d+z1<edeJcRY8>_~I30_J-D=wNo&N>LG@C
zxR*@uhB8KxKKEI~`UOZk%1p#jWCKdwJ$C8%xxJk{466Ocu~4}B)@C6xE88Gm@}o1v
zP|O&{$XBk!2~LR#m`y&Y&4?{oAb@NCZ~2kcTIJ5sj)ykFW2Fz;)Tj|Aw_qG(Pt1}O
zF;?gUZLwp>lN1vbp`nn5nZ=?L+rc(7rNLbq%U`6$uRC9V5wuGV1apc9*rzZtxeVAu
z{~3WWp5-Q?W;~@NAPMYcg+d!aOJNeu?to&H;VVH$I0*GBV6?0xMVVrIhj>-OF%uEv
z1FX2cgFv4#qa(k7r%;?|!4F8n!AhU_0FxJUpsYQXL1mssI3g6DDPeC1nr;W}*DzV7
zA}7H_YK5H(I=Jmum9=X)HxN!krT8MDmiia+h21S8Y@?sefWpQ30!*hON+Za`k;fS*
zyUMpY(o&)R`G0DPS!E^2A*E8uaL6iG+Ez-$=~r3Ku5%<^FdgWhOtQ>u)j@_TLNg`M
z2meSUn=-mOE92^O7@~bbp^oZX_reOE9y<$pzc!sjeyvY8>kH%^4zqb;kDzJS4~Ad9
zo+Qej90!y{MWv1cuw|mvrwUUdjx2K|GnExV8huo`fjoq2dVmO@7xyhI>K;6(mWaN~
zP3-|`4-sQe{5#QrK>OcGP|U}Z+QW9YG$0M^=9E1-u+#~^y&2S0VN6{3&#$j8;Jdx2
z4>mYY>?TZ{TT2r;exq~JwwqbTnR~in*aI;D^+g7BR@el#)ZJxAbC|HvB%3kN$-^K|
z@v^p!;cBC*DS9qdzzLEvAJSpUZu&F4!Cc#a&y%`ec4&(kDCX%Qu8N41#rdXgfN8go
z6C&cnWM~Ph4+e4B8yg|8)Yt?A$isoc3erEF=S9Jy0X4Jr?p%Awh$iOdz9U*36~C+^
z_80}3+D%^josES!sPv80Y_X^#6NMTnb`vr^XN-mPFf+tjstC&>tr3hVajIYXL-<Ob
zGamPPpPcFec3(J;XS!pVNuh?uNu1~ip>jB+titK8$IU(-Dmw9+FkO(!a~={pAfY@=
ze?nKH0+}|YyMn-ivHXoyRjHYzIKOzNSw?g@7A+^s!#C*4&lH+WHBGTNY49a%9R$T&
z(d;UxVa7vcF_g7=#>2%})|&J1U$I)>*i-F+CwqusefSwcV!8NJQ29h9bRMx~#CaLb
z;3F&BKPjPRvvQPX<~*GnLQ*WO#ts8;pu~gC1?(yxPA>p{cPVL?%rTbR7u{WNrV1++
zqQ!_5;9ZcIpNofc1E)X^WBmJ2s=*t58HzWRDDp)ojeCTP44Dljg^BeHi|q<dNu~ZT
z=Y{K6cdy>O|G^Rc8EKIJ2`POCy$wMwp8kJbQBc+1A3`WEMnj6E7^v6R9hx?Z>H&#5
z&hG9j{J;P18$gfS!(&dES|(c(N%vmgo6h^}k^)m1K)C=JAS?i`MRohNA(o%0p!!kY
z8}H?x8AmC^d{1#gBK;&1O;GFpqyr-B$(Lzmt6D7`M1!X6;p};*y^A_t20Sr<qVl8@
z66Q)`t5kV26{^V>60BDQNL~=hAN&kfKc4}04yb0o`S-UqEI4@B`K*+OIu*D?dek^N
z=<u%zj~SJ+*pU6;r8pVn&NHWc#Z6ZK{G$k=Vy0kh!@?sCEzxmlT7>xu%^)(dSw$}b
z(crpcKN8KuL6~gGQ4n#jq$r8LLtV_JLCs4~)eW50&`WmJjEJe+JBkQx&_agUX`CM1
z%4826p+yF6^CZ{gO#v)7>yr1txh0P<^}y<EMAlHq?lP*zm96G0;)+A%tDoo!>jS0S
zhC6mk=E4+$+0noHIofCW1^}0?mYaXp5@)dxICXS?&riKO<3)c?H-Ky7{?_)!zd!uv
ze!2W^U9THz!MpC~esitg)z*KH1kQi&yy25~|Lkp()-Qi}uYG9i&GoH)pGRJK=5ic%
zmd0w1**I3a>#$s&?<$P8bb+cvCZP83LHfL+aNvLrpMHTY`8&M)J9EWW#esSXuq9-;
z_h&wB=j6EYD-yRK1TAfrn8Ja(%?)441+eU2mU4~-$aJmio4~i;GzKa?SK?^?o#o;L
z#v&rYs8pW9)ofZHm@x~1gn+7oJXVUkjF8(!ndP&|QMlKD=NRjTW*4oT)5;udc6zfR
zURtwZc1z#BIh)a@fM*IHtg!u>e%x14cCpLwFC{I)!B#G)EO*=H&-i!|xqYj+!e@ph
z0LEtK^@03l7vgfoPd;1H;HY|s11bWf!98K1#EKGYIwj<8hIU$AwVgWs)we;_v(4{q
z#$`RB1$r@D&2v58#rKNmH~N9(kaBRbPFS&}VM5LlC)7zx^&|dJx%|Kq<6Lo>AXwRU
z8Twq)%U)2MESzd~AU@idmycKzZ3oROrXD_OdVfA2Th9~CH_3U_9Gnl5l#mj0VIsfK
z=!>!>FUMMlj{iPl&~os4M%RbqXRHJvQ|l}lU-NVGdl9=~8By)A-maD`YRwvRIs<{)
z3;RJ)EW>Ix*xH(&&}xrKx8XvZp)28rWpJ9BIMy^+2i{lwoEFg5tB)u9Vmd`=Zv?o5
ziM@pY+dhnJWgkw`PV-uQxjs0ZCNx}`<LgWEz){D5{_m~62^UM5rKe~+su;^N9(`!L
zu7A+;lXasKOt*WvuV#)`*T=V9e$W#2Ils3EI!{^tD4xmahrK`J#cVDB{>=*q5FZN|
z9|Ii6-vJa|Ay?KZNY$0;HyE~DBG$_*#&_O&|E7rvpJRB=8efsABt}p&)6#Edvz0_O
z1t5deXob}S7ob{tj90b*e?wDAKkmW2KHk!G%pHH`-uD;Hu}x{>Dl&~Q2?&kgeY!EW
zJY-6j*^Nd;vfkMSHjZ17NuO9nsWUt<l3DFtWJ*)JgS_u;)-4uP$j9xeS?c)IN=DJ=
zP)c+1`3oes^<^b?Z;50{i;xhYwHf-BAKtO>1d`wps~*PE$3kDT9T-V$(0lDe@eoLi
z{VN5{qWFu~V@Yj0_aI!}!IGA%dtt(p)CHI2{PGN?`VMq2@pun$)BJqQqmyLngybe-
zF{CV+8iuz>d&bgZwgwn=Muds<jsh(|=2-*ygMgEKJ>x?ApBGaEE^|9@L)|?Pup0Ov
zu}as<S)#4Hd~P;L*HRhf!G;BNgBY=w9n!{B?t*rNzqD4ycV#Ldj-`}%wl(xb<AX(8
zT(e&vbiv>ie;&(wqHp?}-WiG*S6Q5omy;}xiq2;{Qgt=*9?$Hqxfk@}h?pl)8dhcx
zb^1ni3xcrt37c_vX$NGZWF)x_^ZJrc=fQHz7qykYy>3wT%-p;nL@u&HFu1je<BAHf
zw&<zq{@~Y43&5sugOKf-xDCiLZ2I`+&qM$Ck1R!$CZFShs$Bqn(!ai(KLOG<eTx8&
zPk<Nz(60*cH|Ct?KgSFxi?!w+OV3@=3hIYw@bK|OZCf*xgXi53>Z-(|QIF}h+w7^B
z6Dmw&*ot_Wua2>b{q~ph^r%C!00R)<_T9`s1A2d_;Q;#&05||3_!&^ErmuKzaXOt)
zypNVwbz_UGSB8w}k~A*Tu>ffc$21O>Kxy(wh~xfjLo6ZE?csu*_)wQ!KG#SP?<gdv
zSr$s88sRflVnj66e@i2Hk2P<~(|n#P;T?<|^FS2@x}fQSfnP?OGo){sBM{{XY2YoI
zS@kIO-rHOkA_7@9e#~P?^ZQ1*b`CMec8%a>)zrk>H6S%LW@(F<_L_8>`GlAXf*M9C
z-U@Pd=Uf9siTkaXGZTuM(T)nhkvtNeIIHZvuypxT-=}-uy4Hc^fYP+3xy4Gg(?Sqx
zGCSOb$GdIgJ5og-RA%~;E?#tr`Od;G`_#`mz^ndLPX<7M2oHCD0yOk<Y~%pg&--UT
z?g0hQ1Y57u#e0&2B6)rz+UE|>o`3SYO)!P@#nn;_9bteSrMoiSA*$TmBX$Lm8Z89X
z&A<x;omNQ1U?Bs%GHQM*Ro!~1^{XSf0zP+m9Sy)dIMQQ5Gvj6H6*VHX{N_B+<)`F1
zm2m`Mm{_7EQlnWhhL>Y%Us6kon8h%-%v6jOzx)0KqtlwuK>r9v3NsxGU$Dx@yl@V6
zUd;5ns77u8{#9OR@xx3x{Cc@N`$>yls3^cCR`m;wlrW3Gk3;Np-1-(Le}d&mb%S{g
z@H35BDNxljZq&k~!G+pi?(Bewp~#0X<SHRoUot!+bSemYta`83^A22KiXEX~CvU=m
z(}+1i{se1f$3T}^j`HCBqn2+kh$hMUDKg$z*ecVg0sRsQa@U|7Bc0I1E?QM=HiRu7
z+)l?vb$(VK+X{90ErRJ?v583XG?}9j1e0NEkI!TAaemFA(&je)xr$l**B2MEEv=qT
z!LN&(o4<x16p0H^doaOwl_?N8p1}Td-v5aO{s;@>R-0Rx?&j<4>hc}>wI0;C)YoI9
zJxUdoChZ}@R${%usgi2qH&TTQ)6Z=)Ww5O(spj29h>C7haK*Wjs2^lAJl0-lDQwTS
z#l7|w0)^AlhrJ&4pd~KBX3!4Qi|wz@UM+gcTQt7<)9KLHB#CtJrukJFf|OQU)fg&&
zJ)5h?o`3F_H3!I_eRS@91{nDJ^ZnWbO#9op0QPf$>}LSM_xF7gLg$S5Ka%7N+EL@&
zm%&r~tZB0lY)a}V$QVPyHzTXK*AYpFvSmNnKZ}o>6+qb~Oxm+hJPnPq<3+-K+fBq+
zTdlAE@N{Cida;%hCeC0b1yIenAkU0hvyeV-+p~5}V!fZuIcGjcXFiI0+JBqWQiq;h
zgi>D-tR35EifoBxDMq)RQHiq-Y@_=c7w6D|!l2{o=KfWyT$Gwj?X4GV<La#iyk-|K
z32F_~$!4WR$2s!<@*|}$kpuXnkJq!F`uQ{70Nl7Yx3(t$v0wWW0D;c0zo6$E4@4tZ
zqxt6MJ;_hrna-<4eUs<p@4PGXcFtV?z~%R}fA&d#=^q@1UmrAs(C>Q!eA*HJKAw$t
zfbBPc{ny{$1<)^_Uv<>aMHIqM0f3?6r^s7F`!|oOGLLcx$9~tTs9twA3j^c+V*Tau
z1JB%w>BNDWctih5_Pc^B|B6}JkOFwqhyM)b0^ASk^}9D50&sr&4*~u*zxQ8$v8~B5
zi}6uq5(rL*D(*Sbqsi9RzJCXGIJl|oZzI|V=p@H{l1zj4mn-rJEFnFw@@|e;6$Tfq
zQ%C#`(G{8LXR5GOjDD;o%kI1d0gRlKr1CJ!+9vU#5St@8&)8ZTjV33v%=dOaacMK|
zx3+sMm8?0mb6}C%h^w+EDKNfq%_x`KW5&xUYP<pv-{_bZ;NkE$qASUb@lx%Keq<0|
zXk~apsK-2x(`VPXD`O~x4TH<3*k=U4O+WU)<TSr$*>SHbmp9)Q+MC;YIn9NSMveUj
z&qN30(iFA225OgYIU=mwN^BDMOuH?fO2OfR$I%P8qS$z0kN?uhG$gAZEEomi$y=~8
zJbm^l9NEdn6eYrxvrzN=c#1C<S2x|gIa>39t-xCRUZVF4GYO-hDPIae1Mh^P=;}EB
zVd5fG4E$Ft)8apRrGs$N6ilkPo-R>HJJ|JH)_i6g^Twu(mLkm{i>MA%<QuEU1q6~6
zN1B=IGy&4HduoF;y_$^5K`(Rz*SOc~CPBZY=!9w{s>)dgh*G2z8k2aKr*Ucz(FO_{
zn~JHD0Fk^hcA^eZ@&+Eb=1?9+%O|f#Xj&9S{oHD#+$8TYupIx6PB3hyWX2L1b2p#b
zdv?|;$as|jQJWfj85N%8wS36rZ28E()S_c1y~Kx>%J!`+zi7!LV_t@=&97G@cuKGA
zP*l%~<hmvefUO`?!l*6Z^^!$91Ur9UTH6Wa6Yhc6%SuYg>4BR=sjF+;m)`=+LEjZ3
zxkZdB`omMX7AB%j(V~+E1F1{GaP~F6ySe&{8toWdyT{JR3IY)|&ZkKD_CcRM>3dEw
zigigfTyr9LU`l1>qY2H)bthHz9EGzf<Re0$PS*D|OU8+ahyZzps4`JjmkekmkzrGt
zuloy97HV7}ng=%vC{puMI0H(CNWaXz-4~sy>*>0w3`GA#c}<+T6IfQPT`6!Zt+g=r
z!c=a72O-^BeEegL^>D$Nz%ddcNBrz#y=RO9p~VCR)mLc%oi4khZK0B=9{%ylxzmR_
zf5$G|s8F8T!6vi2bL~9SEGM^inkpl?3>O^viDXi-bBZKr2sbVUCWW*7ah(Z@a;4y+
z!fBA3q9IjgDQuEO^?_om9mb!m(@Dx-f<~SS`hz}V^c1>8<(eRAb`M`KXKe>*<1nUZ
zCH7R?>)__f=M9aQUDNY&%M{16Dxy(XD&4c<KP+V(v@ZqkJR8Qfr-qx9!-T~j;O11g
z$suFo9zFoyb!c_b&x-QeRxP=NRrMKG_GN8P1=mD<>vOh8yqf73%tn5QWxPMwqWn6t
zi`zx~0T8;1;`OhOY|zp^6r@!0ni5A`8LhuMFJ<eq>AzWy+eXq_VY7qOAz(J?IW0QH
z>!mwE<ejR=&F|%i9Dmt}BK-F>r~=2Cd><CUN(74T1BVR9nu#Z#-?7hkB+0QgAyPl)
z{*05guc8H%NzD{2)AF@IGDEr~1OjL4S6wd`CqFM^X!OLK7h}>KI<)*Pg0xT>86%A&
zGsv;gg&SnZYt)n>$uA|G>~L^RB$S}4TKvHER={P!hbq;q)?WOm9Np6$MZ2vu{P$wt
zH@akCx`>veCoZvlQ3aZ|dowdQeT2KY@gKe*Wny7a6Mq*1@t2?(6m>mYpnU<t29?)t
zKg^zfmfEQ-wxxEph0mpeH?L4&LJw#)UetQ8D8%akt5Ox!ih2hDIP5ov@!`QF-e9m!
zZHO}#G5I$jEsDnWpf`y6G3%C*Gzkyq7E<lyPKxn3mga#jlRjV{9{!OgB=NJK6~X3E
zX@2*JaaE52&MOh99?dt%hN(x=OWfoYVsV{1-!oPP)Qi3z@KL<D2HXw~67?9{yMesZ
zT-gz^d6yxa-^A{6vGk5xHDaySGa>eRlj#Gg7Q!HN9Ivv!onbkh=4w>IXI~DcWnl^R
zw*#&YP7R$&(z?Wg%^1b}3e!{(q@42Cj&!D>JnykseU_I>i;r35#Z(HAv5n{l8P`i|
zL^k2)$>|zg34`j)AW*HV3||3ERam2e=-!K-L?pozQ!k6D@oBO@C}+K*)d3&W{?cXb
zHPRY~)}lrdC<7KS6?}1(n(}<wUQ!r3tuKcs4_MWHZLkimupLT4au?z;dqQV~y<!1c
zR8$2;^sXq-Nrp=hk<bX?5k=(s7fQy0$WbgS;0ozg)J9)tD3Q}Z)=5c7Q-4+HU0NpX
zg0B`x%kRJJ?k~Ee9%0+aN=?<2EEVqe-h89$?#1dEEVewinC_5t;jZ&O%|;}CE;_kH
z9%HKbB!?@{uEAtlsM~>7Rv+p3epAkb%#Q|^5nT34DO+3{86+-6+^PR=;f6ko@zdwP
z(5X^owJ6Nv{;(=Q+-c+~wZ}OJ+uS*zWp1;#-5FX3yGCyN(7YpiOfxY-|72t~7;9;P
z>jY{E8%PtOkA!pSQFz=k4x7X-7ZNAuwk2v`KIWC7uvWms!>6;ER9bJ$Or+&yUg>uW
z<XdyoQE@gF)Kb~RhzeT{q3+FX495^fJgu~#Qs=42oL=Z&?2J1GNz$YmM3uiYa1CCk
z%ylJucl6innrCaf7q7Cn_K}>follpWMe<a!6AC4ei&k{h>c=>Ge;?`3fHo_BFI_c>
znmgS|EP~88Fl%4b+rS;Bgt@;O+zcH(<_Jl0(zV8-7p(T)gxtYs9{p-z<jd+rMnKPb
zj9(P2@F$J3icWX-7;7BXY3`vKi8xXow8IeH5(D!y?3uaRQijq;e>xxV#)ezL%FXtg
zdM>v+J)Y|i^UAqs>ZyFe&e_Ro5utB`%#*nJR`*|k&MuBl7AaPJ)1t{-FW0a=%^2#9
z&TqZ!poD&m)>aY4<{~UB4dUfy27A?dT%}OjOZF31w3S``IEb5L3p9KFbF8+W&1ezC
z&}Ej62t3_1<9mQOMXsuEtZ|DzoaMD;=H?3wM0a=f5+h*CL5tQ4)o$$1YV`>mTh_>?
zcJX7O&8nB)dVa))G5Pf=uT`sqaprPMyBh*ie_yYJS{WkaKUC3kDE0raaW-4{-eEB-
zxROo8ZVbZdw|Zs2Vpnou>XsSOjH+tK`kaz`Fx^hPB%Um7Q^g1!#QADqnG&@X%3sXA
zmC`rB5}DbBRs)MBoO&r}UCgKCHawilL#8HgQ~9lO)tfxPmxQlY3A{Ql*7x#!pV;yJ
zsymuoQmj*Qf4DyW)%x72y-X6LdC7By_%11AKOxcjR?B5sJ6yM}J^9>j4JzKNO-O)k
zzoJM{$=dP{j$tHfoJ(VRUeDXSn1{|N&AmiT==gm5lS*Vx8WUZ8<2eiL%vXd1GKHCY
z01E7KcTv-PW1(lf^*)3}4Y>2`YKw#+s;&Ra{i%6wIW?B0^_m3E#w;z-mNS(WP;Dw^
zQyTNe&UBRHTBcH@FA?!Ef?B_>72cQ)ws-6TXKkx(=OltbbbmQg<4dMenDGGhpkvzE
zlndeTUjy@Y@x9j1|7}MwUoWTF@*HlnZOc7c*T^eH?&J$ZR^>Iih)(D6w*3llkXnMG
z!$q~mCt77V14X_lC3Q*UuhBN|6$0V>$#B%%(XwO^_=BLFr*y5<_HNrf5&iM!&1DL0
z4Q+*k`;*56$yQXJdOxl<bIUS|gLIrKw^<9H>Qm8E-oPsBS1kcykENbG{|#~yNz%7y
z!P0JoOt~58cPf>E694l7_T`-`;)2rtY|ig*5g$)N8cLsi&2D^tHyLeFl2fZ|7q<I0
zT;Ii6LUcsY>3`+5dShn}P+o~uC}#;<1$TfVs|-25Mj_=&mA*x``c9rEh_)s~=1;(C
z^MtE8gvSEt=<Hn;lgAoJfsH1~Nxc7u1Jg!V&QKawy>4=qvKgsv{(y`{kfVp0P??A%
zaF#t<bG9D)I(z!bjt_=kzpYVjhhSZm?!%N_kij?3bQnOZZb?7kHOq_Z$O@hrN@R=3
zRd2O>eawJtRo_CNi=)`sz9e8^sq_1cj2AH3k`LYAg7v?q;wVmdq#b9n1tAIAjVX8J
zn#TUMTxD`aZsW<op*2#+f?vEi!i8|KeUW8pj+o&1k4<DHXhINu$2~pRF|}&Z*x9={
zx0|CPW!M8hvN+fTTEAT>MV}ZjYRr>v`h>QF&pYfhuZOcL4$*neV~g(ydEI&M0O54_
zssD9OX=fI&iGwtk(+p$wi=3vr?B?zQ_&IwTqD^2fC&dtrW1Dq5gpfmKpKb2p)kn9k
zLAVxP+MXau3N;=rS?hMe)w3Mjb}u)j>}2}M&ZcGM3ex1dHF%L23W=0MrVL$$(%P0x
zANW#z%}14v^509LAa&_nPWl^IS&bWwTd;c9I)d)WO`~D|@MwZR&|wrlXTj74Ggzs3
zPy!;Xqg98*CR$o;J;`iFSQ;}WS!JkG>{<MT+706SW<`}A-L(1|UhsSxY^?c?j0|sc
zZ*1P<wa#F!?{(=nU^L&r0m1Pf&l*_h%o26A2C4czOWm!C+rsv<ANq~6b<~Wz%$nz@
zH}FQx$DPmz(6tI3-Bz16*?sxYbx+&$K0^Ic-#Gpw{i)H_0|1%GoTGgr?3Rv<pSB!S
z=>8niF`zLiaoy$kdjHQ_?Mt!&XOV+iQC*0iz&BbaO;PGTw3R)SNQ2EYZTH3Muf<1h
zei8I6wR^e88VlW~1;;7$GW&KrBUW5#Vbw0^;<=J=)PjH#5eyAm-~QFW8766!Xf}x!
zf`*k3qBam(<9HCxcJ#I6Xq^6if}2hlOlCV%KC~vzo#(t6>l@!|#NTI#Bf!!#;QRO$
zq3>sX{jNN>|9jG#c=qs{FP+%VJhR*05kIKoMAB@=Qmfu^y+}wQ(=lDU^dp+{Lv*9C
zu`TmB(gFH+t|$!PRk^}GNOni&3~8g?^@_rFH_$%LQ9DoTCa(+Y{iJ2hYoq>B90s=F
zvSSfwsdkS8L-&wZH)Mz@^R@g^3DqyILD0#}OiIncegpARx3Hx8<IsV6gCq3^t^GT$
zY$5b{`;CKp!a8K78iaF6#gLn0Eg;2PdSJFNNJbHKW33UCNBAh5-Xv%jMf4|ydSy!Y
zM;YS8vN?8Nkt^pEj)3FinWc1hhmrESA}iLyVtW8kju;5&2UX5Bx8EF~9h7Cdf+xDZ
zrb14o?dP-;Ra?~tv)!$1`gl|)z{jDe;laMzK!bXX!}^(<ZDu1xzx>`66r3Nty7by1
zT<4KsgLj7Odgp~#>mLWco+fC){ui(s9xqM_9*<5RzX+C|H2I8R;{VX8c|Oo~H)wkc
zy0gXoef;=OdhOh|Y!0RMhW^8{M|9el&L&Cclob4%pBZgt--H;<(Yr_~f@n#%<;<eh
ziOj@&A^5l$ng-)LPn2?tRy^>S1oPDL1jMg#Wy=OHYA`mSjn5Xjx&YH7KfXS^WWeWw
z*J-$Jay>pCTecv~k>5KhO-^MLo!VS!@z0<0*Cw3UY#gf2#H9Zf`NSlH&~YZTt4p4L
z9!O%Hnuk~acFHX$rgfO6`J<0)h7Z|s?fysZxNz_Aa(UASRRwwS`!%OA?&{$Dw;$U7
zSIQsST_67u>8vcR`IJw+_sj=<XwB+ymlU>>E9Pxs;2K^5?f38P>Fol2epA7#r*pJ(
zGmIf8G!So9N;UNUs7q_5y(M$EF6oEu*1ge!=(cY7B??V>FZD14?@RUcg<bJBHJbwC
zMF-+unE8vF!!^}|)rumP4TqRG+qR~T?J2?ami}9%#Obf@(eF)z8KqVBA(mh_HLS&O
z8I<)9IR>{#l2r<tY$1$+k|wpeRslj9h1k`zKagf$gfj9Gyzh8`GoTJ4wd&z$esj|i
z7$N1B5`X=yyQ#byF9+Zh4LkfPndE&nkHv`f+iP7d@@vBs;m4T!%q++txgxwk^Yqmb
zn;P)WF+wpKI^5oVJExshFMqwfzkllq9k-?<`Q@r}H$w)N%6Ni^=!8e8rYkOBj$iD@
z`Xef=1Eb>dN;vmJLds;rA@fr=>3dOZiC{4{d>IFS>FH#a!t5-2uX_JXArGt$X7?WR
z!PgpkqC&64)h@auU|!3-H_*m#3#3QXf!+YEYcrKVcUxKYfvsibcvtz5>H69dND@+N
zwSf&CM1QEs7o};TCW&L<zIYszVi@BVn3&LN?hQo1NT-Ms2YLR#4F5A0>@MmuHNj2M
z(M+*ZGkvs9o!#yus2=#;QwtUqrv!65$>8(eh@V3_>oALC&R8mIhg3=>Ul?-j1--mZ
zV7U}~Ao1YVY!v@LbB8agR)ATMxTi*GI?$YM17EVn=is<aR^b71G&c1hrPx9#`BXm`
zHGOTarRFH;I()qb%=fJ%*`f~8ZWXfAI`*vcQG{j(T9*RJXgBR4+{jXoPAw6{b-idK
zcC#@Dsw!^$MAK;o*h5&mS!h#hzp10|la@HzRgNEg&*lwxAu_ndHHOZ9;M>1orex-F
zIw&T54vu%;<%NWMV>hB8IT8AOCpI!s(=a`W4xYbUdeEx}7EMJ0<EKZgeuyIHC`p4M
zm6m)%Hys!BflyyUc`j~#3<xqYhRa(yvQ5vO<p0XRSHVm4^Whmi5y(~DB|j7ySxKKX
zp}YH_+scbI2rikNmqw$Cug-J&(YD^4O5Y`s=CIJlC-#{Rx#v@9e)@%?z2e|qS2v24
zOBWDo$<GrLl4K4$O_?Ukz7|-wT3t;OUJ^LL&l%j-dSMTOu4)!(Q)!ts&)~hCOg}Rs
zk|38U?uJm6qc?f0lM(o|ueZL4sngfq`E~jU_>6t)=wR{Y$p7K-!|OmLO~n+@b1w&`
z-4R|EfxZ+Lf|UUupps;(s<@+i(7dW#LwSw53F(`m_buW>U6=xLs5&!)RWlG8YNB43
z#n}eQC^)D;`}cM9S^~D^8k`c##7EDEf(VZn=X`3kWqaCzM&IABGXB;F$|~i`%X#1P
zF-oe-y+-{>txeVyb^v>3th!-QJ8s+3oOS*j%k!aW0VhX!N8~Qsk81~#2W-~$+HZZL
z%oQ(v;E%0HpwIMre;sZYxyivu7|VGR1(K6sA9`wH7!Wmz*+8IVogO=f5e?#Pj0LoN
z+{ky@$OCB~g!jT^8RoEHG~@X$Rn+s@tY0>Q5i3=~S8T7sQ-whJ3o+KFO1sjzGn$H=
z`UJZ{l>o#{2>=&GoEM54ehJV$<6LoHZh~6)=*t^VJ={$4MRpK?%$%3k;dU_GaiJ@k
z%43^F)XuywPup#x5ol3f(=Yzm^)_lcIs^x<CoVMOk3a0>|HR62iV^2K6rAE>`w|@H
zFM_KR86oDe4r^#$hf|2dM-*JLUo^yRq$AG`vCilP?XAHOL_pAcGK0x0;zgHq#Tu|e
zItPk~MC<H!n4Qa$Us)uvI9dMT%bSglZZn=Sm8H4mtxb#&6BiK==gFeSMX$JAxNPEx
zH+NQwehKk1c@J-s8tbaZm2Yc2T$DQ%42JNtvG-xtJ0qlL$fq@ESowu*kq&BL=B9#|
z57o(n>g1YgDvC3Az4y}Op?Spfs}Yy(6fKoJcIzfNIlnZu3A*U~$p;eK4Xk3YTg=+x
z1kORqjuAA!U7RVj^hh(6)l{T2Q8~eHGz<4ITb}D6TlkPD0$LzaEKf4V{8My5e~M7q
zHfzWe(p|Xvj*jTqHS4$+RH>e5DZE&@qp>!mpZT{rbrh6TMT*(;6<d=L+cV<~O42m}
z9DdLhSOXVFp5wBFQ0>@P|6<eTW4Ccm(ahLBqE$@uZs%1gbow4n55LdriuEzkO)xgi
z^v!=KhEAx4{9>4jYC3om_M>AzS|yb1hsa;78WDOC^2ufs)o)r<wAuLhOl~2_7*mWV
z_}2hK%q>-?!ep`Y`|vnka9ANDg#Ui-a8d>wnU5YOgUz?aD-zg$qHjlVFe(kYx@eSB
z?Kbh1^))rv+@8v`g@AXlOXlQxa!`P3lPgf>fJ`%~0NI=_(j#AWSB$g&RaD)+G{bJj
zuXOVm8|QjTBP3LWN?}AHjV3%fAo9}O0>+Sg6&gCdXf9C=_<?X{DUvqWgH7KWVQ(}&
z2VQB~rc6AL97g3hf?iitDb$rIzHV+y-0|8#g_DB{=DX$qHLaI(xvG*>>qJ~<R!?g_
zAwG74_X+U#(f`A7`?vTU@KL^d7_YDX`<1h>OHS7ks#V)_a?EXb+ZDsz4q|O|Nln}R
zK(xAaXSvvj_h;2j<fX9q%fjF8%kL_s25&Y7&h`{ye2E&Y<biQY3DX&WA^y*CMsNbf
z?$HM}Ys)&njwHdhv~X8DfJEcd=luF^PQQ(&<>eT`Pf}wrUjP2P^vUKt(xh!i*GMtn
z+Qw`(Y|K3Dl8vt__3fLa)0p+OukWu|>&eA}wp4kn(V6e5Z#loZs=52jpq~}QAh-q=
zQiYWTx&B`j>}7n%&O5;}(q!d25YEO-Z0rI{u%DlzB>QRROC$MI-getMeiXlbkAPu;
zOC>`FJ#V7iUwaXeO8coW>!Q`Gmn6J~3V2@AUV5BV>U7n{s#+vf?HO<lx05@<deC+4
z@tqp_)@#AoZSzBMmJFgS%2|`5Q6vQXGJ|k)hQ%o4FyVUg`h#WrY^wolHBfxTRx0qG
z{}<;wG#VIS|62FcZfh)kZvKk~Y8t2&A<Cb{i2)y_J1%DzGvbECwXMCQXCi*2aTZ1l
z22ZB`bB(c|2_YF-Li%?%8blmgK|KXN++5Fm?)WPMHe)g%^Z$Q&2V}!`e3xXyykqtM
zN-@lTcr(tC_%_5n0#bjM4wd9k-iq<`!~Y8k27SK2to5J%@p1ZnUjJDc7ORid|GVt>
z`#C;r9xh&|7_ZNZ6s9<s_n8G2`n-9VeADvn=%2Xm<eWE~=E>W^IC_707y0I$CXYnU
z=gWnd4?aIq=24?^L&}~4mOICKn%PP9J-jf89~MTbxY(5L{mnk;)G%|luLw3=&*MVI
zl^+;_dEg=?CS?)`@!1%fMEEa(It?+-;Yz62s!f{<di_sc0vH?SHBu9T90EK(KE9A-
zEL^jXQ$hyARj_>e`F&mZJ^1(`(a(u=7UeCH>tv<G2(a-}H0cvCdvVSQ=N2l~)>pzf
z=jJU;?k*aFgr!&9x5zM~mU5c4ZjH76fFICGY+(oP>&SNV;i&_^2fbfs&yU0NsoJ;G
z>&Nrv%k61*VaEsUoP8Ywy*-0{UHH*iFK73!s!vZ(-v$PCnQ-PTJ>mnFK<vPi4}F-_
zD)xa~-tP`%TvlfeC6gd!YLbx|b-PWLiyCYm&L`K_+P_cX&_M%6NNU!h0#tB6-6$1^
zTL}#eabTbhIXd39XDz*h7^ya)gB+ZO@d#KoHJup))6{0oJUSKBG&2oM^KzrSE}E~3
zLIqFQ_Ierc0Yj*o;jJv0;7F;<H<7IhC#x*$_ajCgZYX`Qwi1C2QF~u5SX}FC()qJy
z<;4d$lHs;J9<ESGkaYi-#_t<t8@$(Mlf3DXDHgZJzWJx4E>t!~3{aRF=}NL!2w+Mp
zW}AmRUT{Tj=_#51{n$c+wrG+d&@)>6;ky@)4rPSDSS=fxyGPVq^Y6>7-hUNMEJM8b
za)XYxpy2SNbY!nQe};2OwYNQbE7NpsFf#XgRsrAhy#VONxO~5>#L=B=z_eerABxWQ
z75X02#m2flUXQNqK_-9E;az#D{X9=fbl8G;nCbSW+onvZIlunzTm10Wxb7GeoUJ)T
zxA53zsRs@PRN5_#W<?I7TqCt)_=mnpGw`5;H+M<YOmEVeE5X0`(5`F>;R0wMQoSqa
z*!)1VU5qNs@E?VplDIa-z>s1uY~bbm?sRF$adU8<+_nJ53;0Tvw0?uHV$kLamT2zg
z3c$9;%HTiEY>&hxlh2Qd(3Y0bKKJzr7KX^g=93V%oCDO9dM&(7VJV2KuCFk3>jVr{
z0x)~0NQn^8v4V8h=;T&{$l6u%0eKU?BosDGVPdD4qaY`Lhv8L3iBgfVFCD8Q)gnfd
zn#i)JKvEt~w2$!Wx10hcoPvYv4_GRAR4a_=;@Oy+|A_AurN~9T*I3Q6kU0&UYbSRj
zdbGxP!<_COH@7aEpnOtww9C^b4H0Y`Olo}7<rlhE;+>$`N5i!b5#b_%270_y!34f>
zO}T{VK`;Dh5!Ii-8VGS>=RRBt%_{m|!$^~a{E)wcP13%n5ud(cBT<S=7u?~Z8FC`_
z@6V(BUKjjScV}%46pBj4vyws-?TU3L9Lr1^2-3lAzubVDQHj`6t_vh$_oRh^_+>6P
z52Q-Rphjii0E2GM5rOypKX`W^YV8|aLdIX1#&wPe`(4E}$U64Mx=vr7)&wXpmsc}G
z-R`J)|AY>uF=r-GW+VaGr-!U^%{mv}T*~%{&Y1h%e=|FDwlWks)=h_E)JbEdu2o>W
zTec9NDU0#?MH&2H{G;{0$LX`&pSzG24Vt%hq5dSO`EhS%nlWsuV8y6z$CIQ?z#@g}
zgR@!kA$2rKe9?6_J#~oz3ZQgeq|lPojByRt+8`IybmYpNr;xbNu)c9dcFdEd78-ui
z*z9PR&+J&CDF0NG(eww$LTd97^9vMCo;7Y#cjbEhAq&V@FgqqmKL6ZhP&4;7%eIng
zZn_Hr&#d%%n7#7mtI3wfP_w8}Z>L9VwbQZ9R!<vG=1i581-8S`PG0OAa@Ty=Mi@nl
z-m3#TA>!1~1kv$+<NZjQ^|3~ZKIzbtRf;#OE+<H9&g9d;MY?a8!hp>6Ct=|G;D{5e
zN)W##V?Ss7W>jKr*a$&w{)5lHZZYq;LtWG*gbSeaP|@i%j<sOlbHBzipIJY{3i%wT
ziBD57K6Ti%mX5xt&0}w0n4g^H7v;Uh#N4hdhYmelX$B8#3`^o$cveg){L?H-`>+hB
zzLBaNNE2Et&+jFV?@1{lq{R$B&gen9G`8%riH|^_f*u(bjds5=HualkEF+wg`JX{4
zZ((fUtMZ<83$it0H>~*;r=dD{k)ZPXs61aJO++|#2Q1r_ky7^XWu9hieri-|I*882
zpg3ai)i}cqHQUNIydg(iLXBWY(#W>)u15@J##W9-Xj=C!ya}47EN;LGPGb74;)b;i
zT`mqq${<uyZ9*|;WYo!ZHz1jt+*rE|KXLq~+)0NOk<`OJrVxL=vUbh6mslI)!w0q+
z&kndy2@Vt=3=k}IsvK22LCk(Tv=_L2)oIu`nWPIZ9Or(>y5U>t>Fs>#r^mLAf2Ud}
z)q?U58Z(kL6>r=!h_#K=Rw|i69QL+UwKu3Zph_;vCvS)aH<EXy6vvT4B<th;)x8yc
z2O+!8wiu!ZuW%dsgcE-+teqBCT*bfarHwlsnXy=fI_!~vyrzt{Bi;Aph)*5+LiK=I
zoE${Xy+Jq|J@QIft1Fz@zhts!tA-V)$-<O>L(MTxbM96hO;oVQ5R##Awm_kMTz;&}
zm1Dd=??r6@BxB~ZW4-<K)vbTXR`@2>+xPgv<~jy0JBBy<bn<OMv{dE%c6Jq^>!zLb
z8Li3%%UjW;lf>_`C<d{}1VN+#oy(WJ#@hPi^XslnDaJIb^bd4WHF5l^5V>Hr&L>t`
z>m?Eu`2)*RxrKRVq+Zh6?V4Ii#m3m`d~o7WRuV(uCb1lzh<MXYg3Y+>WcT4u(}TVt
znRsXrre0q+b9s(N^mX<&e59Ocu}H7uc8dG5b!p!R6AXu*>FdzmeF6;6wZ@Qotr>E*
zb`!1&x!7r2ZuErO@$2B_mv_vb)OltWXqHuz!!ZoJWd`oa402}+)dcgd++?Ao7no@{
zR!7SR*0i<3a~7?j8M1$|;ai#Tf0j2%LOg|#&QEI&87DS1Oq;EAW=-QF;TF?po0B`A
zisz`Je=v)7xvEL+e?{U^;Z$4jGWWO0;BF@S97*eT<yR%8|C*S0Zs5FFuCTX$%Z)|8
zs7_DW-kBuDoOHxWjH|(94{>3bJEC|jZ`eY3T{hj>idp5bw^uG3y+L^nj&&-$fg9T^
zU2>8XFW`uL;CO(+0oxXfEZ%bN8ewOPnnu62&FxAj5sop>??PY4wo}fnV!lwWS)iQf
z`^r&x?rE8%ok_zYFk6A*TvHD#veP-!2|qKo&-HkA)2@Lg-noj-fS#a=e>n6sOp5Jc
z4@>mAq8}U2=DZB7-a(Ijfh3f;)ue3GiosPC2|vOcLo7=xi!M$|Bb6VmH&@F;;I;m|
zhtHngZz5=YKkFBp7Q#APVl`MV=Mh|h^m~2dH(6o}`NwC5ed^)&b92Gr*S{QwH~%*(
z%ALPmxkE%-n|8C92-~+vl8)C0TTr|I12r$hOMyToU~HrKeOV~*?gW?ez0W!+*RLaI
zjz^Y)=xz?DIcg{q(L>|48eMoKkk?|^X$b>i^vJ0%*UdkQ4ugOft`j|Dm3EvNKZ>-B
z_T4nRBF^Dr54Y8CPf69*`pZ6mZeDwLbA1PEQ$4e!-4rT^10s#-vU;FoI^JMdJpQkd
zAVU7qqThqt+9zGvGRt<Ej>cTkgiRp<A`d7O72kMogN}OkNmkt9TMf;AWPv*hwl0Uh
z6T)zus1BNNROPZr)S!f%3%9JK5PO8hB{1A);1CsQ0oD(jGY!3pE+VKsf5m&XQCnR+
zdfhXb&BXif+|oRrY2shku5?u@di?hzBStc5?}s9$!*Ho+6^?+N$6PVqwL}8I>(j9|
zf7Y7V(qnaUygiOn`p)0kt}*3$K*Z#7UoqTG-loH#4V5g$6c)iv16W+sB}65TLkPS3
z(RMb?_ew3pFoJpTlpV)xfNJqr*;L0FzimRRI{n!O=2uIS^7n%Et|x))69I4uJ7m=I
z(ogK&NJ^wi;0{YP-nmh>QArd;snUIwZ5xoTX>z4;myG!{h`jF=fj_PJT4a>NY5I14
z|4vfn@`-!Ps4V!hbf@VD#O=S})2(ILx3@;vBJ?`JBzuXU-}Lp4-p3#A0yTGKSujIc
zUaa!OtUyvey3fK6-wA5&MoHP{6<|!x^B&MFn*@wechpnro+O*cdK%XCh@E$F$Y8uP
z*-Vr#yhM?y3?*?5*ZH#6Nll*AfMu1BCxchppcyvb0H3YkQN@e<h4IEx$-mc>#I7rd
z`A!IQ8Z%1jym4n}S&pKZ>LLF(DFIghBVB|&AMH`N2VBy8h@btIl|7c*wYt%uoPWev
zG#E`}6@YI2fK~@D*;9_PWwoUr-0`#r0VgKv9&_ZQDrl55o2Uc&nOrH8u8O8MKl<iW
zxP#Sk*-_zFj!Q==ooH~q48-Y#FHi3Fg^kW!Nt<lAU>MIjVDFBF-T2plzieI_VmQkG
zT<?dz$fKx*pRBL9v&jC~J9hWBMP;&jzx<oI%93Jwwu`psSvZ<sC65gP-|n6UFYzxs
z$PVusKB0cpUyn$tazpNH4sTdV;jJ(cT(DpaIy0qfj^72-59}@HBj4zM?H*;iI;FS~
zjP5yqtp(&nOr`U%M-;DS@Z_pkG<V(%m(HlO;!{;~r0oL~(o+Jog1rOU*e8lLLxoXA
z?*qr5H`z8uw$>>;F>e|IDA*$7u^ee^qg;J6DOrduXeeLsT1`JT1J7bcX(^6p;xxDc
z?{|udUn5`33PD}+*t#s+X61Zh)AV|VtI@ELNLm#MT+FGGP4`YQQVc%4SZ)8UKV-R?
z8c7HN5xt2^qXN6Trk;!X2uxlu_`uO-g~YFQUfh9oqfC^Ar~VE3anT|&DuxblBZMf@
zT(VgeNmWonFrk+6qmHs-7VXPXI{+kT(Cj+9Wehh!qmoWKCq#9vWqLA{3Pfm{JL~GD
zCJvq9yxO$rgj9^8lL0{Nr*$qVG|DT5sv3tk<z4*Snmy9Pq5h2P`@k4aj>O->g>HB&
z4EE6#%r1lUonw|b^`hJY@!~sj{<w_0@~=8QCSFH5MbFhpUc_Q)VMo)ZBApW*8?veO
z-yMrB7^$~5t&O^7w$n1wLC+5DldQ0XI&~@P?zPZ5aL{MbO!*O*$HSlX>g;Iu{60Os
z7It?cbmn_wu@uc9sYu1JAGW*_CpJs(;x~_46p8gzvJqoO4enaOG=wW``@}1%7A=Iy
zY@V@gnL*t!#ch|7_w-QFgUT0Wu4xhLo{c&2augE?{oxsn{HRj^jDL4s)6A1;nz;aV
z%cWDar^bECeW~1d<!Op$Zis}oFt(BoWCDvp=hLVyYc4n0{pRDHA%#<PTZ4We2y?!`
zIY&G3XjZ-t1{+eg-Z9q;lN5Fmt6@_ZHLe?B$_gv0VZQ1|Fgq>4ZDCe9f*GbiH~)Rv
zvF=5I&Tde;q3?34RBq5)i>jR;Xv-9l$k8<@ZRyv6iIa!tieGn<6|yfoNiqv3oCb#D
z7T4}3nhD)83XoCSp=>8#8eI>QDcrmUSN&AaoPPk?p6X8*ej?>7P=4dymMXj~p<I=(
zRLMt6*v`wZxU6f3(F5V9YVjddPGOSFA;MXZzieQPp$$p49!Xv&UmZqQ<<dkcMzoyP
zYx+FbG~3tobFl3vPi6f@qb(M0qG9xiO18MR%n_l2&!BRGTDZRfrFW-l_z=>#q{rG-
zmSp8yVJqu;=nlmlO`7S3v4QHTV?tG?%oOSUL(#f_*5@0qrz=_S9B*;opw9)d%4A*H
zFG94PWid~wC5u5#fT$s?qV0qu^VC;Nvpo>ioSN3P9-Q{HLbnFoj+qCJgLcn|Jq4`H
zkNqL+6FK)Vk=a)n;ZGAASiea)<{KY)x^TWT(G^ee_DbvFMwRp~7n^=863HW-lCYJQ
zh+Pp1-v}RLM1|a`;;A7CsHx-B2=lTZIeG^Zy>qA({%_9jGxC~>tPK(8UC)7K^x=s%
zhZgtv&NU0gF4Ve%I&Q9R0(8?FYeO%vaQQ{0$UfH;yYv+M_zdIXrO594!ne0~{GYA4
z$+vCVjfzC}l$X{m-?ueROB3*B+xUiUqskWHV;fR<yoUmDdOt(k)BhWb+u0Zx6nGB*
z_@AZ1XJ|U{l$>Cj>fuR=CpV--80kn(<M9S_B_*bn*BvTSS-Dh}A*%i8Rt5nk1^|f%
BS$hBg

literal 0
HcmV?d00001

diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml
index fcee331a5aa..ef28798deae 100644
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@@ -635,3 +635,12 @@ serviceMonitor:
   namespaceSelector:
     matchNames: []
     # - test-namespace
+
+# Optional runtime AI inventory (k8s-aibom). When enabled, an unprivileged
+# controller generates a CycloneDX 1.6 ML-BOM for AI workloads in namespaces
+# labeled aibom.k8saibom.dev/enabled=true — including the LiteLLM proxy
+# this chart deploys (detected as the `litellm` runtime). Disabled by
+# default; nothing is inventoried without both this flag and the namespace
+# opt-in label.
+k8s-aibom:
+  enabled: false

From 2d51fed0027916f59d865faf87bc7ab7b29d109a Mon Sep 17 00:00:00 2001
From: Glen Messenger <gmessenger@google.com>
Date: Tue, 29 Sep 2026 17:16:56 -0700
Subject: [PATCH 2/2] helm: bump litellm-helm to 1.1.4; unit-test the enabled
 k8s-aibom subchart

Addresses review: the parent chart version increments so the changed
chart publishes and selects reliably, and the enabled configuration is
exercised by helm unittest (controller Deployment, ClusterRole, and the
default AIBOMControllerConfig render when k8s-aibom.enabled=true). The
default-off path cannot be asserted as zero documents by helm-unittest
(disabled dependencies are not loaded) and is covered by every other
suite rendering with default values.

Signed-off-by: Glen Messenger <gmessenger@google.com>
---
 helm/litellm-helm/Chart.yaml                |  2 +-
 helm/litellm-helm/tests/k8s_aibom_test.yaml | 37 +++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 helm/litellm-helm/tests/k8s_aibom_test.yaml

diff --git a/helm/litellm-helm/Chart.yaml b/helm/litellm-helm/Chart.yaml
index 3421e8f619a..6145fcb52d4 100644
--- a/helm/litellm-helm/Chart.yaml
+++ b/helm/litellm-helm/Chart.yaml
@@ -18,7 +18,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.3
+version: 1.1.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/helm/litellm-helm/tests/k8s_aibom_test.yaml b/helm/litellm-helm/tests/k8s_aibom_test.yaml
new file mode 100644
index 00000000000..770a8a41ec0
--- /dev/null
+++ b/helm/litellm-helm/tests/k8s_aibom_test.yaml
@@ -0,0 +1,37 @@
+# The k8s-aibom subchart is condition-gated (k8s-aibom.enabled, default
+# false). helm-unittest does not load a disabled dependency's templates at
+# all, so the default-off path cannot be asserted here as "zero documents";
+# it is covered by every other suite rendering with default values. These
+# tests exercise the enabled configuration end to end.
+suite: k8s-aibom optional subchart (enabled)
+templates:
+  - charts/k8s-aibom/templates/deployment.yaml
+  - charts/k8s-aibom/templates/clusterrole.yaml
+  - charts/k8s-aibom/templates/controllerconfig.yaml
+set:
+  k8s-aibom.enabled: true
+tests:
+  - it: renders the k8s-aibom controller Deployment when enabled
+    template: charts/k8s-aibom/templates/deployment.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: manager
+  - it: renders the k8s-aibom ClusterRole when enabled
+    template: charts/k8s-aibom/templates/clusterrole.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ClusterRole
+  - it: renders the default AIBOMControllerConfig when enabled
+    template: charts/k8s-aibom/templates/controllerconfig.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: AIBOMControllerConfig