AzSHCI.ARCInstaller

0.1.2486.40

AzSHCI.ARCInstaller.psm1

<#############################################################
 # #
 # Copyright (C) Microsoft Corporation. All rights reserved. #
 # #
 #############################################################>
Import-Module $PSScriptRoot\Classes\reporting.psm1 -Force -DisableNameChecking -Global
 

function Check-NodeArcRegistrationStateScriptBlock {
    if(Test-Path -Path "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe")
    {
        $arcAgentStatus = Invoke-Expression -Command "& 'C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe' show -j"
        
        # Parsing the status received from Arc agent
        $arcAgentStatusParsed = $arcAgentStatus | ConvertFrom-Json

        # Throw an error if the node is Arc enabled to a different resource group or subscription id
        # Agent can be is "Connected" or disconnected state. If the resource name property on the agent is empty, that means, it is cleanly disconnected , and just the exe exists
        # If the resourceName exists and agent is in "Disconnected" state, indicates agent has temporary connectivity issues to the cloud
        if(-not ([string]::IsNullOrEmpty($arcAgentStatusParsed.resourceName)) -or
         -not ([string]::IsNullOrEmpty($arcAgentStatusParsed.subscriptionId))  -or 
         -not ([string]::IsNullOrEmpty($arcAgentStatusParsed.resourceGroup))
         )
        {
            
            $differentResourceExceptionMessage = "Node is already ARC Enabled and connected to Subscription Id: {0}, Resource Group: {1}" -f $arcAgentStatusParsed.subscriptionId, $arcAgentStatusParsed.resourceGroup
            Log-info -Message "$differentResourceExceptionMessage" -Type Error -ConsoleOut
            return [ErrorDetail]::NodeAlreadyArcEnabled
        }
        return [ErrorDetail]::Success
    }
}

function Register-ResourceProviderIfRequired{
    param(
        [string] $ProviderNamespace
    )
        $rpState = Get-AzResourceProvider -ProviderNamespace $ProviderNamespace
        $notRegisteredResourcesForRP = ($rpState.Where({$_.RegistrationState  -ne "Registered"}) | Measure-Object ).Count
        if ($notRegisteredResourcesForRP -eq 0 )
        { 
            Log-Info -Message "$ProviderNamespace RP already registered, skipping registration" -ConsoleOut
        } 
        else
        {
            try
            {
                Register-AzResourceProvider -ProviderNamespace $ProviderNamespace | Out-Null
                Log-Info -Message "registered Resource Provider: $ProviderNamespace " -ConsoleOut
            }
            catch
            {
                Log-Info -Message  -Message "Exception occured while registering $ProviderNamespace RP, $_" -ConsoleOut   
                throw 
            }
        }
    }

 function Invoke-AzStackHciArcInitialization
 {
     <#
     .SYNOPSIS
         Perform AzStackHci ArcIntegration Initialization
     .DESCRIPTION
         Initializes ARC integration on Azure Stack HCI node
     .EXAMPLE
         PS C:\> Connect-AzAccount -Tenant $tenantID -Subscription $subscriptionID -DeviceCode
         PS C:\> $nodeNames = [string[]]("host1","host2","host3","host4")
         PS C:\> Invoke-AzStackHciArcIntegrationValidation -SubscriptionID $subscriptionID -ArcResourceGroupName $resourceGroupName -NodeNames $nodeNames
     .PARAMETER SubscriptionID
         Specifies the Azure Subscription to create the resource. Is Mandatory Paratmer
     .PARAMETER ResourceGroup
         Specifies the resource group to which ARC resources should be projected. Is Mandatory Paratmer
    .PARAMETER TenantID
         Specifies the Azure TenantId.Required only if ARMAccessToken is used.
    .PARAMETER Cloud
         Specifies the Azure Environment. Valid values are AzureCloud, AzureChinaCloud, AzureUSGovernment. Required only if ARMAccessToken is used.
    .PARAMETER Region
        Specifies the Region to create the resource. Region is a Mandatory parameter.
    .PARAMETER ArmAccessToken
         Specifies the ARM access token. Specifying this along with AccountId will avoid Azure interactive logon. If not specified, Azure Context is expected to be setup.
    .PARAMETER AccountID
         Specifies the Account Id. Specifying this along with ArmAccessToken will avoid Azure interactive logon. Required only if ARMAccessToken is used.
    .PARAMETER SpnCredential
        Specifies the Service Principal Credential. Required only if ARMAccessToken is not used.
    .PARAMETER Tag
        Specifies the resource tags for the resource in Azure in the form of key-value pairs in a hash table. For example: @{key0="value0";key1=$null;key2="value2"}
    .PARAMETER OutputPath
         Directory path for log and report output.
     #>
     [CmdletBinding(DefaultParametersetName='AZContext')]
     param (
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Subscription ID to project ARC resource ")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Subscription ID to project ARC resource ")]
         [string]
         $SubscriptionID,
         
         #TODO: should we do a validation of if the resource group is created or should we create the RG ?
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Resource group used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Resource group used for HCI ARC Integration")]
         [string]
         $ResourceGroup,
         
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Tenant used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Tenant used for HCI ARC Integration")]
         [string]
         $TenantID,
         
        # AzureCloud , AzureUSGovernment , AzureChinaCloud
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Cloud type used for HCI ARC Integration. Valid values are : AzureCloud , AzureUSGovernment , AzureChinaCloud")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Cloud type used for HCI ARC integration. Valid values are : AzureCloud , AzureUSGovernment , AzureChinaCloud")]
        [string] 
        $Cloud,
        
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Region used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Region used for HCI ARC Integration")]
         [string] 
         $Region,


         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "ARM Access Token used for HCI ARC Integration")]
         [string]
         $ArmAccessToken,

         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Account ID used for HCI ARC Integration")]
         [string]
         $AccountID,
         
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "SPN credential used for onboarding AR")]
         [System.Management.Automation.PSCredential] 
         $SpnCredential,
         
         [Parameter(ParameterSetName='SPN', Mandatory=$false)]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $false, HelpMessage = "Return PSObject result.")]
         [Parameter(Mandatory = $false)]
         [System.Collections.Hashtable] $Tag,

         [Parameter(ParameterSetName='SPN', Mandatory=$false)]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $false, HelpMessage = "Directory path for log and report output")]
         [string]$OutputPath,

         [Parameter(Mandatory = $false)]
         [Switch] $Force
         
     )
 
     try
     {

        $script:ErrorActionPreference = 'Stop'
        $ProgressPreference = 'SilentlyContinue'
        Set-AzStackHciOutputPath -Path $OutputPath
        Log-Info -Message "Installing and Running Azure Stack HCI Environment Checker" -ConsoleOut
        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072;
        $environmentValidatorResult = RunEnvironmentValidator
        if ($environmentValidatorResult -ne [ErrorDetail]::Success -and (-Not $Force) ) {
            Log-Info -Message "Environment Validator failed so not installing the ARC agent" -Type Error -ConsoleOut
            throw "Environment Validator failed, so skipping ARC integration"
        }
        install-HypervModules

        Log-Info -Message "Starting AzStackHci ArcIntegration Initialization" -ConsoleOut  
        $scrubbedParams = @{}
        foreach($psbp in $PSBoundParameters.GetEnumerator())
        {
            if($psbp.Key -eq "ArmAccessToken")
            {
                continue
            }
            $scrubbedParams[$psbp.Key] = $psbp.Value
        }

        Write-AzStackHciHeader -invocation $MyInvocation -params $scrubbedParams -PassThru:$PassThru

        $ArcConnectionState = Check-NodeArcRegistrationStateScriptBlock

        #TODO: other validations related to OS Type and Version should happen here.
        # If the agent is already installed and not connected, we will re-install the agent again. This is like upgrade operation
        & "$PSScriptRoot\Classes\install_aszmagent_hci.ps1";
        if ($LASTEXITCODE -ne 0) { exit 1; }

        # Run connect command
        $CorrelationID =  New-Guid
        $machineName = [System.Net.Dns]::GetHostName()
        if ($PSCmdlet.ParameterSetName -eq "SPN")
        {
            Log-Info -Message "Connecting to Azure using SPN Credentials" -ConsoleOut
            Connect-AzAccount -ServicePrincipal -TenantId $TenantId -Credential $SpnCredential | out-null

            Log-Info -Message "Connected to Azure successfully" -ConsoleOut

            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.HybridCompute"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.GuestConfiguration"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.HybridConnectivity"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.AzureStackHCI"
            if ($ArcConnectionState -ne [ErrorDetail]::NodeAlreadyArcEnabled) {
                Log-Info -Message "Connecting to Azure ARC agent " -ConsoleOut

                & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" connect --service-principal-id "$SpnCredential.UserName" --service-principal-secret "$SpnCredential.GetNetworkCredential().Password" --resource-group "$ResourceGroup"  --resource-name "$machineName"  --tenant-id "$TenantID" --location "$Region" --subscription-id "$SubscriptionID" --cloud "$Cloud" --correlation-id "$CorrelationID"; 

                if ($LASTEXITCODE -ne 0) {
                    Log-Info -Message "Azure ARC agent onboarding failed " -ConsoleOut
                    throw "Arc agent onboarding failed, so erroring out, logs are present in C:\ProgramData\AzureConnectedMachineAgent\Log\azcmagent.log"
                }

                Log-Info -Message "Connected Azure ARC agent successfully " -ConsoleOut
            }
            else {
                Log-Info -Message "Node Already Arc Enabled, so skipping the arc registration" -ConsoleOut
            }

            PerformRoleAssignmentsOnArcMSI $ResourceGroup
               
        }
        elseif ($PSCmdlet.ParameterSetName -eq "ARMToken")
        {
            Log-Info -Message "Connecting to Azure using ARM Access Token" -ConsoleOut

            Connect-AzAccount -Environment $Cloud -Tenant $TenantID  -AccessToken $ArmAccessToken -AccountId $AccountId -Subscription $SubscriptionID | out-null

            Log-Info -Message "Connected to Azure successfully" -ConsoleOut

            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.HybridCompute"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.GuestConfiguration"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.HybridConnectivity"
            Register-ResourceProviderIfRequired -ProviderNamespace "Microsoft.AzureStackHCI"
            
            if ($ArcConnectionState -ne [ErrorDetail]::NodeAlreadyArcEnabled) {
                & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" connect --resource-group "$ResourceGroup" --resource-name "$machineName" --tenant-id "$TenantID" --location "$Region" --subscription-id "$SubscriptionID" --cloud "$Cloud" --correlation-id "$CorrelationID" --access-token "$ArmAccessToken";
            
                if ($LASTEXITCODE -ne 0) {
                    Log-Info -Message "Azure ARC agent onboarding failed " -ConsoleOut
                    throw "Arc agent onboarding failed, so erroring out, logs are present in C:\ProgramData\AzureConnectedMachineAgent\Log\azcmagent.log" 
                }

                Log-Info -Message "Connected Azure ARC agent successfully " -ConsoleOut
            }
            else {
                Log-Info -Message "Node is already arc enabled so skipping ARC registration" -ConsoleOut
            }

            PerformRoleAssignmentsOnArcMSI $ResourceGroup
        }

        Log-Info -Message "Installing TelemetryAndDiagnostics Extension " -ConsoleOut

        $Settings = @{ "CloudName" = $Cloud; "RegionName" = $Region; "DeviceType" = "AzureEdge" }
        New-AzConnectedMachineExtension -Name "TelemetryAndDiagnostics"  -ResourceGroupName $ResourceGroup -MachineName $env:COMPUTERNAME -Location $Region -Publisher "Microsoft.AzureStack.Observability" -Settings $Settings -ExtensionType "TelemetryAndDiagnostics" -NoWait | out-null

        Log-Info -Message "Successfully triggered TelemetryAndDiagnostics Extension installation " -ConsoleOut

        Log-Info -Message "Installing DeviceManagement Extension " -ConsoleOut
        New-AzConnectedMachineExtension -Name "AzureEdgeDeviceManagement"  -ResourceGroupName $ResourceGroup -MachineName $env:COMPUTERNAME -Location $Region -Publisher "Microsoft.Edge" -ExtensionType "DeviceManagementExtension" -NoWait | out-null

        Log-Info -Message "Successfully triggered DeviceManagementExtension installation " -ConsoleOut

        Log-Info -Message "Installing LcmController Extension " -ConsoleOut
        New-AzConnectedMachineExtension -Name "AzureEdgeLifecycleManager"  -ResourceGroupName $ResourceGroup -MachineName $env:COMPUTERNAME -Location $Region -Publisher "Microsoft.AzureStack.Orchestration" -ExtensionType "LcmController" -NoWait | out-null 

        Log-Info -Message "Successfully triggered LCMController Extension installation " -ConsoleOut

        Log-Info -Message "Please verify that the extensions are successfully installed before continuing..." -ConsoleOut
     }
     catch
     {
         Log-Info -Message "" -ConsoleOut
         Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
         Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
         $cmdletFailed = $true
         throw $_
     }
     finally
     {
        Disconnect-AzAccount -ErrorAction SilentlyContinue | out-null
        $Script:ErrorActionPreference = 'SilentlyContinue'
        Write-AzStackHciFooter -invocation $MyInvocation -Failed:$cmdletFailed -PassThru:$PassThru
     }
 }


 function Remove-AzStackHciArcInitialization
 {
     <#
     .SYNOPSIS
         Perform AzStackHci ArcIntegration Initialization
     .DESCRIPTION
         Initializes ARC integration on Azure Stack HCI node
     .EXAMPLE
         PS C:\> Connect-AzAccount -Tenant $tenantID -Subscription $subscriptionID -DeviceCode
         PS C:\> $nodeNames = [string[]]("host1","host2","host3","host4")
         PS C:\> Invoke-AzStackHciArcIntegrationValidation -SubscriptionID $subscriptionID -ArcResourceGroupName $resourceGroupName -NodeNames $nodeNames
     .PARAMETER SubscriptionID
         Specifies the Azure Subscription to create the resource. Is Mandatory Paratmer
     .PARAMETER ResourceGroup
        TODO: This is not used anywhere. Remove it
     .PARAMETER TenantID
         Specifies the Azure TenantId.Required only if ARMAccessToken is used.
     .PARAMETER Cloud
         Specifies the Azure Environment. Valid values are AzureCloud, AzureChinaCloud, AzureUSGovernment. Required only if ARMAccessToken is used.
     .PARAMETER ArmAccessToken
         Specifies the ARM access token. Specifying this along with AccountId will avoid Azure interactive logon. If not specified, Azure Context is expected to be setup.
     .PARAMETER AccountID
         Specifies the Account Id. Specifying this along with ArmAccessToken will avoid Azure interactive logon. Required only if ARMAccessToken is used.
      
    .PARAMETER PassThru
         Return PSObject result.
     .PARAMETER OutputPath
         Directory path for log and report output.
     .PARAMETER CleanReport
         Remove all previous progress and create a clean report.
     .INPUTS
         Inputs (if any)
     .OUTPUTS
         Output (if any)
     #>
     [CmdletBinding(DefaultParametersetName='AZContext')]
     param (
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Environment used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Environment used for HCI ARC Integration")]
         [string]
         $SubscriptionID,
         
         #TODO: should we do a validation of if the resource group is created or should we create the RG ?
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Environment used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Tenant used for HCI ARC Integration")]
         [string]
         $ResourceGroup,
         
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Azure Environment used for HCI ARC Integration")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Azure Subscription used for HCI ARC Integration")]
         [string]
         $TenantID,
         # AzureCloud , AzureUSGovernment , AzureChinaCloud
         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "Specifies the Azure Environment. Azure Valid values are AzureCloud, AzureChinaCloud, AzureUSGovernment")]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Specifies the Azure Environment. Azure Valid values are AzureCloud, AzureChinaCloud, AzureUSGovernment")]
         [string] 
         $Cloud,

         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "ARM Access Token used for HCI ARC Integration")]
         [string]
         $ArmAccessToken,

         [Parameter(ParameterSetName='ARMToken', Mandatory = $true, HelpMessage = "Account ID used for HCI ARC Integration")]
         [string]
         $AccountID,
         

         [Parameter(ParameterSetName='SPN', Mandatory = $true, HelpMessage = "SPN credential used for onboarding ARC machine")]
         [System.Management.Automation.PSCredential] 
         $SpnCredential,

        [Parameter(ParameterSetName='SPN', Mandatory=$false)]
        [Parameter(ParameterSetName='ARMToken', Mandatory = $false, HelpMessage = "Use to force clean the device , even if the cloud side clean up fails")]
        [switch]
        $Force,
 
         [Parameter(ParameterSetName='SPN', Mandatory=$false)]
         [Parameter(ParameterSetName='ARMToken', Mandatory = $false, HelpMessage = "Directory path for log and report output")]
         [string]$OutputPath
     )
 
     try
     {
        $script:ErrorActionPreference = 'Stop'
        Set-AzStackHciOutputPath -Path $OutputPath
        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072;

        Log-Info -Message "Starting Arc Cleanup" -ConsoleOut

        $ArcConnectionState = Check-NodeArcRegistrationStateScriptBlock

        if ($PSCmdlet.ParameterSetName -eq "SPN")
        {
            Log-info -Message "Connecting to Azure with SPN" -ConsoleOut
            Connect-AzAccount -ServicePrincipal -TenantId $TenantId -Credential $SpnCredential
            RemoveRoleAssignmentsOnArcMSI $ResourceGroup
            Log-info -Message "Successfully connected to Azure with SPN" -ConsoleOut
            if ($ArcConnectionState -eq [ErrorDetail]::NodeAlreadyArcEnabled) {
                try {
                    Log-Info -Message "Removing Arc Extensions" -ConsoleOut
                    #TODO: enable Debug logs on Azure cmdlets
                    Get-AzConnectedMachineExtension -ResourceGroupName  $ResourceGroup -MachineName $ENV:COMPUTERNAME | Remove-AzConnectedMachineExtension -NoWait
                
                    Log-Info -Message "Removed Arc Extensions successfully" -ConsoleOut
                
                    & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" disconnect --service-principal-id "$SpnCredential.UserName" --service-principal-secret "$SpnCredential.GetNetworkCredential().Password" ;

                    Log-Info -Message "successfully disconnected ARC agent" -ConsoleOut

                }
                catch {
                    & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" disconnect --force-local-only;
                    #TODO: delete all the extension folders
                }
            }
            else{
                Log-Info -Message "Node was not ARC enabled so not disconnecting from ARC" -ConsoleOut
            }
  
        }
        elseif ($PSCmdlet.ParameterSetName -eq "ARMToken")
        {
            Log-Info -Message "Connecting to Azure with ARMAccess Token" -ConsoleOut
            Connect-AzAccount -Environment $Cloud -Tenant $TenantID  -AccessToken $ArmAccessToken -AccountId $AccountId -Subscription $SubscriptionID | out-null
            RemoveRoleAssignmentsOnArcMSI $ResourceGroup
            Log-Info -Message "Successfully connected to Azure with ARM Token" -ConsoleOut
            if ($ArcConnectionState -eq [ErrorDetail]::NodeAlreadyArcEnabled) {
                try {
                
                    Log-Info -Message "Removing Arc Extensions" -ConsoleOut
                    Get-AzConnectedMachineExtension -ResourceGroupName  $ResourceGroup -MachineName $ENV:COMPUTERNAME | Remove-AzConnectedMachineExtension -NoWait
            
                    & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" disconnect  --access-token "$ArmAccessToken";
                
                    Log-Info -Message "successfully disconnected ARC agent" -ConsoleOut
                
                }
                catch {
                    & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" disconnect --force-local-only;
                    #TODO: delete all the extension folders
                }
            }
            else{
                Log-Info -Message "Node was not ARC enabled, so not removing ARC agent" -ConsoleOut
            }

        }

     }
     catch
     {
         Log-Info -Message "" -ConsoleOut
         Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
         Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
         $cmdletFailed = $true
         throw $_
     }
     finally
     {
         Disconnect-AzAccount -ErrorAction SilentlyContinue | out-null
         $Script:ErrorActionPreference = 'SilentlyContinue'
     }
 }

 # Method to assign role assignments on ARC MSI
function PerformRoleAssignmentsOnArcMSI {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string] $ResourceGroup
    )
    try {
        $objectId = GetObjectIdFromArcMachine
        if ($null -ne $objectId) {
            $setEdgeDevicesRolesResult = AssignRoleToAnObjectUsingRetries -ObjectId $objectId -RoleName "Azure Stack HCI Device Management Role" -ResourceGroup $ResourceGroup -Verbose
            if ($setEdgeDevicesRolesResult -ne [ErrorDetail]::Success) {
                Log-Info -Message "Failed to assign Edge devices create role on the resource group" -ConsoleOut -Type Error
            }
            else{
                Log-Info -Message "Successfully assigned permission Azure Stack HCI Device Management Service Role to create or update Edge Devices on the resource group" -ConsoleOut
            }
            
            # Temporary assignment till the Observability role removes the extension installation call
            $arcManagerRoleStatus = AssignRoleToAnObjectUsingRetries -ObjectId $objectId -RoleName "Azure Connected Machine Resource Manager" -ResourceGroup $ResourceGroup
            if ($arcManagerRoleStatus -ne [ErrorDetail]::Success) {
                Log-Info -Message "Failed to assign the Azure Connected Machine Resource Nanager role on the resource group" -ConsoleOut -Type Error
            }
            else{
                Log-Info -Message "Successfully assigned the Azure Connected Machine Resource Nanager role on the resource group" -ConsoleOut
            }
            # Temporary assignment till the "Azure Stack HCI Device Management Role" gets the ResourceGroup Read permission
            $readerRoleStatus = AssignRoleToAnObjectUsingRetries -ObjectId $objectId -RoleName "Reader" -ResourceGroup $ResourceGroup
            if ($readerRoleStatus -ne [ErrorDetail]::Success) {
                Log-Info -Message "Failed to assign the reader role on the resource group" -ConsoleOut -Type Error
            }
            else{
                Log-Info -Message "Successfully assigned the reader Resource Nanager role on the resource group" -ConsoleOut
            }
        }    
    }
    catch {
        Log-Info -Message "" -ConsoleOut
        Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
        Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
    }
}

# Method to remove role assignments on ARC MSI
function RemoveRoleAssignmentsOnArcMSI {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string] $ResourceGroup
    )
    try {
        $objectId = GetObjectIdFromArcMachine
        if ($null -ne $objectId) {
            $edgeDevicesRoleAssignment = Get-AzRoleAssignment -ObjectId $objectId -RoleDefinitionName "Azure Stack HCI Device Management Service Role" -ResourceGroupName $ResourceGroup
            if ($null -ne $edgeDevicesRoleAssignment){
                Remove-AzRoleAssignment -ObjectId $objectId -RoleDefinitionName "Azure Stack HCI Device Management Service Role" -ResourceGroupName $ResourceGroup
                Log-Info -Message "Successfully removed permission Azure Stack HCI Device Management Service Role to create or update Edge Devices on the resource group" -ConsoleOut
            }
            else{
                Log-Info -Message "Already Azure Stack HCI Device Management Service Role role assignment is removed" -ConsoleOut
            }
        }
    }
    catch {
        Log-Info -Message "" -ConsoleOut
        Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
        Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
    }
}

# Set Role On An Object Id with retries
function AssignRoleToAnObjectUsingRetries {
    param(
        [String] $ObjectId,
        [String] $ResourceGroup,
        [string] $RoleName
    )
    $stopLoop = $false
    [int]$retryCount = "0"
    [int]$maxRetryCount = "5"

    Log-Info -Message $"Checking if $RoleName is assigned already for SPN with Object ID: $ObjectId" -ConsoleOut
    $arcSPNRbacRoles = Get-AzRoleAssignment -ObjectId $ObjectId -ResourceGroupName $ResourceGroup
    $alreadyFoundRole = $false
    $arcSPNRbacRoles | ForEach-Object {
        $roleFound = $_.RoleDefinitionName
        if ($roleFound -eq $RoleName)
        {
            $alreadyFoundRole=$true
            Log-Info -Message $"Already Found $RoleName Not Assigning" -ConsoleOut
        }
    }
    if( -not $alreadyFoundRole)
    {
        Log-Info -Message "Assigning $RoleName to Object : $ObjectId" -ConsoleOut
        do
        {
            try
            {
                New-AzRoleAssignment -ObjectId $ObjectId -ResourceGroupName $ResourceGroup -RoleDefinitionName $RoleName | Out-Null
                Log-Info -Message $"Sucessfully assigned $RoleName to Object Id $ObjectId" -ConsoleOut
                $stopLoop = $true
            }
            catch
            {
                # 'Conflict' can happen when either the RoleAssignment already exists or the limit for number of role assignments has been reached.
                if ($_.Exception.Response.StatusCode -eq 'Conflict')
                {
                    $roleAssignment  = Get-AzRoleAssignment -ObjectId $ObjectId -ResourceGroupName $ResourceGroup -RoleDefinitionName $RoleName
                    if ($null -ne $roleAssignment)
                    {
                        Log-Info -Message $"Sucessfully assigned $RoleName to Object Id $ObjectId" -ConsoleOut
                        return [ErrorDetail]::Success
                    }
                    Log-Info -Message $"Failed to assign roles to service principal with object Id $($ObjectId). ErrorMessage: " + $_.Exception.Message + " PositionalMessage: " + $_.InvocationInfo.PositionMessage -ConsoleOut -Type Error
                    return [ErrorDetail]::PermissionsMissing
                }
                if ($retryCount -ge $maxRetryCount)
                {
                    # Timed out.
                    Log-Info -Message $"Failed to assign roles to service principal with object Id $($ObjectId). ErrorMessage: " + $_.Exception.Message + " PositionalMessage: " + $_.InvocationInfo.PositionMessage -ConsoleOut -Type Error
                    return [ErrorDetail]::PermissionsMissing
                }
                Log-Info -Message $"Could not assign roles to service principal with Object Id $($ObjectId). Retrying in 10 seconds..." -ConsoleOut
                Start-Sleep -Seconds 10
                $retryCount = $retryCount + 1
            }
        }
        While(-Not $stopLoop)
    }
    return [ErrorDetail]::Success
}

function install-HypervModules{
    try
    {
        Log-Info -Message "Installing Hyper-V Management Tools" -ConsoleOut
        Install-WindowsFeature -Name Hyper-V -IncludeManagementTools | Out-Null
        Log-Info -Message "Successfully installed Hyper-V Management Tools"                
    }
    catch
    {
        Log-Info -Message "" -ConsoleOut
        Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
        Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
    }
 }
 # Method to Get the object id from the ARC Imds endpoint
 function GetObjectIdFromArcMachine {
    try {
        $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
        $headers.Add("metadata", "true")
        $headers.Add("UseDefaultCredentials","true")
        $response = Invoke-WebRequest -Uri "http://localhost:40342/metadata/instance/compute?api-version=2020-06-01" -Method GET -Headers $headers -UseBasicParsing
        $content = $response.Content | ConvertFrom-Json
        Log-Info -Message "Successfully got the content from IMDS endpoint" -ConsoleOut
        $arcResource = Get-AzResource -ResourceId $content.resourceId
        $objectId = $arcResource.Identity.PrincipalId
        Log-Info -Message "Successfully got Object Id for Arc Installation $objectId" -ConsoleOut
        return $objectId
    }
    catch {
        Log-Info -Message "" -ConsoleOut
        Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
        Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
    }
    
 }

 function RunEnvironmentValidator {
    try {
        Install-Module -Name AzStackHci.EnvironmentChecker -Repository PSGallery -Force
        $res = Invoke-AzStackHciConnectivityValidation -PassThru
        $successfulTests = $res | Where-Object { $_.Status -eq "Succeeded"}
        if ($res.Count -eq $successfulTests.Count){
            Log-Info -Message "All the environment validation checks succeeded" -ConsoleOut
            return [ErrorDetail]::Success
        }
        else {
            $failedTests = $res | Where-Object { $_.Status -ne "Succeeded"}
            $criticalFailedTests =  $failedTests | Where-Object { $_.Severity -eq "Critical"}
            if( $criticalFailedTests.Count -gt 0)
            {
                Log-Info -Message "Critical environment validations failed, Failed Tests are shown below" -ConsoleOut
                $criticalFailedTests | Where-Object { $msg = $_ | Format-List | Out-String ; Log-Info -Message $msg -ConsoleOut }
                return [ErrorDetail]::EnvironmentValidationFailed
                
            }else
            {
                Log-Info -Message "Non-Critical environment validations failed, Failed Tests are shown below" -ConsoleOut
                $failedTests | Where-Object { $msg = $_ | Format-List | Out-String ; Log-Info -Message $msg -ConsoleOut }
                return [ErrorDetail]::Success
            }

        }
    }
    catch {
        Log-Info -Message "" -ConsoleOut
        Log-Info -Message "$($_.Exception.Message)" -ConsoleOut -Type Error
        Log-Info -Message "$($_.ScriptStackTrace)" -ConsoleOut -Type Error
        return [ErrorDetail]::EnvironmentValidationFailed
    }
    return [ErrorDetail]::EnvironmentValidationFailed
 }
enum ErrorDetail
{
    Unused;
    PermissionsMissing;
    Success;
    NodeAlreadyArcEnabled;
    EnvironmentValidationFailed
}

Export-ModuleMember -Function Invoke-AzStackHciArcInitialization
Export-ModuleMember -Function Remove-AzStackHciArcInitialization
# SIG # Begin signature block
# MIIoLQYJKoZIhvcNAQcCoIIoHjCCKBoCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBZwFaGo0ajbOps
# Qf7CzUyBXu8322x7QxSwbW3wD2G3w6CCDXYwggX0MIID3KADAgECAhMzAAADTrU8
# esGEb+srAAAAAANOMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI5WhcNMjQwMzE0MTg0MzI5WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDdCKiNI6IBFWuvJUmf6WdOJqZmIwYs5G7AJD5UbcL6tsC+EBPDbr36pFGo1bsU
# p53nRyFYnncoMg8FK0d8jLlw0lgexDDr7gicf2zOBFWqfv/nSLwzJFNP5W03DF/1
# 1oZ12rSFqGlm+O46cRjTDFBpMRCZZGddZlRBjivby0eI1VgTD1TvAdfBYQe82fhm
# WQkYR/lWmAK+vW/1+bO7jHaxXTNCxLIBW07F8PBjUcwFxxyfbe2mHB4h1L4U0Ofa
# +HX/aREQ7SqYZz59sXM2ySOfvYyIjnqSO80NGBaz5DvzIG88J0+BNhOu2jl6Dfcq
# jYQs1H/PMSQIK6E7lXDXSpXzAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUnMc7Zn/ukKBsBiWkwdNfsN5pdwAw
# RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW
# MBQGA1UEBRMNMjMwMDEyKzUwMDUxNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci
# tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG
# CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu
# Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0
# MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAD21v9pHoLdBSNlFAjmk
# mx4XxOZAPsVxxXbDyQv1+kGDe9XpgBnT1lXnx7JDpFMKBwAyIwdInmvhK9pGBa31
# TyeL3p7R2s0L8SABPPRJHAEk4NHpBXxHjm4TKjezAbSqqbgsy10Y7KApy+9UrKa2
# kGmsuASsk95PVm5vem7OmTs42vm0BJUU+JPQLg8Y/sdj3TtSfLYYZAaJwTAIgi7d
# hzn5hatLo7Dhz+4T+MrFd+6LUa2U3zr97QwzDthx+RP9/RZnur4inzSQsG5DCVIM
# pA1l2NWEA3KAca0tI2l6hQNYsaKL1kefdfHCrPxEry8onJjyGGv9YKoLv6AOO7Oh
# JEmbQlz/xksYG2N/JSOJ+QqYpGTEuYFYVWain7He6jgb41JbpOGKDdE/b+V2q/gX
# UgFe2gdwTpCDsvh8SMRoq1/BNXcr7iTAU38Vgr83iVtPYmFhZOVM0ULp/kKTVoir
# IpP2KCxT4OekOctt8grYnhJ16QMjmMv5o53hjNFXOxigkQWYzUO+6w50g0FAeFa8
# 5ugCCB6lXEk21FFB1FdIHpjSQf+LP/W2OV/HfhC3uTPgKbRtXo83TZYEudooyZ/A
# Vu08sibZ3MkGOJORLERNwKm2G7oqdOv4Qj8Z0JrGgMzj46NFKAxkLSpE5oHQYP1H
# tPx1lPfD7iNSbJsP6LiUHXH1MIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq
# hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
# IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG
# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg
# Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
# CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03
# a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr
# rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg
# OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy
# 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9
# sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh
# dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k
# A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB
# w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn
# Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90
# lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w
# ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o
# ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD
# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa
# BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny
# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG
# AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t
# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV
# HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG
# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl
# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb
# C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l
# hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6
# I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0
# wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560
# STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam
# ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa
# J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah
# XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA
# 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt
# Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr
# /Xmfwb1tbWrJUnMTDXpQzTGCGg0wghoJAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw
# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN
# aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp
# Z25pbmcgUENBIDIwMTECEzMAAANOtTx6wYRv6ysAAAAAA04wDQYJYIZIAWUDBAIB
# BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO
# MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIAbG2yuYgJt86PtxA0EUoC1b
# dJEYlCeBqhprIjvpj0oEMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A
# cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB
# BQAEggEAr4qsTx1DGMvVcRT/mz6YG/sreVZQxANxFPz8iCDoiE2IUNpYeCq5DPMi
# o032q9X0TH/xyI1jtTxc/6VDG+ZDQdM3uxtE7QSJgF88Py+bAqIohScc42nOjsf+
# hIHFM+3e45Q/BUW3RYl1tAXFhcGTDQr5ix7iSrYuONRVjS/2KJU/APr30lKBkVTR
# pDFjJKQsnMekbtOrGRYCQhvd9pqXWbrnBkQE/bSh6Myiv0tQnyCUKIjz0uSHeNAB
# mYNED///ZB0wAWO89/8mWLsnvvOIVwqo2vckN1ElQfIM2EmJzKMqhyJ0UAbyJyha
# 5KHdqfr+z14OlsvjSww5VVVjJua3aqGCF5cwgheTBgorBgEEAYI3AwMBMYIXgzCC
# F38GCSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsq
# hkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl
# AwQCAQUABCBXjvADL7fcpFBDZkPS2hQNVm+AeT4dAOB1swv28jV8AQIGZSieJjEL
# GBMyMDIzMTAyMzA3NDYzMC43MjdaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJV
# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE
# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l
# cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046MzcwMy0w
# NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Wg
# ghHtMIIHIDCCBQigAwIBAgITMwAAAdTk6QMvwKxprAABAAAB1DANBgkqhkiG9w0B
# AQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD
# VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yMzA1MjUxOTEy
# MjdaFw0yNDAyMDExOTEyMjdaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz
# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv
# cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z
# MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046MzcwMy0wNUUwLUQ5NDcxJTAjBgNV
# BAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEB
# AQUAA4ICDwAwggIKAoICAQCYU94tmwIkl353SWej1ybWcSAbu8FLwTEtOvw3uXMp
# a1DnDXDwbtkLc+oT8BNti8t+38TwktfgoAM9N/BOHyT4CpXB1Hwn1YYovuYujoQV
# 9kmyU6D6QttTIKN7fZTjoNtIhI5CBkwS+MkwCwdaNyySvjwPvZuxH8RNcOOB8ABD
# hJH+vw/jev+G20HE0Gwad323x4uA4tLkE0e9yaD7x/s1F3lt7Ni47pJMGMLqZQCK
# 7UCUeWauWF9wZINQ459tSPIe/xK6ttLyYHzd3DeRRLxQP/7c7oPJPDFgpbGB2HRJ
# aE0puRRDoiDP7JJxYr+TBExhI2ulZWbgL4CfWawwb1LsJmFWJHbqGr6o0irW7IqD
# kf2qEbMRT1WUM15F5oBc5Lg18lb3sUW7kRPvKwmfaRBkrmil0H/tv3HYyE6A490Z
# FEcPk6dzYAKfCe3vKpRVE4dPoDKVnCLUTLkq1f/pnuD/ZGHJ2cbuIer9umQYu/Fz
# 1DBreC8CRs3zJm48HIS3rbeLUYu/C93jVIJOlrKAv/qmYRymjDmpfzZvfvGBGUbO
# px+4ofwqBTLuhAfO7FZz338NtsjDzq3siR0cP74p9UuNX1Tpz4KZLM8GlzZLje3a
# HfD3mulrPIMipnVqBkkY12a2slsbIlje3uq8BSrj725/wHCt4HyXW4WgTGPizyEx
# TQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFDzajMdwtAZ6EoB5Hedcsru0DHZJMB8G
# A1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCG
# Tmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUy
# MFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4w
# XAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2Vy
# dHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwG
# A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQD
# AgeAMA0GCSqGSIb3DQEBCwUAA4ICAQC0xUPP+ytwktdRhYlZ9Bk4/bLzLOzq+wcC
# 7VAaRQHGRS+IPyU/8OLiVoXcoyKKKiRQ7K9c90OdM+qL4PizKnStLDBsWT+ds1ha
# yNkTwnhVcZeA1EGKlNZvdlTsCUxJ5C7yoZQmA+2lpk04PGjcFhH1gGRphz+tcDNK
# /CtKJ+PrEuNj7sgmBop/JFQcYymiP/vr+dudrKQeStcTV9W13cm2FD5F/XWO37Ti
# +G4Tg1BkU25RA+t8RCWy/IHug3rrYzqUcdVRq7UgRl40YIkTNnuco6ny7vEBmWFj
# cr7Skvo/QWueO8NAvP2ZKf3QMfidmH1xvxx9h9wVU6rvEQ/PUJi3popYsrQKuogp
# hdPqHZ5j9OoQ+EjACUfgJlHnn8GVbPW3xGplCkXbyEHheQNd/a3X/2zpSwEROOcy
# 1YaeQquflGilAf0y40AFKqW2Q1yTb19cRXBpRzbZVO+RXUB4A6UL1E1Xjtzr/b9q
# z9U4UNV8wy8Yv/07bp3hAFfxB4mn0c+PO+YFv2YsVvYATVI2lwL9QDSEt8F0RW6L
# ekxPfvbkmVSRwP6pf5AUfkqooKa6pfqTCndpGT71HyiltelaMhRUsNVkaKzAJrUo
# ESSj7sTP1ZGiS9JgI+p3AO5fnMht3mLHMg68GszSH4Wy3vUDJpjUTYLtaTWkQtz6
# UqZPN7WXhjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZI
# hvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw
# DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x
# MjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAy
# MDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMC
# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV
# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp
# bWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
# AQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25Phdg
# M/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPF
# dvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6
# GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBp
# Dco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50Zu
# yjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3E
# XzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0
# lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1q
# GFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ
# +QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PA
# PBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkw
# EgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxG
# NSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARV
# MFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWlj
# cm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAK
# BggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMC
# AYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvX
# zpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20v
# cGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYI
# KwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG
# 9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0x
# M7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmC
# VgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449
# xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wM
# nosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDS
# PeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2d
# Y3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxn
# GSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+Crvs
# QWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokL
# jzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL
# 6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNQ
# MIICOAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp
# bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw
# b3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEn
# MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjM3MDMtMDVFMC1EOTQ3MSUwIwYDVQQD
# ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQAt
# M12Wjo2xxA5sduzB/3HdzZmiSKCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
# IFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA6OBLETAiGA8yMDIzMTAyMzAxMjk1
# M1oYDzIwMjMxMDI0MDEyOTUzWjB3MD0GCisGAQQBhFkKBAExLzAtMAoCBQDo4EsR
# AgEAMAoCAQACAk7pAgH/MAcCAQACAhOQMAoCBQDo4ZyRAgEAMDYGCisGAQQBhFkK
# BAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJ
# KoZIhvcNAQELBQADggEBAIrIac5HT7UE7Kshax5Zdvu0t0p44CGxZ6sOp0Dem1mE
# 4M/coaUXAT8ZsWPmpj4IH8GQZ0Q1gAoAiyXJQ8Yeprwho4U/pEkzeneEgNAhYEKy
# u/Zn+H/2cTEKxNz2L2hWBugVjtilRCMv9SzqOFUbmJ/+/Hr+c9SaCIH/lEMctWSN
# kJtVSiQ02LU/1J/CRuN3wVKPVpWPmHnBEJ/CRUiB5Z9nKd/QWUViKm3yr5COxltD
# DRz2+JJ0BjHaevC0UdPThKItUqBSq0vHPBnRrPXof8uHgWNWZjITEbzNUjZ2fazu
# Ko3FXv8kQ48UzHTZkjZWs2qbB0zQa2RyvEXhc7gVNJsxggQNMIIECQIBATCBkzB8
# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk
# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1N
# aWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAdTk6QMvwKxprAABAAAB
# 1DANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEE
# MC8GCSqGSIb3DQEJBDEiBCBHuXkfcvceG+33Wrm1PMxomdkJa7Jp3DAngdL2BkHr
# sjCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIMzqh/rYFKXOlzvWS5xCtPi9
# aU+fBUkxIriXp2WTPWI3MIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
# Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m
# dCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENB
# IDIwMTACEzMAAAHU5OkDL8CsaawAAQAAAdQwIgQgFMhz0cQUuKvg4PQG8LV8Gaai
# W/xNxe6IYD3SGYO6kPswDQYJKoZIhvcNAQELBQAEggIAZFXfgutVZB794IaKLcO8
# cpczJqS20N4zuRfFnN2DTFgCpNXwMhX+Rw+jMjgFJhJJeAipU5pPoZnP+urmAS3d
# g//SjdoJ0r59/+4E99Ea40QylhYUQKugKjHiagCmyURnTrwREBa/ibb+pN6pcY0B
# LCQTV5pdRRgEdQ93IVWx/mn64bl14GMti3lcw/8GE8cFylwW5WfB24mQI0k33Y5b
# LdhnnJrXvv7yoU2g3NuaccChP63VN7z7cDT1v3CpvED9oZNhng24eA0gbAN6qw4Q
# 9wzLEJiCDTuODAGCFh34X+hjYCKl7UM234U7E0lzVYHR0jon6NyYK3lnMU5mj/XY
# VAaE3sd4OVGBFYh+zwmD1LpAFeZqVH7B3GgsDE0hFl5QeFuKjruP2ctKPcOfoqxG
# nuE4Nyumb1PLIDh/Eq21PrFa46+m4ahD+UCan8Jl+mZGp6iABbkXXoitThSmYpa1
# 7ryY6xgS6gfK8msXpmd/tqCAS3++NoqZ7f2cAOwJXz6N9yjHsxcv5JsYASyPxKht
# lLwINXevK+1trZrYrYyuB57CsQ8ItB0+VWXRrds7B5lbuFMnQEecN1pC8fQWSphH
# z/dlH/s2g5MFeAhrj3jjPKHhXn16G1T43Oo4WQ2JFayvODnPiON+bCDm7JkghxcX
# SVtQZeP2mBFIi67FQBmP2hs=
# SIG # End signature block