From 8117afa67836f7fccb0407d20d98ae7d3ff10815 Mon Sep 17 00:00:00 2001 From: Brenda Rearden Date: Mon, 12 Oct 2020 17:19:32 -0700 Subject: [PATCH 1/6] Add migration details, add more details about kiali requirements --- content/rancher/v2.x/en/istio/_index.md | 6 +++++- content/rancher/v2.x/en/istio/setup/view-traffic/_index.md | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md index a39d487a3ce..a6fb3bd4b9b 100644 --- a/content/rancher/v2.x/en/istio/_index.md +++ b/content/rancher/v2.x/en/istio/_index.md @@ -56,7 +56,11 @@ To remove Istio components from a cluster, namespace, or workload, refer to the # Migrate From Previous Istio Version -There is no upgrade path for Istio versions less than 1.7 +There is no upgrade path for Istio versions less than 1.7.x. To successfully install Istio in the **Cluster Explorer**, you will need to disable your existing Istio in the **Cluster Manager**. + +If you have a significant amount of additional Istio CRDs you might consider manually migrating CRDs that are supported in both versions of Istio. You can do this by running `kubectl get -n istio-system -o yaml`, save the output yaml and re-apply in the new version. + +Another option is to manually uninstall istio resources one at a time, but leave the resources that are supported in both versions of Istio and that will not be installed by the newest version. This method is more likely to result in issues installing the new version, but could be a good option depending on your situation. # Accessing Visualizations diff --git a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md index e0aad92e277..163b716f0d2 100644 --- a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md +++ b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md @@ -11,7 +11,7 @@ This section describes how to view the traffic that is being managed by Istio. The Istio overpage provides a link to the Kiali dashboard. From the Kiali dashboard, you are able to view graphs for each namespace. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other. ->**Prerequisite:** To enable traffic to show up in the graph, ensure you have enabled one of the [Selectors & Scrape Configs]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs)options. If you do not have this configured, you will not see information on the graph. +>**Prerequisite:** To enable traffic to show up in the graph, ensure you have prometheus installed in the cluster. Rancher-istio installs Kiali configured by default to work with the rancher-monitoring chart. You can use rancher-monitoring or install your own monitoring solution. Optional: you can change configuration on how data scraping occurs by setting the [Selectors & Scrape Configs]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs) options. To see the traffic graph, From cb10d5428a778ba02641c96da7a004dd2bca453f Mon Sep 17 00:00:00 2001 From: catherineluse Date: Tue, 13 Oct 2020 15:39:05 -0700 Subject: [PATCH 2/6] Restructure Rancher v2.5 feature docs --- content/rancher/v2.x/en/backups/_index.md | 118 +-------- .../rancher/v2.x/en/backups/legacy/_index.md | 22 -- .../v2.x/en/backups/legacy/restore/_index.md | 12 - .../restorations/ha-restoration/_index.md | 135 ---------- .../v2.x/en/backups/v2.0.x-v2.4.x/_index.md | 14 + .../backup/_index.md | 10 +- .../backup}/docker-backups/_index.md | 0 .../backup/k3s-backups/_index.md | 1 + .../backup/rke-backups}/_index.md | 1 + .../backups/v2.0.x-v2.4.x/restore/_index.md | 14 + .../restore}/docker-restores/_index.md | 0 .../restore/k3s-restore/_index.md | 1 + .../restore/rke-restore/_index.md | 1 + .../rancher/v2.x/en/backups/v2.5/_index.md | 123 +++++++++ .../{ => v2.5}/back-up-rancher/_index.md | 2 + .../{ => v2.5}/configuration/_index.md | 2 + .../configuration/backup-config/_index.md | 2 + .../configuration/restore-config/_index.md | 2 + .../configuration/storage-config/_index.md | 2 + .../{ => v2.5}/docker-installs/_index.md | 0 .../docker-installs/docker-backups/_index.md | 76 ++++++ .../docker-installs/docker-restores/_index.md | 72 ++++++ .../en/backups/{ => v2.5}/examples/_index.md | 2 + .../{ => v2.5}/migrating-rancher/_index.md | 2 + .../{ => v2.5}/restoring-rancher/_index.md | 6 +- content/rancher/v2.x/en/cis-scans/_index.md | 229 +---------------- .../en/cis-scans/{legacy => v2.4}/_index.md | 9 +- .../{legacy => v2.4}/skipped-tests/_index.md | 2 + .../rancher/v2.x/en/cis-scans/v2.5/_index.md | 236 +++++++++++++++++ .../{ => v2.5}/configuration/_index.md | 2 + .../en/cis-scans/{ => v2.5}/rbac/_index.md | 2 + .../{ => v2.5}/skipped-tests/_index.md | 2 + .../v2.x/en/cluster-admin/tools/_index.md | 38 ++- .../en/deploy-across-clusters/fleet/_index.md | 2 +- .../multi-cluster-apps/_index.md | 6 +- .../en/helm-charts/apps-marketplace/_index.md | 1 + .../en/helm-charts/legacy-catalogs/_index.md | 6 +- content/rancher/v2.x/en/istio/_index.md | 92 +------ .../istio/{legacy => v2.3.x-v2.4.x}/_index.md | 6 +- .../disabling-istio/_index.md | 1 + .../{legacy => v2.3.x-v2.4.x}/rbac/_index.md | 1 + .../release-notes/_index.md | 1 + .../resources/_index.md | 1 + .../{legacy => v2.3.x-v2.4.x}/setup/_index.md | 1 + .../setup/deploy-workloads/_index.md | 1 + .../setup/enable-istio-in-cluster/_index.md | 1 + .../enable-istio-with-psp/_index.md | 1 + .../setup/enable-istio-in-namespace/_index.md | 1 + .../setup/gateway/_index.md | 1 + .../setup/node-selectors/_index.md | 1 + .../setup/set-up-traffic-management/_index.md | 1 + .../setup/view-traffic/_index.md | 1 + content/rancher/v2.x/en/istio/v2.5/_index.md | 101 ++++++++ .../{ => v2.5}/disabling-istio/_index.md | 3 +- .../v2.x/en/istio/{ => v2.5}/rbac/_index.md | 3 +- .../istio/{ => v2.5}/release-notes/_index.md | 3 +- .../en/istio/{ => v2.5}/resources/_index.md | 1 + .../v2.x/en/istio/{ => v2.5}/setup/_index.md | 0 .../setup/deploy-workloads/_index.md | 5 +- .../setup/enable-istio-in-cluster/_index.md | 34 +-- .../setup/enable-istio-in-namespace/_index.md | 1 + .../istio/{ => v2.5}/setup/gateway/_index.md | 1 + .../setup/set-up-traffic-management/_index.md | 1 + .../{ => v2.5}/setup/view-traffic/_index.md | 1 + .../rancher/v2.x/en/k8s-in-rancher/_index.md | 2 +- content/rancher/v2.x/en/logging/_index.md | 235 +---------------- .../rancher/v2.x/en/logging/legacy/_index.md | 7 - .../v2.x/en/logging/v2.0.x-v2.4.x/_index.md | 11 + .../cluster-logging/_index.md | 6 +- .../cluster-logging/elasticsearch/_index.md | 1 + .../cluster-logging/fluentd/_index.md | 1 + .../cluster-logging/kafka/_index.md | 1 + .../cluster-logging/splunk/_index.md | 1 + .../cluster-logging/syslog/_index.md | 1 + .../project-logging/_index.md | 4 +- .../rancher/v2.x/en/logging/v2.5/_index.md | 239 ++++++++++++++++++ content/rancher/v2.x/en/longhorn/_index.md | 4 +- .../v2.x/en/monitoring-alerting/_index.md | 183 +------------- .../en/monitoring-alerting/legacy/_index.md | 7 - .../legacy/monitoring/_index.md | 4 - .../v2.0.x-v2.4.x/_index.md | 15 ++ .../cluster-alerts/_index.md | 3 +- .../cluster-alerts/default-alerts/_index.md | 3 +- .../cluster-alerts}/project-alerts/_index.md | 3 +- .../cluster-monitoring/_index.md | 6 +- .../cluster-metrics/_index.md | 1 + .../custom-metrics/_index.md | 3 +- .../cluster-monitoring/expression/_index.md | 3 +- .../project-monitoring/_index.md | 5 +- .../cluster-monitoring/prometheus/_index.md | 3 +- .../viewing-metrics/_index.md | 5 +- .../notifiers/_index.md | 6 +- .../en/monitoring-alerting/v2.5/_index.md | 189 ++++++++++++++ .../{ => v2.5}/configuration/_index.md | 2 + .../{ => v2.5}/migrating/_index.md | 2 + .../{ => v2.5}/rbac/_index.md | 1 + 96 files changed, 1279 insertions(+), 1098 deletions(-) delete mode 100644 content/rancher/v2.x/en/backups/legacy/_index.md delete mode 100644 content/rancher/v2.x/en/backups/legacy/restore/_index.md delete mode 100644 content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md create mode 100644 content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md rename content/rancher/v2.x/en/backups/{legacy => v2.0.x-v2.4.x}/backup/_index.md (55%) rename content/rancher/v2.x/en/backups/{docker-installs => v2.0.x-v2.4.x/backup}/docker-backups/_index.md (100%) rename content/rancher/v2.x/en/backups/{legacy => v2.0.x-v2.4.x}/backup/k3s-backups/_index.md (96%) rename content/rancher/v2.x/en/backups/{legacy/backup/ha-backups => v2.0.x-v2.4.x/backup/rke-backups}/_index.md (99%) create mode 100644 content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/_index.md rename content/rancher/v2.x/en/backups/{docker-installs => v2.0.x-v2.4.x/restore}/docker-restores/_index.md (100%) rename content/rancher/v2.x/en/backups/{legacy => v2.0.x-v2.4.x}/restore/k3s-restore/_index.md (95%) rename content/rancher/v2.x/en/backups/{legacy => v2.0.x-v2.4.x}/restore/rke-restore/_index.md (99%) create mode 100644 content/rancher/v2.x/en/backups/v2.5/_index.md rename content/rancher/v2.x/en/backups/{ => v2.5}/back-up-rancher/_index.md (98%) rename content/rancher/v2.x/en/backups/{ => v2.5}/configuration/_index.md (84%) rename content/rancher/v2.x/en/backups/{ => v2.5}/configuration/backup-config/_index.md (99%) rename content/rancher/v2.x/en/backups/{ => v2.5}/configuration/restore-config/_index.md (98%) rename content/rancher/v2.x/en/backups/{ => v2.5}/configuration/storage-config/_index.md (98%) rename content/rancher/v2.x/en/backups/{ => v2.5}/docker-installs/_index.md (100%) create mode 100644 content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-backups/_index.md create mode 100644 content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-restores/_index.md rename content/rancher/v2.x/en/backups/{ => v2.5}/examples/_index.md (99%) rename content/rancher/v2.x/en/backups/{ => v2.5}/migrating-rancher/_index.md (98%) rename content/rancher/v2.x/en/backups/{ => v2.5}/restoring-rancher/_index.md (78%) rename content/rancher/v2.x/en/cis-scans/{legacy => v2.4}/_index.md (98%) rename content/rancher/v2.x/en/cis-scans/{legacy => v2.4}/skipped-tests/_index.md (99%) create mode 100644 content/rancher/v2.x/en/cis-scans/v2.5/_index.md rename content/rancher/v2.x/en/cis-scans/{ => v2.5}/configuration/_index.md (98%) rename content/rancher/v2.x/en/cis-scans/{ => v2.5}/rbac/_index.md (98%) rename content/rancher/v2.x/en/cis-scans/{ => v2.5}/skipped-tests/_index.md (99%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/_index.md (98%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/disabling-istio/_index.md (96%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/rbac/_index.md (98%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/release-notes/_index.md (96%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/resources/_index.md (99%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/_index.md (98%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/deploy-workloads/_index.md (99%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/enable-istio-in-cluster/_index.md (96%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md (96%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/enable-istio-in-namespace/_index.md (97%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/gateway/_index.md (99%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/node-selectors/_index.md (97%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/set-up-traffic-management/_index.md (97%) rename content/rancher/v2.x/en/istio/{legacy => v2.3.x-v2.4.x}/setup/view-traffic/_index.md (96%) create mode 100644 content/rancher/v2.x/en/istio/v2.5/_index.md rename content/rancher/v2.x/en/istio/{ => v2.5}/disabling-istio/_index.md (96%) rename content/rancher/v2.x/en/istio/{ => v2.5}/rbac/_index.md (93%) rename content/rancher/v2.x/en/istio/{ => v2.5}/release-notes/_index.md (95%) rename content/rancher/v2.x/en/istio/{ => v2.5}/resources/_index.md (98%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/_index.md (100%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/deploy-workloads/_index.md (98%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/enable-istio-in-cluster/_index.md (89%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/enable-istio-in-namespace/_index.md (97%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/gateway/_index.md (99%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/set-up-traffic-management/_index.md (98%) rename content/rancher/v2.x/en/istio/{ => v2.5}/setup/view-traffic/_index.md (97%) delete mode 100644 content/rancher/v2.x/en/logging/legacy/_index.md create mode 100644 content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/_index.md (97%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/elasticsearch/_index.md (97%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/fluentd/_index.md (96%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/kafka/_index.md (97%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/splunk/_index.md (98%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/cluster-logging/syslog/_index.md (97%) rename content/rancher/v2.x/en/logging/{legacy => v2.0.x-v2.4.x}/project-logging/_index.md (97%) create mode 100644 content/rancher/v2.x/en/logging/v2.5/_index.md delete mode 100644 content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md delete mode 100644 content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md create mode 100644 content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md rename content/rancher/v2.x/en/monitoring-alerting/{legacy/alerts => v2.0.x-v2.4.x}/cluster-alerts/_index.md (99%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/alerts => v2.0.x-v2.4.x}/cluster-alerts/default-alerts/_index.md (96%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/alerts => v2.0.x-v2.4.x/cluster-alerts}/project-alerts/_index.md (98%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/_index.md (97%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/cluster-metrics/_index.md (98%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/custom-metrics/_index.md (99%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/expression/_index.md (99%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x/cluster-monitoring}/project-monitoring/_index.md (97%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/prometheus/_index.md (97%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy/monitoring => v2.0.x-v2.4.x}/cluster-monitoring/viewing-metrics/_index.md (96%) rename content/rancher/v2.x/en/monitoring-alerting/{legacy => v2.0.x-v2.4.x}/notifiers/_index.md (98%) create mode 100644 content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md rename content/rancher/v2.x/en/monitoring-alerting/{ => v2.5}/configuration/_index.md (99%) rename content/rancher/v2.x/en/monitoring-alerting/{ => v2.5}/migrating/_index.md (98%) rename content/rancher/v2.x/en/monitoring-alerting/{ => v2.5}/rbac/_index.md (99%) diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md index 9179179bdfc..0f855ff2540 100644 --- a/content/rancher/v2.x/en/backups/_index.md +++ b/content/rancher/v2.x/en/backups/_index.md @@ -3,120 +3,6 @@ title: Backups and Disaster Recovery weight: 5 --- -In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new Kubernetes cluster. +If you are using Rancher v2.5, refer to [this section.](./v2.5) -As of Rancher v2.5, the `rancher-backup` operator is used to backup and restore Rancher. The `rancher-backup` Helm chart is [here.](https://github.com/rancher/charts/tree/main/charts/rancher-backup) - -The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. - -The Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher. - -- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) - - [Backup and Restore for Rancher v2.5 installed with Docker](#backup-and-restore-for-rancher-v2-5-installed-with-docker) - - [Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5](#backup-and-restore-for-rancher-installed-on-a-kubernetes-cluster-prior-to-v2-5) -- [How Backups and Restores Work](#how-backups-and-restores-work) -- [Installing the rancher-backup Operator](#installing-the-rancher-backup-operator) - - [Installing rancher-backup with the Rancher UI](#installing-rancher-backup-with-the-rancher-ui) - - [Installing rancher-backup with the Helm CLI](#installing-rancher-backup-with-the-helm-cli) -- [Backing up Rancher](#backing-up-rancher) -- [Restoring Rancher](#restoring-rancher) -- [Migrating Rancher to a New Cluster](#migrating-rancher-to-a-new-cluster) -- [Default Storage Location Configuration](#default-storage-location-configuration) - - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart) - -# Changes in Rancher v2.5 - -The new `rancher-backup` operator allows Rancher to be backed up and restored on any Kubernetes cluster. This application is a Helm chart, and it can be deployed through the Rancher **Apps & Marketplace** page, or by using the Helm CLI. - -Previously, the way that cluster data was backed up depended on the type of Kubernetes cluster that was used. - -In Rancher v2.4, it was only supported to install Rancher on two types of Kubernetes clusters: an RKE cluster, or a K3s cluster with an external database. If Rancher was installed on an RKE cluster, RKE would be used to take a snapshot of the etcd database and restore the cluster. If Rancher was installed on a K3s cluster with an external database, the database would need to be backed up and restored using the upstream documentation for the database. - -In Rancher v2.5, it is now supported to install Rancher hosted Kubernetes clusters, such as Amazon EKS clusters, which do not expose etcd to a degree that would allow snapshots to be created by an external tool. etcd doesn't need to be exposed for `rancher-backup` to work, because the operator gathers resources by making calls to `kube-apiserver`. - -### Backup and Restore for Rancher v2.5 installed with Docker - -For Rancher installed with Docker, refer to the same steps used up till 2.5 for [backups](./docker-installs/docker-backups) and [restores.](./docker-installs/docker-backups) - -### Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5 - -For Rancher prior to v2.5, the way that Rancher is backed up and restored differs based on the way that Rancher was installed. Our legacy backup and restore documentation is here: - -- For Rancher installed on an RKE Kubernetes cluster, refer to the legacy [backup]({{}}/rancher/v2.x/en/backups/legacy/backup/ha-backups) and [restore]({{}}/rancher/v2.x/en/backups/legacy/restore/rke-restore) documentation. -- For Rancher installed on a K3s Kubernetes cluster, refer to the legacy [backup]({{}}/rancher/v2.x/en/backups/legacy/backup/k3s-backups) and [restore]({{}}/rancher/v2.x/en/backups/legacy/restore/k3s-restore) documentation. - -# How Backups and Restores Work - -The `rancher-backup` operator introduces three custom resources: Backups, Restores, and ResourceSets. The following cluster-scoped custom resource definitions are added to the cluster: - -- `backups.resources.cattle.io` -- `resourcesets.resources.cattle.io` -- `restores.resources.cattle.io` - -The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined. This ResourceSet should not be modified. - -When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet (specifically, the predefined `rancher-resource-set`) that the Backup custom resource refers to. - -The operator then creates the backup file in the .tar.gz format and stores it in the location configured in the Backup resource. - -When a Restore custom resource is created, the operator accesses the backup .tar.gz file specified by the Restore, and restores the application from that file. - -The Backup and Restore custom resources can be created in the Rancher UI, or by using `kubectl apply`. - -# Installing the rancher-backup Operator - -The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the local cluster. - -### Installing rancher-backup with the Rancher UI - -1. In the Rancher UI, go to the **Cluster Explorer.** -1. Click **Apps.** -1. Click the `rancher-backup` operator. -1. Optional: Configure the default storage location. For help, refer to the [configuration section.](./configuration/storage-config) - -**Result:** The `rancher-backup` operator is installed. - -From the **Cluster Explorer,** you can see the `rancher-backup` operator listed under **Deployments.** - -To configure the backup app in Rancher, click **Cluster Explorer** in the upper left corner and click **Rancher Backups.** - -### Installing rancher-backup with the Helm CLI - -Install the backup app as a Helm chart: - -``` -helm repo add rancher-charts https://charts.rancher.io -helm repo update -helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace -helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system -``` - -### RBAC - -Only the rancher admins, and local cluster’s cluster-owner can: - -* Install the Chart -* See the navigation links for Backup and Restore CRDs -* Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far - -# Backing up Rancher - -A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](./back-up-rancher) - -# Restoring Rancher - -A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](./restoring-rancher) - -# Migrating Rancher to a New Cluster - -A migration is performed by following [these steps.](./migrating-rancher) - -# Default Storage Location Configuration - -Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible or Minio object store. - -For information on configuring these options, refer to [this page.](./configuration/storage-config) - -### Example values.yaml for the rancher-backup Helm Chart - -The example [values.yaml file](./configuration/storage-config/#example-values-yaml-for-the-rancher-backup-helm-chart) can be used to configure the `rancher-backup` operator when the Helm CLI is used to install it. +If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/backups/legacy/_index.md b/content/rancher/v2.x/en/backups/legacy/_index.md deleted file mode 100644 index c2e3485acd0..00000000000 --- a/content/rancher/v2.x/en/backups/legacy/_index.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Backup and Restore for Rancher 2.4.x and Below -weight: 6 ---- - -> In Rancher v2.5, the `rancher-backup` operator is used to back up and restore Rancher. This section preserves the older documentation for backups and restores in Rancher v2.0.x-v2.4.x. - -This section is devoted to protecting your data in a disaster scenario. - -To protect yourself from a disaster scenario, you should create backups on a regular basis. - - - Rancher server backups: - - [Rancher installed on a K3s Kubernetes cluster](./backups/k3s-backups) - - [Rancher installed on an RKE Kubernetes cluster](./backups/ha-backups) - - [Backing up Rancher Launched Kubernetes Clusters]({{}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) - -In a disaster scenario, you can restore your `etcd` database by restoring a backup. - - - [Rancher Server Restorations]({{}}/rancher/v2.x/en/backups/restorations) - - [Restoring Rancher Launched Kubernetes Clusters]({{}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) - -For Rancher installed with Docker, the backup and restore procedure is the same in Rancher v2.5. The backup and restore instructions for Docker installs are [here.]({{}}/rancher/v2.x/en/backups/docker-installs) \ No newline at end of file diff --git a/content/rancher/v2.x/en/backups/legacy/restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/_index.md deleted file mode 100644 index 9acfbf7ad73..00000000000 --- a/content/rancher/v2.x/en/backups/legacy/restore/_index.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: Restore -weight: 1010 -aliases: - - /rancher/v2.x/en/backups/restorations ---- -If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location. - -- [Restoring Backups—Docker Installs]({{}}/rancher/v2.x/en/backups/docker-installs/docker-restores) -- [Restoring Backups—Kubernetes installs]({{}}/rancher/v2.x/en/backups/restorations/ha-restoration/) - -If you are looking to restore your [Rancher launched Kubernetes cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), please refer [here]({{}}/rancher/v2.x/en/cluster-admin/restoring-etcd/). diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md deleted file mode 100644 index cba496f6963..00000000000 --- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Restoring Backups—Kubernetes installs -shortTitle: Kubernetes Installs -weight: 370 -aliases: - - /rancher/v2.x/en/installation/after-installation/ha-backup-and-restoration/ - - /rancher/v2.x/en/installation/backups/restores ---- - -This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. -This will restore the Kubernetes configuration and the Rancher database and state. - -> **Note:** This document covers clusters set up with RKE >= v0.2.x, for older RKE versions refer to the [RKE Documentation]({{}}/rke/latest/en/etcd-snapshots/restoring-from-backup). - -## Restore Outline - - - -- [1. Preparation](#1-preparation) -- [2. Place Snapshot](#2-place-snapshot) -- [3. Configure RKE](#3-configure-rke) -- [4. Restore the Database and bring up the Cluster](#4-restore-the-database-and-bring-up-the-cluster) - - - -### 1. Preparation - -It is advised that you run the restore from your local host or a jump box/bastion where your cluster yaml, rke statefile, and kubeconfig are stored. You will need [RKE]({{}}/rke/latest/en/installation/) and [kubectl]({{}}/rancher/v2.x/en/faq/kubectl/) CLI utilities installed locally. - -Prepare by creating 3 new nodes to be the target for the restored Rancher instance. We recommend that you start with fresh nodes and a clean state. For clarification on the requirements, review the [Installation Requirements](https://rancher.com/docs/rancher/v2.x/en/installation/requirements/). - -Alternatively you can re-use the existing nodes after clearing Kubernetes and Rancher configurations. This will destroy the data on these nodes. See [Node Cleanup]({{}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) for the procedure. - -> **IMPORTANT:** Before starting the restore make sure all the Kubernetes services on the old cluster nodes are stopped. We recommend powering off the nodes to be sure. - -### 2. Place Snapshot - -As of RKE v0.2.0, snapshots could be saved in an S3 compatible backend. To restore your cluster from the snapshot stored in S3 compatible backend, you can skip this step and retrieve the snapshot in [4. Restore the Database and bring up the Cluster](#4-restore-the-database-and-bring-up-the-cluster). Otherwise, you will need to place the snapshot directly on one of the etcd nodes. - -Pick one of the clean nodes that will have the etcd role assigned and place the zip-compressed snapshot file in `/opt/rke/etcd-snapshots` on that node. - -> **Note:** Because of a current limitation in RKE, the restore process does not work correctly if `/opt/rke/etcd-snapshots` is a NFS share that is mounted on all nodes with the etcd role. The easiest options are to either keep `/opt/rke/etcd-snapshots` as a local folder during the restore process and only mount the NFS share there after it has been completed, or to only mount the NFS share to one node with an etcd role in the beginning. - -### 3. Configure RKE - -Use your original `rancher-cluster.yml` and `rancher-cluster.rkestate` files. If they are not stored in a version control system, it is a good idea to back them up before making any changes. - -``` -cp rancher-cluster.yml rancher-cluster.yml.bak -cp rancher-cluster.rkestate rancher-cluster.rkestate.bak -``` - -If the replaced or cleaned nodes have been configured with new IP addresses, modify the `rancher-cluster.yml` file to ensure the address and optional internal_address fields reflect the new addresses. - -> **IMPORTANT:** You should not rename the `rancher-cluster.yml` or `rancher-cluster.rkestate` files. It is important that the filenames match each other. - -### 4. Restore the Database and bring up the Cluster - -You will now use the RKE command-line tool with the `rancher-cluster.yml` and the `rancher-cluster.rkestate` configuration files to restore the etcd database and bring up the cluster on the new nodes. - -> **Note:** Ensure your `rancher-cluster.rkestate` is present in the same directory as the `rancher-cluster.yml` file before starting the restore, as this file contains the certificate data for the cluster. - -#### Restoring from a Local Snapshot - -When restoring etcd from a local snapshot, the snapshot is assumed to be located on the target node in the directory `/opt/rke/etcd-snapshots`. - -``` -rke etcd snapshot-restore --name snapshot-name --config ./rancher-cluster.yml -``` - -> **Note:** The --name parameter expects the filename of the snapshot without the extension. - -#### Restoring from a Snapshot in S3 - -_Available as of RKE v0.2.0_ - -When restoring etcd from a snapshot located in an S3 compatible backend, the command needs the S3 information in order to connect to the S3 backend and retrieve the snapshot. - -``` -$ rke etcd snapshot-restore --config ./rancher-cluster.yml --name snapshot-name \ ---s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \ ---bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com \ ---folder folder-name # Available as of v2.3.0 -``` - -#### Options for `rke etcd snapshot-restore` - -S3 specific options are only available for RKE v0.2.0+. - -| Option | Description | S3 Specific | -| --- | --- | ---| -| `--name` value | Specify snapshot name | | -| `--config` value | Specify an alternate cluster YAML file (default: "cluster.yml") [$RKE_CONFIG] | | -| `--s3` | Enabled backup to s3 |* | -| `--s3-endpoint` value | Specify s3 endpoint url (default: "s3.amazonaws.com") | * | -| `--access-key` value | Specify s3 accessKey | *| -| `--secret-key` value | Specify s3 secretKey | *| -| `--bucket-name` value | Specify s3 bucket name | *| -| `--folder` value | Specify s3 folder in the bucket name _Available as of v2.3.0_ | *| -| `--region` value | Specify the s3 bucket location (optional) | *| -| `--ssh-agent-auth` | [Use SSH Agent Auth defined by SSH_AUTH_SOCK]({{}}/rke/latest/en/config-options/#ssh-agent) | | -| `--ignore-docker-version` | [Disable Docker version check]({{}}/rke/latest/en/config-options/#supported-docker-versions) | - -#### Testing the Cluster - -Once RKE completes it will have created a credentials file in the local directory. Configure `kubectl` to use the `kube_config_rancher-cluster.yml` credentials file and check on the state of the cluster. See [Installing and Configuring kubectl]({{}}/rancher/v2.x/en/faq/kubectl/#configuration) for details. - -#### Check Kubernetes Pods - -Wait for the pods running in `kube-system`, `ingress-nginx` and the `rancher` pod in `cattle-system` to return to the `Running` state. - -> **Note:** `cattle-cluster-agent` and `cattle-node-agent` pods will be in an `Error` or `CrashLoopBackOff` state until Rancher server is up and the DNS/Load Balancer have been pointed at the new cluster. - -``` -kubectl get pods --all-namespaces - -NAMESPACE NAME READY STATUS RESTARTS AGE -cattle-system cattle-cluster-agent-766585f6b-kj88m 0/1 Error 6 4m -cattle-system cattle-node-agent-wvhqm 0/1 Error 8 8m -cattle-system rancher-78947c8548-jzlsr 0/1 Running 1 4m -ingress-nginx default-http-backend-797c5bc547-f5ztd 1/1 Running 1 4m -ingress-nginx nginx-ingress-controller-ljvkf 1/1 Running 1 8m -kube-system canal-4pf9v 3/3 Running 3 8m -kube-system cert-manager-6b47fc5fc-jnrl5 1/1 Running 1 4m -kube-system kube-dns-7588d5b5f5-kgskt 3/3 Running 3 4m -kube-system kube-dns-autoscaler-5db9bbb766-s698d 1/1 Running 1 4m -kube-system metrics-server-97bc649d5-6w7zc 1/1 Running 1 4m -kube-system tiller-deploy-56c4cf647b-j4whh 1/1 Running 1 4m -``` - -#### Finishing Up - -Rancher should now be running and available to manage your Kubernetes clusters. Review the [recommended architecture]({{}}/rancher/v2.x/en/installation/k8s-install/#recommended-architecture) for Kubernetes installations and update the endpoints for Rancher DNS or the Load Balancer that you built during Step 1 of the Kubernetes install ([1. Create Nodes and Load Balancer]({{}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/#load-balancer)) to target the new cluster. Once the endpoints are updated, the agents on your managed clusters should automatically reconnect. This may take 10-15 minutes due to reconnect back off timeouts. - -> **IMPORTANT:** Remember to save your updated RKE config (`rancher-cluster.yml`) state file (`rancher-cluster.rkestate`) and `kubectl` credentials (`kube_config_rancher-cluster.yml`) files in a safe place for future maintenance for example in a version control system. diff --git a/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md new file mode 100644 index 00000000000..8c0011fae6c --- /dev/null +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md @@ -0,0 +1,14 @@ +--- +title: Rancher v2.0.x-v2.4.x +weight: 2 +--- + +> In Rancher v2.5, the `rancher-backup` operator is used to back up and restore Rancher. This section preserves the older documentation for backups and restores in Rancher v2.0.x-v2.4.x. + +This section is devoted to protecting your data in a disaster scenario. + +To protect yourself from a disaster scenario, you should create backups on a regular basis. + +- [Backup](./backup) +- [Restore](./restore) + diff --git a/content/rancher/v2.x/en/backups/legacy/backup/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/_index.md similarity index 55% rename from content/rancher/v2.x/en/backups/legacy/backup/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/_index.md index 2bad5e462b6..defb1735c65 100644 --- a/content/rancher/v2.x/en/backups/legacy/backup/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/_index.md @@ -5,11 +5,15 @@ aliases: - /rancher/v2.x/en/installation/after-installation/ - /rancher/v2.x/en/backups/ - /rancher/v2.x/en/backups/backups + - /rancher/v2.x/en/backups/legacy/backup --- This section contains information about how to create backups of your Rancher data and how to restore them in a disaster scenario. -- [Backing up Rancher installed on a K3s Kubernetes cluster](./k3s-backups) -- [Backing up Rancher installed on an RKE Kubernetes cluster](./ha-backups/) -- [Backing up Rancher installed with Docker]({{}}/rancher/v2.x/en/backups/docker-installs/docker-backups) + - Rancher server backups: + - [Rancher installed on a K3s Kubernetes cluster](./k3s-backups) + - [Rancher installed on an RKE Kubernetes cluster](./rke-backups) + - [Rancher installed with Docker](./docker-backups) + +For information on backing up Rancher launched Kubernetes clusters, refer to [this section.]({{}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) If you are looking to back up your [Rancher launched Kubernetes cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), please refer [here]({{}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/). diff --git a/content/rancher/v2.x/en/backups/docker-installs/docker-backups/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/docker-backups/_index.md similarity index 100% rename from content/rancher/v2.x/en/backups/docker-installs/docker-backups/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/docker-backups/_index.md diff --git a/content/rancher/v2.x/en/backups/legacy/backup/k3s-backups/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/k3s-backups/_index.md similarity index 96% rename from content/rancher/v2.x/en/backups/legacy/backup/k3s-backups/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/k3s-backups/_index.md index 45f946fec3a..612ea492291 100644 --- a/content/rancher/v2.x/en/backups/legacy/backup/k3s-backups/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/k3s-backups/_index.md @@ -7,6 +7,7 @@ aliases: - /rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups - /rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/ - /rancher/v2.x/en/backups/legacy/backups/k3s-backups + - /rancher/v2.x/en/backups/legacy/backup/k3s-backups --- When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data. diff --git a/content/rancher/v2.x/en/backups/legacy/backup/ha-backups/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/rke-backups/_index.md similarity index 99% rename from content/rancher/v2.x/en/backups/legacy/backup/ha-backups/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/rke-backups/_index.md index 7b3fd1da2da..f14318ea1d3 100644 --- a/content/rancher/v2.x/en/backups/legacy/backup/ha-backups/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/backup/rke-backups/_index.md @@ -9,6 +9,7 @@ aliases: - /rancher/v2.x/en/backups/backups/k8s-backups/ha-backups - /rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/ - /rancher/v2.x/en/backups/legacy/backups/ha-backups + - /rancher/v2.x/en/backups/legacy/backup/ha-backups --- This section describes how to create backups of your high-availability Rancher install. diff --git a/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/_index.md new file mode 100644 index 00000000000..515d0e777c7 --- /dev/null +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/_index.md @@ -0,0 +1,14 @@ +--- +title: Restore +weight: 1010 +aliases: + - /rancher/v2.x/en/backups/restorations + - /rancher/v2.x/en/backups/legacy/restore +--- +If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location. + +- [Restoring backups for Rancher installed with Docker](./docker-restores) +- [Restoring backups for Rancher installed on an RKE Kubernetes cluster](./rke-restore) +- [Restoring backups for Rancher installed on a K3s Kubernetes cluster](./k3s-restore) + +If you are looking to restore your [Rancher launched Kubernetes cluster]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), please refer to [this section]({{}}/rancher/v2.x/en/cluster-admin/restoring-etcd/). diff --git a/content/rancher/v2.x/en/backups/docker-installs/docker-restores/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/docker-restores/_index.md similarity index 100% rename from content/rancher/v2.x/en/backups/docker-installs/docker-restores/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/docker-restores/_index.md diff --git a/content/rancher/v2.x/en/backups/legacy/restore/k3s-restore/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/k3s-restore/_index.md similarity index 95% rename from content/rancher/v2.x/en/backups/legacy/restore/k3s-restore/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/k3s-restore/_index.md index 34c4e54a1c3..715836e61e1 100644 --- a/content/rancher/v2.x/en/backups/legacy/restore/k3s-restore/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/k3s-restore/_index.md @@ -6,6 +6,7 @@ aliases: - /rancher/v2.x/en/backups/restorations/k3s-restoration - /rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore - /rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/ + - /rancher/v2.x/en/backups/legacy/restore/k3s-restore --- When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data. diff --git a/content/rancher/v2.x/en/backups/legacy/restore/rke-restore/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/rke-restore/_index.md similarity index 99% rename from content/rancher/v2.x/en/backups/legacy/restore/rke-restore/_index.md rename to content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/rke-restore/_index.md index 4b15565cf35..122006cfef6 100644 --- a/content/rancher/v2.x/en/backups/legacy/restore/rke-restore/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/restore/rke-restore/_index.md @@ -7,6 +7,7 @@ aliases: - /rancher/v2.x/en/backups/restorations/ha-restoration - /rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore - /rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/ + - /rancher/v2.x/en/backups/legacy/restore/rke-restore --- This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. diff --git a/content/rancher/v2.x/en/backups/v2.5/_index.md b/content/rancher/v2.x/en/backups/v2.5/_index.md new file mode 100644 index 00000000000..4a10f006a37 --- /dev/null +++ b/content/rancher/v2.x/en/backups/v2.5/_index.md @@ -0,0 +1,123 @@ +--- +title: Backup and Restore in Rancher v2.5 +shortTitle: Rancher v2.5 +weight: 1 +--- + +In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new Kubernetes cluster. + +As of Rancher v2.5, the `rancher-backup` operator is used to backup and restore Rancher. The `rancher-backup` Helm chart is [here.](https://github.com/rancher/charts/tree/main/charts/rancher-backup) + +The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster. + +The Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher. + +- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) + - [Backup and Restore for Rancher v2.5 installed with Docker](#backup-and-restore-for-rancher-v2-5-installed-with-docker) + - [Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5](#backup-and-restore-for-rancher-installed-on-a-kubernetes-cluster-prior-to-v2-5) +- [How Backups and Restores Work](#how-backups-and-restores-work) +- [Installing the rancher-backup Operator](#installing-the-rancher-backup-operator) + - [Installing rancher-backup with the Rancher UI](#installing-rancher-backup-with-the-rancher-ui) + - [Installing rancher-backup with the Helm CLI](#installing-rancher-backup-with-the-helm-cli) +- [Backing up Rancher](#backing-up-rancher) +- [Restoring Rancher](#restoring-rancher) +- [Migrating Rancher to a New Cluster](#migrating-rancher-to-a-new-cluster) +- [Default Storage Location Configuration](#default-storage-location-configuration) + - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart) + +# Changes in Rancher v2.5 + +The new `rancher-backup` operator allows Rancher to be backed up and restored on any Kubernetes cluster. This application is a Helm chart, and it can be deployed through the Rancher **Apps & Marketplace** page, or by using the Helm CLI. + +Previously, the way that cluster data was backed up depended on the type of Kubernetes cluster that was used. + +In Rancher v2.4, it was only supported to install Rancher on two types of Kubernetes clusters: an RKE cluster, or a K3s cluster with an external database. If Rancher was installed on an RKE cluster, RKE would be used to take a snapshot of the etcd database and restore the cluster. If Rancher was installed on a K3s cluster with an external database, the database would need to be backed up and restored using the upstream documentation for the database. + +In Rancher v2.5, it is now supported to install Rancher hosted Kubernetes clusters, such as Amazon EKS clusters, which do not expose etcd to a degree that would allow snapshots to be created by an external tool. etcd doesn't need to be exposed for `rancher-backup` to work, because the operator gathers resources by making calls to `kube-apiserver`. + +### Backup and Restore for Rancher v2.5 installed with Docker + +For Rancher installed with Docker, refer to the same steps used up till 2.5 for [backups](./docker-installs/docker-backups) and [restores.](./docker-installs/docker-backups) + +### Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5 + +For Rancher prior to v2.5, the way that Rancher is backed up and restored differs based on the way that Rancher was installed. Our legacy backup and restore documentation is here: + +- For Rancher installed on an RKE Kubernetes cluster, refer to the legacy [backup]({{}}/rancher/v2.x/en/backups/legacy/backup/ha-backups) and [restore]({{}}/rancher/v2.x/en/backups/legacy/restore/rke-restore) documentation. +- For Rancher installed on a K3s Kubernetes cluster, refer to the legacy [backup]({{}}/rancher/v2.x/en/backups/legacy/backup/k3s-backups) and [restore]({{}}/rancher/v2.x/en/backups/legacy/restore/k3s-restore) documentation. + +# How Backups and Restores Work + +The `rancher-backup` operator introduces three custom resources: Backups, Restores, and ResourceSets. The following cluster-scoped custom resource definitions are added to the cluster: + +- `backups.resources.cattle.io` +- `resourcesets.resources.cattle.io` +- `restores.resources.cattle.io` + +The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined. This ResourceSet should not be modified. + +When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet (specifically, the predefined `rancher-resource-set`) that the Backup custom resource refers to. + +The operator then creates the backup file in the .tar.gz format and stores it in the location configured in the Backup resource. + +When a Restore custom resource is created, the operator accesses the backup .tar.gz file specified by the Restore, and restores the application from that file. + +The Backup and Restore custom resources can be created in the Rancher UI, or by using `kubectl apply`. + +# Installing the rancher-backup Operator + +The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the local cluster. + +### Installing rancher-backup with the Rancher UI + +1. In the Rancher UI, go to the **Cluster Explorer.** +1. Click **Apps.** +1. Click the `rancher-backup` operator. +1. Optional: Configure the default storage location. For help, refer to the [configuration section.](./configuration/storage-config) + +**Result:** The `rancher-backup` operator is installed. + +From the **Cluster Explorer,** you can see the `rancher-backup` operator listed under **Deployments.** + +To configure the backup app in Rancher, click **Cluster Explorer** in the upper left corner and click **Rancher Backups.** + +### Installing rancher-backup with the Helm CLI + +Install the backup app as a Helm chart: + +``` +helm repo add rancher-charts https://charts.rancher.io +helm repo update +helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace +helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system +``` + +### RBAC + +Only the rancher admins, and local cluster’s cluster-owner can: + +* Install the Chart +* See the navigation links for Backup and Restore CRDs +* Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far + +# Backing up Rancher + +A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](./back-up-rancher) + +# Restoring Rancher + +A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](./restoring-rancher) + +# Migrating Rancher to a New Cluster + +A migration is performed by following [these steps.](./migrating-rancher) + +# Default Storage Location Configuration + +Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible or Minio object store. + +For information on configuring these options, refer to [this page.](./configuration/storage-config) + +### Example values.yaml for the rancher-backup Helm Chart + +The example [values.yaml file](./configuration/storage-config/#example-values-yaml-for-the-rancher-backup-helm-chart) can be used to configure the `rancher-backup` operator when the Helm CLI is used to install it. diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md similarity index 98% rename from content/rancher/v2.x/en/backups/back-up-rancher/_index.md rename to content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md index 0c9e6e5a119..b513b3947c2 100644 --- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md @@ -1,6 +1,8 @@ --- title: Backing up Rancher weight: 1 +aliases: + - /rancher/v2.x/en/backups/back-up-rancher --- In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups](../legacy/backup/single-node-backups/) diff --git a/content/rancher/v2.x/en/backups/configuration/_index.md b/content/rancher/v2.x/en/backups/v2.5/configuration/_index.md similarity index 84% rename from content/rancher/v2.x/en/backups/configuration/_index.md rename to content/rancher/v2.x/en/backups/v2.5/configuration/_index.md index d83cc04b29f..89b0233845c 100644 --- a/content/rancher/v2.x/en/backups/configuration/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/configuration/_index.md @@ -2,6 +2,8 @@ title: Rancher Backup Configuration Reference shortTitle: Configuration weight: 4 +aliases: + - /rancher/v2.x/en/backups/configuration --- - [Backup configuration](./backup-config) diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/v2.5/configuration/backup-config/_index.md similarity index 99% rename from content/rancher/v2.x/en/backups/configuration/backup-config/_index.md rename to content/rancher/v2.x/en/backups/v2.5/configuration/backup-config/_index.md index adbb9e065f1..0861563cfba 100644 --- a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/configuration/backup-config/_index.md @@ -2,6 +2,8 @@ title: Backup Configuration shortTitle: Backup weight: 1 +aliases: + - /rancher/v2.x/en/backups/configuration/backup-config --- The Backup Create page lets you configure a schedule, enable encryption and specify the storage location for your backups. diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/v2.5/configuration/restore-config/_index.md similarity index 98% rename from content/rancher/v2.x/en/backups/configuration/restore-config/_index.md rename to content/rancher/v2.x/en/backups/v2.5/configuration/restore-config/_index.md index fbd9b1368c2..b53c4952680 100644 --- a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/configuration/restore-config/_index.md @@ -2,6 +2,8 @@ title: Restore Configuration shortTitle: Restore weight: 2 +aliases: + - /rancher/v2.x/en/backups/configuration/restore-config --- The Restore Create page lets you provide details of the backup to restore from diff --git a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md b/content/rancher/v2.x/en/backups/v2.5/configuration/storage-config/_index.md similarity index 98% rename from content/rancher/v2.x/en/backups/configuration/storage-config/_index.md rename to content/rancher/v2.x/en/backups/v2.5/configuration/storage-config/_index.md index 1ebb4259b85..77a7516d946 100644 --- a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/configuration/storage-config/_index.md @@ -2,6 +2,8 @@ title: Backup Storage Location Configuration shortTitle: Storage weight: 3 +aliases: + - /rancher/v2.x/en/backups/configuration/storage-config --- Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store. diff --git a/content/rancher/v2.x/en/backups/docker-installs/_index.md b/content/rancher/v2.x/en/backups/v2.5/docker-installs/_index.md similarity index 100% rename from content/rancher/v2.x/en/backups/docker-installs/_index.md rename to content/rancher/v2.x/en/backups/v2.5/docker-installs/_index.md diff --git a/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-backups/_index.md b/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-backups/_index.md new file mode 100644 index 00000000000..f428719d46c --- /dev/null +++ b/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-backups/_index.md @@ -0,0 +1,76 @@ +--- +title: Backing up Rancher Installed with Docker +shortTitle: Backups +weight: 3 +aliases: + - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/ + - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/ + - /rancher/v2.x/en/backups/backups/single-node-backups/ + - /rancher/v2.x/en/backups/legacy/backup/single-node-backups/ +--- + + +After completing your Docker installation of Rancher, we recommend creating backups of it on a regular basis. Having a recent backup will let you recover quickly from an unexpected disaster. + +## Before You Start + +During the creation of your backup, you'll enter a series of commands, replacing placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (``). Here's an example of a command with a placeholder: + +``` +docker run --volumes-from rancher-data- -v $PWD:/backup busybox tar pzcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher +``` + +In this command, `` is a placeholder for the date that the data container and backup were created. `9-27-18` for example. + +Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#creating-a-backup). + +Terminal `docker ps` Command, Displaying Where to Find `` and `` +![Placeholder Reference]({{}}/img/rancher/placeholder-ref.png) + +| Placeholder | Example | Description | +| -------------------------- | -------------------------- | --------------------------------------------------------- | +| `` | `v2.0.5` | The rancher/rancher image you pulled for initial install. | +| `` | `festive_mestorf` | The name of your Rancher container. | +| `` | `v2.0.5` | The version of Rancher that you're creating a backup for. | +| `` | `9-27-18` | The date that the data container or backup was created. | +
+ +You can obtain `` and `` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped with `docker ps -a`. Use these commands for help anytime while creating backups. + +## Creating a Backup + +This procedure creates a backup that you can restore if Rancher encounters a disaster scenario. + + +1. Using a remote Terminal connection, log into the node running your Rancher Server. + +1. Stop the container currently running Rancher Server. Replace `` with the [name of your Rancher container](#before-you-start). + + ``` + docker stop + ``` +1. Use the command below, replacing each [placeholder](#before-you-start), to create a data container from the Rancher container that you just stopped. + + ``` + docker create --volumes-from --name rancher-data- rancher/rancher: + ``` + +1. From the data container that you just created (`rancher-data-`), create a backup tarball (`rancher-data-backup--.tar.gz`). Use the following command, replacing each [placeholder](#before-you-start). + + ``` + docker run --volumes-from rancher-data- -v $PWD:/backup:z busybox tar pzcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher + ``` + + **Step Result:** A stream of commands runs on the screen. + +1. Enter the `ls` command to confirm that the backup tarball was created. It will have a name similar to `rancher-data-backup--.tar.gz`. + +1. Move your backup tarball to a safe location external to your Rancher Server. Then delete the `rancher-data-` container from your Rancher Server. + +1. Restart Rancher Server. Replace `` with the name of your [Rancher container](#before-you-start). + + ``` + docker start + ``` + +**Result:** A backup tarball of your Rancher Server data is created. See [Restoring Backups: Docker Installs]({{}}/rancher/v2.x/en/backups/restorations/single-node-restoration) if you need to restore backup data. diff --git a/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-restores/_index.md b/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-restores/_index.md new file mode 100644 index 00000000000..caab667f83a --- /dev/null +++ b/content/rancher/v2.x/en/backups/v2.5/docker-installs/docker-restores/_index.md @@ -0,0 +1,72 @@ +--- +title: Restoring Backups—Docker Installs +shortTitle: Restores +weight: 3 +aliases: + - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/ + - /rancher/v2.x/en/backups/restorations/single-node-restoration +--- + +If you encounter a disaster scenario, you can restore your Rancher Server to your most recent backup. + +## Before You Start + +During restore of your backup, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (``). Here's an example of a command with a placeholder: + +``` +docker run --volumes-from -v $PWD:/backup \ +busybox sh -c "rm /var/lib/rancher/* -rf && \ +tar pzxvf /backup/rancher-data-backup--" +``` + +In this command, `` and `-` are environment variables for your Rancher deployment. + +Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the procedure below. + +Terminal `docker ps` Command, Displaying Where to Find `` and `` +![Placeholder Reference]({{}}/img/rancher/placeholder-ref.png) + +| Placeholder | Example | Description | +| -------------------------- | -------------------------- | --------------------------------------------------------- | +| `` | `v2.0.5` | The rancher/rancher image you pulled for initial install. | +| `` | `festive_mestorf` | The name of your Rancher container. | +| `` | `v2.0.5` | The version number for your Rancher backup. | +| `` | `9-27-18` | The date that the data container or backup was created. | +
+ +You can obtain `` and `` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups. + +## Restoring Backups + +Using a [backup]({{}}/rancher/v2.x/en/backups/backups/single-node-backups/) that you created earlier, restore Rancher to its last known healthy state. + +1. Using a remote Terminal connection, log into the node running your Rancher Server. + +1. Stop the container currently running Rancher Server. Replace `` with the [name of your Rancher container](#before-you-start). + + ``` + docker stop + ``` +1. Move the backup tarball that you created during completion of [Creating Backups—Docker Installs]({{}}/rancher/v2.x/en/backups/backups/single-node-backups/) onto your Rancher Server. Change to the directory that you moved it to. Enter `dir` to confirm that it's there. + + If you followed the naming convention we suggested in [Creating Backups—Docker Installs]({{}}/rancher/v2.x/en/backups/backups/single-node-backups/), it will have a name similar to `rancher-data-backup--.tar.gz`. + +1. Enter the following command to delete your current state data and replace it with your backup data, replacing the [placeholders](#before-you-start). Don't forget to close the quotes. + + >**Warning!** This command deletes all current state data from your Rancher Server container. Any changes saved after your backup tarball was created will be lost. + + ``` + docker run --volumes-from -v $PWD:/backup \ + busybox sh -c "rm /var/lib/rancher/* -rf && \ + tar pzxvf /backup/rancher-data-backup--.tar.gz" + ``` + + **Step Result:** A series of commands should run. + +1. Restart your Rancher Server container, replacing the [placeholder](#before-you-start). It will restart using your backup data. + + ``` + docker start + ``` + +1. Wait a few moments and then open Rancher in a web browser. Confirm that the restore succeeded and that your data is restored. diff --git a/content/rancher/v2.x/en/backups/examples/_index.md b/content/rancher/v2.x/en/backups/v2.5/examples/_index.md similarity index 99% rename from content/rancher/v2.x/en/backups/examples/_index.md rename to content/rancher/v2.x/en/backups/v2.5/examples/_index.md index b73e0405afd..a3a25363e50 100644 --- a/content/rancher/v2.x/en/backups/examples/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/examples/_index.md @@ -1,6 +1,8 @@ --- title: Examples weight: 5 +aliases: + - /rancher/v2.x/en/backups/examples --- This section contains examples of Backup and Restore custom resources. diff --git a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md b/content/rancher/v2.x/en/backups/v2.5/migrating-rancher/_index.md similarity index 98% rename from content/rancher/v2.x/en/backups/migrating-rancher/_index.md rename to content/rancher/v2.x/en/backups/v2.5/migrating-rancher/_index.md index 22a3c62a2ee..2543b4db554 100644 --- a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/migrating-rancher/_index.md @@ -1,6 +1,8 @@ --- title: Migrating Rancher to a New Cluster weight: 3 +aliases: + - /rancher/v2.x/en/backups/migrating-rancher --- If you are migrating Rancher to a new Kubernetes cluster, you don't need to install Rancher on the new cluster first. If Rancher is restored to a new cluster with Rancher already installed, it can cause problems. diff --git a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md b/content/rancher/v2.x/en/backups/v2.5/restoring-rancher/_index.md similarity index 78% rename from content/rancher/v2.x/en/backups/restoring-rancher/_index.md rename to content/rancher/v2.x/en/backups/v2.5/restoring-rancher/_index.md index ad73cc85a95..0bc2cfd3676 100644 --- a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/restoring-rancher/_index.md @@ -3,13 +3,15 @@ title: Restoring Rancher weight: 2 aliases: - /rancher/v2.x/en/installation/backups/restores + - /rancher/v2.x/en/backups/restoring-rancher --- A restore is performed by creating a Restore custom resource. > **Important** -* Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.](../migrating-rancher) -* While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore. +> +> * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.](../migrating-rancher) +> * While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore. ### Create the Restore Custom Resource diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md index dbf6d64b863..15b5988f5d8 100644 --- a/content/rancher/v2.x/en/cis-scans/_index.md +++ b/content/rancher/v2.x/en/cis-scans/_index.md @@ -5,232 +5,7 @@ weight: 18 _Available as of v2.4.0_ -Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. -The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. +If you are using Rancher v2.5, refer to the CIS scan documentation [here.](./v2.5) -> The CIS scan feature was improved in Rancher v2.5. If you are using Rancher v2.4, refer to the older version of the CIS scan documentation [here.](./legacy) - -- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) -- [About the CIS Benchmark](#about-the-cis-benchmark) -- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) -- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) -- [Running a Scan](#running-a-scan) -- [Skipping Tests](#skipping-tests) -- [Viewing Reports](#viewing-reports) -- [About the generated report](#about-the-generated-report) -- [Test Profiles](#test-profiles) -- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) -- [Roles-based access control](./rbac) -- [Configuration](./configuration) - -### Changes in Rancher v2.5 - -We now support running CIS scans on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. Previously it was only supported to run CIS scans on RKE Kubernetes clusters. - -In Rancher v2.4, the CIS scan tool was available from the **cluster manager** in the Rancher UI. Now it is available in the **Cluster Explorer** and it can be enabled and deployed using a Helm chart. It can be installed from the Rancher UI, but it can also be installed independently of Rancher. It deploys a CIS scan operator for the cluster, and deploys Kubernetes custom resources for cluster scans. The custom resources can be managed directly from the **Cluster Explorer.** - -In v1 of the CIS scan tool, which was available in Rancher v2.4 through the cluster manager, recurring scans could be scheduled. The ability to schedule recurring scans is not yet available in Rancher v2.5. - -Support for alerting for the cluster scan results is not available for Rancher v2.5 yet. - -More test profiles were added. In Rancher v2.4, permissive and hardened profiles were included. In Rancher v2.5, the following profiles are available: - -- Generic CIS 1.5 -- RKE permissive -- RKE hardened -- EKS -- GKE - -The default profile depends on the type of cluster that will be scanned: - -- For RKE Kubernetes clusters, the RKE permissive profile is the default. -- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. -- For cluster types other than RKE, EKS and GKE, the Generic CIS 1.5 profile will be used by default. - -The `rancher-cis-benchmark` currently supports the CIS 1.5 Benchmark version. - -> **Note:** CIS v1 cannot run on a cluster when CIS v2 is deployed. In other words, after `rancher-cis-benchmark` is installed, you can't run scans by going to the Cluster Manager view in the Rancher UI and clicking **Tools > CIS Scans.** - -# About the CIS Benchmark - -The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. - -CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. - -The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is -here. - -# Installing rancher-cis-benchmark - -The application can be installed with the Rancher UI or with Helm. - -### Installing with the Rancher UI - -1. In the Rancher UI, go to the **Cluster Explorer.** -1. Click **Apps.** -1. Click `rancher-cis-benchmark`. -1. Click **Install.** - -**Result:** The CIS scan application is deployed on the Kubernetes cluster. - -### Installing with Helm - -There are two Helm charts for the application: - -- `rancher-cis-benchmark-crds`, the custom resource definition chart -- `rancher-cis-benchmark`, the chart deploying rancher/cis-operator - -To install the charts, run the following commands: -``` -helm repo add rancherchart https://charts.rancher.io -helm repo update -helm install rancher-cis-benchmark-crd --kubeconfig <> rancherchart/rancher-cis-benchmark-crd --create-namespace -n cis-operator-system -helm install rancher-cis-benchmark --kubeconfig <> rancherchart/rancher-cis-benchmark -n cis-operator-system -``` - -# Uninstalling rancher-cis-benchmark - -The application can be uninstalled with the Rancher UI or with Helm. - -### Uninstalling with the Rancher UI - -1. From the **Cluster Explorer,** go to the top left dropdown menu and click **Apps & Marketplace.** -1. Click **Installed Apps.** -1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. -1. Click **Delete** and confirm **Delete.** - -**Result:** The `rancher-cis-benchmark` application is uninstalled. - -### Uninstalling with Helm - -Run the following commands: - -``` -helm uninstall rancher-cis-benchmark -n cis-operator-system -helm uninstall rancher-cis-benchmark-crd -n cis-operator-system -``` - -# Running a Scan - -When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. - -Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. - -To run a scan, - -1. Go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > CIS Benchmark.** -1. In the **Scans** section, click **Create.** -1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. -1. Click **Create.** - -**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. - -# Skipping Tests - -CIS scans can be run using test profiles with user-defined skips. - -To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. - -1. In the **Cluster Explorer,** go to the top-left dropdown menu and click **CIS Benchmark.** -1. Click **Profiles.** -1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile, click the three vertical dots, and click **Clone as YAML.** If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: - - ```yaml - apiVersion: cis.cattle.io/v1 - kind: ClusterScanProfile - metadata: - annotations: - meta.helm.sh/release-name: clusterscan-operator - meta.helm.sh/release-namespace: cis-operator-system - labels: - app.kubernetes.io/managed-by: Helm - name: "" - spec: - benchmarkVersion: cis-1.5 - skipTests: - - "1.1.20" - - "1.1.21" - ``` -1. Click **Create.** - -**Result:** A new CIS scan profile is created. - -When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. - -# Viewing Reports - -To view the generated CIS scan reports, - -1. In the **Cluster Explorer,** go to the top left dropdown menu and click **Cluster Explorer > CIS Benchmark.** -1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. - -One can download the report from the Scans list or from the scan detail page. - -# About the Generated Report - -Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. - -In Rancher v2.5, the scan will use the CIS Benchmark v1.5. The Benchmark version is included in the generated report. - -The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report. - -Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. - -The report contains the following information: - -| Column in Report | Description | -|------------------|-------------| -| `id` | The ID number of the CIS Benchmark. | -| `description` | The description of the CIS Benchmark test. | -| `remediation` | What needs to be fixed in order to pass the test. | -| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | -| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | -| `audit` | This is the audit check that `kube-bench` runs for this test. | -| `audit_config` | Any configuration applicable to the audit script. | -| `test_info` | Test-related info as reported by `kube-bench`, if any. | -| `commands` | Test-related commands as reported by `kube-bench`, if any. | -| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | -| `actual_value` | The test's actual value, present if reported by `kube-bench`. | -| `expected_result` | The test's expected result, present if reported by `kube-bench`. | - -Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. - -# Test Profiles - -The following profiles are available: - -- Generic CIS 1.5 (default) -- RKE permissive -- RKE hardened -- EKS -- GKE - -You also have the ability to customize a profile by saving a set of tests to skip. - -All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. - -There are 2 types of RKE cluster scan profiles: - -- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. -- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. - -The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. - -In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. - -# About Skipped and Not Applicable Tests - -For a list of skipped and not applicable tests, refer to this page. - -For now, only user-defined skipped tests are marked as skipped in the generated report. - -Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. - -# Roles-based Access Control - -For information about permissions, refer to this page. - -# Configuration - -For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. +If you are using Rancher v2.4, refer to the CIS scan documentation [here.](./v2.4) \ No newline at end of file diff --git a/content/rancher/v2.x/en/cis-scans/legacy/_index.md b/content/rancher/v2.x/en/cis-scans/v2.4/_index.md similarity index 98% rename from content/rancher/v2.x/en/cis-scans/legacy/_index.md rename to content/rancher/v2.x/en/cis-scans/v2.4/_index.md index 155073640f1..278ac634113 100644 --- a/content/rancher/v2.x/en/cis-scans/legacy/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.4/_index.md @@ -1,8 +1,11 @@ --- -title: Cluster Manager CIS Scan (Deprecated) -shortTitle: Cluster Manager -weight: 1 +title: CIS Scans in Rancher v2.4 (Deprecated) +shortTitle: Rancher v2.4 +weight: 2 +aliases: + - /rancher/v2.x/en/cis-scans/legacy --- + _Available as of v2.4.0_ This section contains the legacy documentation for the CIS Scan tool that was released in Rancher v2.4, and was available under the **Tools** menu in the top navigation bar of the cluster manager. diff --git a/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/v2.4/skipped-tests/_index.md similarity index 99% rename from content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md rename to content/rancher/v2.x/en/cis-scans/v2.4/skipped-tests/_index.md index 849e69019f6..f35347c3eaa 100644 --- a/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.4/skipped-tests/_index.md @@ -1,6 +1,8 @@ --- title: Skipped and Not Applicable Tests weight: 1 +aliases: + - /rancher/v2.x/en/cis-scans/legacy/skipped-tests --- This section lists the tests that are skipped in the permissive test profile for RKE. diff --git a/content/rancher/v2.x/en/cis-scans/v2.5/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md new file mode 100644 index 00000000000..87da892d66e --- /dev/null +++ b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md @@ -0,0 +1,236 @@ +--- +title: CIS Scans in Rancher v2.5 +shortTitle: Rancher v2.5 +weight: 1 +--- + + +Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. + +The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. + +> The CIS scan feature was improved in Rancher v2.5. If you are using Rancher v2.4, refer to the older version of the CIS scan documentation [here.](./legacy) + +- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) +- [About the CIS Benchmark](#about-the-cis-benchmark) +- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) +- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark) +- [Running a Scan](#running-a-scan) +- [Skipping Tests](#skipping-tests) +- [Viewing Reports](#viewing-reports) +- [About the generated report](#about-the-generated-report) +- [Test Profiles](#test-profiles) +- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests) +- [Roles-based access control](./rbac) +- [Configuration](./configuration) + +### Changes in Rancher v2.5 + +We now support running CIS scans on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. Previously it was only supported to run CIS scans on RKE Kubernetes clusters. + +In Rancher v2.4, the CIS scan tool was available from the **cluster manager** in the Rancher UI. Now it is available in the **Cluster Explorer** and it can be enabled and deployed using a Helm chart. It can be installed from the Rancher UI, but it can also be installed independently of Rancher. It deploys a CIS scan operator for the cluster, and deploys Kubernetes custom resources for cluster scans. The custom resources can be managed directly from the **Cluster Explorer.** + +In v1 of the CIS scan tool, which was available in Rancher v2.4 through the cluster manager, recurring scans could be scheduled. The ability to schedule recurring scans is not yet available in Rancher v2.5. + +Support for alerting for the cluster scan results is not available for Rancher v2.5 yet. + +More test profiles were added. In Rancher v2.4, permissive and hardened profiles were included. In Rancher v2.5, the following profiles are available: + +- Generic CIS 1.5 +- RKE permissive +- RKE hardened +- EKS +- GKE + +The default profile depends on the type of cluster that will be scanned: + +- For RKE Kubernetes clusters, the RKE permissive profile is the default. +- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters. +- For cluster types other than RKE, EKS and GKE, the Generic CIS 1.5 profile will be used by default. + +The `rancher-cis-benchmark` currently supports the CIS 1.5 Benchmark version. + +> **Note:** CIS v1 cannot run on a cluster when CIS v2 is deployed. In other words, after `rancher-cis-benchmark` is installed, you can't run scans by going to the Cluster Manager view in the Rancher UI and clicking **Tools > CIS Scans.** + +# About the CIS Benchmark + +The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions. + +CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team. + +The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is +here. + +# Installing rancher-cis-benchmark + +The application can be installed with the Rancher UI or with Helm. + +### Installing with the Rancher UI + +1. In the Rancher UI, go to the **Cluster Explorer.** +1. Click **Apps.** +1. Click `rancher-cis-benchmark`. +1. Click **Install.** + +**Result:** The CIS scan application is deployed on the Kubernetes cluster. + +### Installing with Helm + +There are two Helm charts for the application: + +- `rancher-cis-benchmark-crds`, the custom resource definition chart +- `rancher-cis-benchmark`, the chart deploying rancher/cis-operator + +To install the charts, run the following commands: +``` +helm repo add rancherchart https://charts.rancher.io +helm repo update +helm install rancher-cis-benchmark-crd --kubeconfig <> rancherchart/rancher-cis-benchmark-crd --create-namespace -n cis-operator-system +helm install rancher-cis-benchmark --kubeconfig <> rancherchart/rancher-cis-benchmark -n cis-operator-system +``` + +# Uninstalling rancher-cis-benchmark + +The application can be uninstalled with the Rancher UI or with Helm. + +### Uninstalling with the Rancher UI + +1. From the **Cluster Explorer,** go to the top left dropdown menu and click **Apps & Marketplace.** +1. Click **Installed Apps.** +1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. +1. Click **Delete** and confirm **Delete.** + +**Result:** The `rancher-cis-benchmark` application is uninstalled. + +### Uninstalling with Helm + +Run the following commands: + +``` +helm uninstall rancher-cis-benchmark -n cis-operator-system +helm uninstall rancher-cis-benchmark-crd -n cis-operator-system +``` + +# Running a Scan + +When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. + +Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state. + +To run a scan, + +1. Go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > CIS Benchmark.** +1. In the **Scans** section, click **Create.** +1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on. +1. Click **Create.** + +**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears. + +# Skipping Tests + +CIS scans can be run using test profiles with user-defined skips. + +To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark. + +1. In the **Cluster Explorer,** go to the top-left dropdown menu and click **CIS Benchmark.** +1. Click **Profiles.** +1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile, click the three vertical dots, and click **Clone as YAML.** If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name: + + ```yaml + apiVersion: cis.cattle.io/v1 + kind: ClusterScanProfile + metadata: + annotations: + meta.helm.sh/release-name: clusterscan-operator + meta.helm.sh/release-namespace: cis-operator-system + labels: + app.kubernetes.io/managed-by: Helm + name: "" + spec: + benchmarkVersion: cis-1.5 + skipTests: + - "1.1.20" + - "1.1.21" + ``` +1. Click **Create.** + +**Result:** A new CIS scan profile is created. + +When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`. + +# Viewing Reports + +To view the generated CIS scan reports, + +1. In the **Cluster Explorer,** go to the top left dropdown menu and click **Cluster Explorer > CIS Benchmark.** +1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name. + +One can download the report from the Scans list or from the scan detail page. + +# About the Generated Report + +Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format. + +In Rancher v2.5, the scan will use the CIS Benchmark v1.5. The Benchmark version is included in the generated report. + +The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report. + +Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's self-assessment guide for the corresponding Kubernetes version. + +The report contains the following information: + +| Column in Report | Description | +|------------------|-------------| +| `id` | The ID number of the CIS Benchmark. | +| `description` | The description of the CIS Benchmark test. | +| `remediation` | What needs to be fixed in order to pass the test. | +| `state` | Indicates if the test passed, failed, was skipped, or was not applicable. | +| `node_type` | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. | +| `audit` | This is the audit check that `kube-bench` runs for this test. | +| `audit_config` | Any configuration applicable to the audit script. | +| `test_info` | Test-related info as reported by `kube-bench`, if any. | +| `commands` | Test-related commands as reported by `kube-bench`, if any. | +| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. | +| `actual_value` | The test's actual value, present if reported by `kube-bench`. | +| `expected_result` | The test's expected result, present if reported by `kube-bench`. | + +Refer to the table in the cluster hardening guide for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests. + +# Test Profiles + +The following profiles are available: + +- Generic CIS 1.5 (default) +- RKE permissive +- RKE hardened +- EKS +- GKE + +You also have the ability to customize a profile by saving a set of tests to skip. + +All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes. + +There are 2 types of RKE cluster scan profiles: + +- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests. +- **Hardened:** This profile will not skip any tests, except for the non-applicable tests. + +The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters. + +In order to pass the "Hardened" profile, you will need to follow the steps on the hardening guide and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster. + +# About Skipped and Not Applicable Tests + +For a list of skipped and not applicable tests, refer to this page. + +For now, only user-defined skipped tests are marked as skipped in the generated report. + +Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable. + +# Roles-based Access Control + +For information about permissions, refer to this page. + +# Configuration + +For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to this page. diff --git a/content/rancher/v2.x/en/cis-scans/configuration/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/configuration/_index.md similarity index 98% rename from content/rancher/v2.x/en/cis-scans/configuration/_index.md rename to content/rancher/v2.x/en/cis-scans/v2.5/configuration/_index.md index c2b3629f838..ccc6df3f416 100644 --- a/content/rancher/v2.x/en/cis-scans/configuration/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.5/configuration/_index.md @@ -1,6 +1,8 @@ --- title: Configuration weight: 3 +aliases: + - /rancher/v2.x/en/cis-scans/configuration --- This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization. diff --git a/content/rancher/v2.x/en/cis-scans/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/rbac/_index.md similarity index 98% rename from content/rancher/v2.x/en/cis-scans/rbac/_index.md rename to content/rancher/v2.x/en/cis-scans/v2.5/rbac/_index.md index d3800df3559..79046fa30ef 100644 --- a/content/rancher/v2.x/en/cis-scans/rbac/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.5/rbac/_index.md @@ -2,6 +2,8 @@ title: Roles-based Access Control shortTitle: RBAC weight: 3 +aliases: + - /rancher/v2.x/en/cis-scans/rbac --- This section describes the permissions required to use the rancher-cis-benchmark App. diff --git a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/skipped-tests/_index.md similarity index 99% rename from content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md rename to content/rancher/v2.x/en/cis-scans/v2.5/skipped-tests/_index.md index feaf42e27b9..6c79a7627a9 100644 --- a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.5/skipped-tests/_index.md @@ -1,6 +1,8 @@ --- title: Skipped and Not Applicable Tests weight: 3 +aliases: + - /rancher/v2.x/en/cis-scans/skipped-tests --- This section lists the tests that are skipped in the permissive test profile for RKE. diff --git a/content/rancher/v2.x/en/cluster-admin/tools/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/_index.md index c5833676ce9..e1848728eaf 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/_index.md @@ -9,11 +9,11 @@ Rancher contains a variety of tools that aren't included in Kubernetes to assist -- [Notifiers and Alerts](#notifiers-and-alerts) - [Logging](#logging) -- [Monitoring](#monitoring) +- [Monitoring and Alerts](#monitoring-and-alerts) - [Istio](#istio) - [OPA Gatekeeper](#opa-gatekeeper) +- [CIS Scans](#cis-scans) @@ -30,24 +30,44 @@ Logging is helpful because it allows you to: Rancher can integrate with Elasticsearch, splunk, kafka, syslog, and fluentd. -For details, refer to the [logging section.]({{}}/rancher/v2.x/en/logging) +Logging was improved in Rancher v2.5. -# Monitoring +- If you are using Rancher v2.5, refer to the logging documentation [here.]({{}}/rancher/v2.x/en/logging/v2.5) +- If you are using Rancher v2.0.x-v2.4.x, refer to the logging documentation [here.]({{}}/rancher/v2.x/en/logging/v2.0.x-v2.4.x) + +# Monitoring and Alerts Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{}}/rancher/v2.x/en/monitoring) -### Notifiers and Alerts - After monitoring is enabled, you can set up alerts and notifiers that provide the mechanism to receive them. Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action. Notifications can be sent with Slack, email, PagerDuty, WeChat, and webhooks. Alerts are rules that trigger those notifications. Before you can receive alerts, you must configure one or more notifier in Rancher. The scope for alerts can be set at either the cluster or project level. +- If you are using Rancher v2.5, refer to the monitoring documentation [here.]({{}}/rancher/v2.x/en/monitoring-alerting/v2.5) +- If you are using Rancher v2.0.x-v2.4.x, refer to the monitoring documentation [here.]({{}}/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x) + # Istio -[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. For details on how to enable Istio in Rancher, refer to the [Istio section.]({{}}/rancher/v2.x/en/istio) +_Available as of v2.3_ -## OPA Gatekeeper +[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. - [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.]({{}}/rancher/v2.x/en/opa-gatekeper) +Rancher's integration with Istio was improved in Rancher v2.5. + +- If you are using Rancher v2.5, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.5) +- If you are using Rancher v2.3.x-v2.4.x, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.3.x-v2.4.x) + +# OPA Gatekeeper + +[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.]({{}}/rancher/v2.x/en/opa-gatekeper) + + +# CIS Scans + +Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. + +If you are using Rancher v2.5, refer to the CIS scan documentation [here.](./v2.5) + +If you are using Rancher v2.4, refer to the CIS scan documentation [here.](./v2.4) \ No newline at end of file diff --git a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md index 762f2f0bc26..5e474b26d5b 100644 --- a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md +++ b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md @@ -1,6 +1,6 @@ --- title: Fleet - GitOps at Scale -shortTitle: Fleet +shortTitle: Rancher v2.5 weight: 1 --- diff --git a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md index 93e0bc45c3e..b69ddac0928 100644 --- a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md +++ b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md @@ -1,11 +1,13 @@ --- -title: Cluster Manager Multi-Cluster App Documentation -shortTitle: Cluster Manager +title: Multi-cluster Apps +shortTitle: Rancher v2.2.0-v2.4.x weight: 2 --- _Available as of v2.2.0_ +> As of Rancher v2.5, we recommend using [Fleet]({{}}/rancher/v2.x/en/deploy-across-clusters/fleet) for deploying apps across clusters. + Typically, most applications are deployed on a single Kubernetes cluster, but there will be times you might want to deploy multiple copies of the same application across different clusters and/or projects. In Rancher, a _multi-cluster application_, is an application deployed using a Helm chart across multiple clusters. With the ability to deploy the same application across multiple clusters, it avoids the repetition of the same action on each cluster, which could introduce user error during application configuration. With multi-cluster applications, you can customize to have the same configuration across all projects/clusters as well as have the ability to change the configuration based on your target project. Since multi-cluster application is considered a single application, it's easy to manage and maintain this application. Any Helm charts from a global catalog can be used to deploy and manage multi-cluster applications. diff --git a/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md index 007941b3f18..183a775ad14 100644 --- a/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md +++ b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md @@ -1,5 +1,6 @@ --- title: Apps and Marketplace +shortTitle: Rancher v2.5 weight: 1 --- diff --git a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md index 924152bb467..8ad67dd78f6 100644 --- a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md +++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md @@ -1,6 +1,6 @@ --- -title: Cluster Manager Catalog Documentation -shortTitle: Cluster Manager +title: Rancher v2.0.x-v2.4.x Catalogs (Deprecated) +shortTitle: Rancher v2.0.x-v2.4.x description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps. weight: 1 aliases: @@ -11,6 +11,8 @@ aliases: - /rancher/v2.x/en/catalog/apps --- +> As of Rancher v2.5, the catalog system is deprecated and has been replaced with [Apps and Marketplace]({{}}/rancher/v2.x/en/helm-charts/apps-marketplace) in the Cluster Explorer. + Rancher provides the ability to use a catalog of Helm charts that make it easy to repeatedly deploy applications. - **Catalogs** are GitHub repositories or Helm Chart repositories filled with applications that are ready-made for deployment. Applications are bundled in objects called _Helm charts_. diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md index a6fb3bd4b9b..e34233f81d0 100644 --- a/content/rancher/v2.x/en/istio/_index.md +++ b/content/rancher/v2.x/en/istio/_index.md @@ -5,95 +5,9 @@ aliases: - /rancher/v2.x/en/dashboard/istio --- -# Istio in Cluster Manager -If you are using a Rancher version from **v2.3.x** to **v2.4.x**, the older way of setting up Istio in th **Cluster Manager** is documented in [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/) +In Rancher 2.5, the Istio application was improved. -# Istio in Cluster Explorer - [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices. +If you are using Rancher v2.5, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.5) -As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. - -Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to a team of developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. - -This core service mesh provides features that include but are not limited to the following: - -- **Traffic Management** such as ingress and egress routing, circuit breaking, mirroring. -- **Security** with resources to authenticate and authorize traffic and users, mTLS included. -- **Observability** of logs, metrics, and distributed traffic flows. - -After [setting up istio]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) you can leverage Istio's control plane functionality through the Cluster Explorer, `kubectl`, or `istioctl`. - -Rancher's Istio integration comes with a comprehensive visualization aid: - -- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component. - -Istio needs to be set up by a `cluster-admin` before it can be used in a project. - -# What's New in Rancher v2.5 - -The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent. - -Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not. - -A Prometheus integration will still be available through an installation of [Rancher Monitoring]({{}}/rancher/v2.x/en/monitoring-alerting/), or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box. - -Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation. - -This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project. - -# Prerequisites - -Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio. - -# Setup Guide - -Refer to the [setup guide]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project. - -# Remove Istio - -To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{}}/rancher/v2.x/en/istio/disabling-istio/) - -# Migrate From Previous Istio Version - -There is no upgrade path for Istio versions less than 1.7.x. To successfully install Istio in the **Cluster Explorer**, you will need to disable your existing Istio in the **Cluster Manager**. - -If you have a significant amount of additional Istio CRDs you might consider manually migrating CRDs that are supported in both versions of Istio. You can do this by running `kubectl get -n istio-system -o yaml`, save the output yaml and re-apply in the new version. - -Another option is to manually uninstall istio resources one at a time, but leave the resources that are supported in both versions of Istio and that will not be installed by the newest version. This method is more likely to result in issues installing the new version, but could be a good option depending on your situation. - -# Accessing Visualizations - -> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations) - -After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI. - -To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus** - -To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. - -By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs) if you would like to use a different configuration for prometheus data scraping. - -Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml. - -# Architecture - -Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster. - -Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio. - -When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads. - -For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/) - -### Multiple Ingresses - -By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace. The result is that your cluster will have two ingresses in your cluster. - -![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{}}/img/rancher/istio-ingress.svg) - - Additional Istio Ingress gateways can be enabled via the [overlay file]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file). - -### Egress Support - -By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file). +If you are using Rancher v2.3.x-v2.4.x, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.3.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/istio/legacy/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/legacy/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md index 75abbd9b772..09c4c721535 100644 --- a/content/rancher/v2.x/en/istio/legacy/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md @@ -1,6 +1,6 @@ --- -title: Cluster Manager Istio Documentation -shortTitle: Cluster Manager +title: Istio in Rancher v2.3.x-v2.4.x +shortTitle: Rancher v2.3.x-v2.4.x weight: 1 aliases: - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/ @@ -10,7 +10,7 @@ aliases: --- _Available as of v2.3.0_ -> In Rancher 2.5, the Istio application was improved. There are now two ways to enable Istio. The older way is documented in this section, and the new application for Istio is documented [here.]({{}}/rancher/v2.x/en/istio) +> In Rancher 2.5, the Istio application was improved. There are now two ways to enable Istio. The older way is documented in this section, and the new application for Istio is documented [here.]({{}}/rancher/v2.x/en/istio/v2.5) [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. diff --git a/content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/disabling-istio/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/disabling-istio/_index.md index 46821dc798c..0c8113c11f9 100644 --- a/content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/disabling-istio/_index.md @@ -3,6 +3,7 @@ title: Disabling Istio weight: 4 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio + - /rancher/v2.x/en/istio/legacy/disabling-istio --- This section describes how to disable Istio in a cluster, namespace, or workload. diff --git a/content/rancher/v2.x/en/istio/legacy/rbac/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/rbac/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/legacy/rbac/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/rbac/_index.md index 4f11c00f6d9..05a9a3db0ab 100644 --- a/content/rancher/v2.x/en/istio/legacy/rbac/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/rbac/_index.md @@ -3,6 +3,7 @@ title: Role-based Access Control weight: 3 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/rbac + - /rancher/v2.x/en/istio/legacy/rbac --- This section describes the permissions required to access Istio features and how to configure access to the Kiali and Jaeger visualizations. diff --git a/content/rancher/v2.x/en/istio/legacy/release-notes/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/release-notes/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/legacy/release-notes/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/release-notes/_index.md index af54839bc48..4c17bf28307 100644 --- a/content/rancher/v2.x/en/istio/legacy/release-notes/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/release-notes/_index.md @@ -2,6 +2,7 @@ title: Release Notes aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/release-notes + - /rancher/v2.x/en/istio/legacy/release-notes --- diff --git a/content/rancher/v2.x/en/istio/legacy/resources/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/resources/_index.md similarity index 99% rename from content/rancher/v2.x/en/istio/legacy/resources/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/resources/_index.md index 8a6dafeb684..babbb1229a3 100644 --- a/content/rancher/v2.x/en/istio/legacy/resources/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/resources/_index.md @@ -5,6 +5,7 @@ aliases: - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/ - /rancher/v2.x/en/project-admin/istio/config/ - /rancher/v2.x/en/cluster-admin/tools/istio/resources + - /rancher/v2.x/en/istio/legacy/resources --- _Available as of v2.3.0_ diff --git a/content/rancher/v2.x/en/istio/legacy/setup/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/legacy/setup/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/_index.md index ab842cf4f30..062943de64a 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/_index.md @@ -3,6 +3,7 @@ title: Setup Guide weight: 2 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup + - /rancher/v2.x/en/istio/legacy/setup --- This section describes how to enable Istio and start using it in your projects. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/deploy-workloads/_index.md similarity index 99% rename from content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/deploy-workloads/_index.md index e1338e861bf..78fd1b6e616 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/deploy-workloads/_index.md @@ -3,6 +3,7 @@ title: 4. Add Deployments and Services with the Istio Sidecar weight: 4 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads + - /rancher/v2.x/en/istio/legacy/setup/deploy-workloads --- > **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/_index.md index a17cc358d30..fea051bad38 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/_index.md @@ -3,6 +3,7 @@ title: 1. Enable Istio in the Cluster weight: 1 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster + - /rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster --- This cluster uses the default Nginx controller to allow traffic into the cluster. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md index 5a6cc65b8c7..39bb3dd572c 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md @@ -2,6 +2,7 @@ title: Enable Istio with Pod Security Policies aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp + - /rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp --- >**Note:** The following guide is only for RKE provisioned clusters. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-namespace/_index.md similarity index 97% rename from content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-namespace/_index.md index 24c594e80eb..b621b795fcd 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/enable-istio-in-namespace/_index.md @@ -3,6 +3,7 @@ title: 2. Enable Istio in a Namespace weight: 2 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace + - /rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace --- You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/gateway/_index.md similarity index 99% rename from content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/gateway/_index.md index 60f8780fd65..102042bcb65 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/gateway/_index.md @@ -3,6 +3,7 @@ title: 5. Set up the Istio Gateway weight: 5 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway + - /rancher/v2.x/en/istio/legacy/setup/gateway --- The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/node-selectors/_index.md similarity index 97% rename from content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/node-selectors/_index.md index f226580b0de..c88facca80f 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/node-selectors/_index.md @@ -3,6 +3,7 @@ title: 3. Select the Nodes Where Istio Components Will be Deployed weight: 3 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors + - /rancher/v2.x/en/istio/legacy/setup/node-selectors --- > **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) diff --git a/content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/set-up-traffic-management/_index.md similarity index 97% rename from content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/set-up-traffic-management/_index.md index b9d44ea7193..ef8c72475d4 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/set-up-traffic-management/_index.md @@ -3,6 +3,7 @@ title: 6. Set up Istio's Components for Traffic Management weight: 6 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management + - /rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management --- A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*. diff --git a/content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/view-traffic/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md rename to content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/view-traffic/_index.md index e456dd14b81..dd4e908a24b 100644 --- a/content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/setup/view-traffic/_index.md @@ -3,6 +3,7 @@ title: 7. Generate and View Traffic weight: 7 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic + - /rancher/v2.x/en/istio/legacy/setup/view-traffic --- This section describes how to view the traffic that is being managed by Istio. diff --git a/content/rancher/v2.x/en/istio/v2.5/_index.md b/content/rancher/v2.x/en/istio/v2.5/_index.md new file mode 100644 index 00000000000..a41e62e1e4b --- /dev/null +++ b/content/rancher/v2.x/en/istio/v2.5/_index.md @@ -0,0 +1,101 @@ +--- +title: Istio in Rancher v2.5 +shortTitle: Rancher v2.5 +weight: 1 +--- + +[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices. + +As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly. + +Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to a team of developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing. + +This core service mesh provides features that include but are not limited to the following: + +- **Traffic Management** such as ingress and egress routing, circuit breaking, mirroring. +- **Security** with resources to authenticate and authorize traffic and users, mTLS included. +- **Observability** of logs, metrics, and distributed traffic flows. + +After [setting up istio]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) you can leverage Istio's control plane functionality through the Cluster Explorer, `kubectl`, or `istioctl`. + +Rancher's Istio integration comes with a comprehensive visualization aid: + +- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component. + +Istio needs to be set up by a `cluster-admin` before it can be used in a project. + +- [What's New in Rancher v2.5](#what-s-new-in-rancher-v2-5) +- [Prerequisites](#prerequisites) +- [Setup Guide](#setup-guide) +- [Remove Istio](#remove-istio) +- [Migrate from Previous Istio Version](#migrate-from-previous-istio-version) +- [Accessing Visualizations](#accessing-visualizations) +- [Architecture](#architecture) + +# What's New in Rancher v2.5 + +The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent. + +Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not. + +A Prometheus integration will still be available through an installation of [Rancher Monitoring]({{}}/rancher/v2.x/en/monitoring-alerting/), or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box. + +Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation. + +This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project. + +# Prerequisites + +Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio. + +# Setup Guide + +Refer to the [setup guide]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project. + +# Remove Istio + +To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{}}/rancher/v2.x/en/istio/disabling-istio/) + +# Migrate From Previous Istio Version + +There is no upgrade path for Istio versions less than 1.7.x. To successfully install Istio in the **Cluster Explorer**, you will need to disable your existing Istio in the **Cluster Manager**. + +If you have a significant amount of additional Istio CRDs you might consider manually migrating CRDs that are supported in both versions of Istio. You can do this by running `kubectl get -n istio-system -o yaml`, save the output yaml and re-apply in the new version. + +Another option is to manually uninstall istio resources one at a time, but leave the resources that are supported in both versions of Istio and that will not be installed by the newest version. This method is more likely to result in issues installing the new version, but could be a good option depending on your situation. + +# Accessing Visualizations + +> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations) + +After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI. + +To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus** + +To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. + +By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs) if you would like to use a different configuration for prometheus data scraping. + +Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml. + +# Architecture + +Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster. + +Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio. + +When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads. + +For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/) + +### Multiple Ingresses + +By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace. The result is that your cluster will have two ingresses in your cluster. + +![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{}}/img/rancher/istio-ingress.svg) + + Additional Istio Ingress gateways can be enabled via the [overlay file]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file). + +### Egress Support + +By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file]({{}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file). diff --git a/content/rancher/v2.x/en/istio/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/v2.5/disabling-istio/_index.md similarity index 96% rename from content/rancher/v2.x/en/istio/disabling-istio/_index.md rename to content/rancher/v2.x/en/istio/v2.5/disabling-istio/_index.md index 2c054c556f0..bcbe1171293 100644 --- a/content/rancher/v2.x/en/istio/disabling-istio/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/disabling-istio/_index.md @@ -1,7 +1,8 @@ --- title: Disabling Istio weight: 4 - +aliases: + - /rancher/v2.x/en/istio/disabling-istio --- This section describes how to uninstall Istio in a cluster or disable a namespace, or workload. diff --git a/content/rancher/v2.x/en/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/v2.5/rbac/_index.md similarity index 93% rename from content/rancher/v2.x/en/istio/rbac/_index.md rename to content/rancher/v2.x/en/istio/v2.5/rbac/_index.md index 91c56254a8c..852ac33c621 100644 --- a/content/rancher/v2.x/en/istio/rbac/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/rbac/_index.md @@ -3,6 +3,7 @@ title: Role-based Access Control weight: 3 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/rbac + - /rancher/v2.x/en/istio/rbac --- This section describes the permissions required to access Istio features. @@ -36,7 +37,7 @@ ClusterRole create by chart | Default K8s ClusterRole | Rancher Role | `istio-edit`| edit | Project Member | `istio-view` | view | Read-only | -Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create ( C ), Get ( G ), List ( L ), Update ( U ), Patch ( P ), Delete( D ), All ( * )) that can be performed. +Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create ( C ), Get ( G ), List ( L ), Watch ( W ), Update ( U ), Patch ( P ), Delete( D ), All ( * )) that can be performed. |CRDs | Admin | Edit | View diff --git a/content/rancher/v2.x/en/istio/release-notes/_index.md b/content/rancher/v2.x/en/istio/v2.5/release-notes/_index.md similarity index 95% rename from content/rancher/v2.x/en/istio/release-notes/_index.md rename to content/rancher/v2.x/en/istio/v2.5/release-notes/_index.md index 2cf7c2ca9a0..5ca589330a0 100644 --- a/content/rancher/v2.x/en/istio/release-notes/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/release-notes/_index.md @@ -2,9 +2,10 @@ title: Release Notes aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/release-notes + - /rancher/v2.x/en/istio/release-notes --- -## Istio 1.5.9 release notes +# Istio 1.5.9 release notes **Bug fixes** diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/v2.5/resources/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/resources/_index.md rename to content/rancher/v2.x/en/istio/v2.5/resources/_index.md index 9a13b076b69..dff95ccedb1 100644 --- a/content/rancher/v2.x/en/istio/resources/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/resources/_index.md @@ -5,6 +5,7 @@ aliases: - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/ - /rancher/v2.x/en/project-admin/istio/config/ - /rancher/v2.x/en/cluster-admin/tools/istio/resources + - /rancher/v2.x/en/istio/resources --- _This section applies to Istio in Rancher v2.5.0. If you are using Rancher v2.4.x, refer to [this section.]({{}}/rancher/v2.x/en/cluster-admin/tools/istio/)_ diff --git a/content/rancher/v2.x/en/istio/setup/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/_index.md similarity index 100% rename from content/rancher/v2.x/en/istio/setup/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/_index.md diff --git a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/deploy-workloads/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/deploy-workloads/_index.md index 017ee200eed..79fcdfe69bf 100644 --- a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/deploy-workloads/_index.md @@ -3,6 +3,7 @@ title: 4. Add Deployments and Services with the Istio Sidecar weight: 4 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads + - /rancher/v2.x/en/istio/setup/deploy-workloads --- > **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have the Istio app installed. @@ -13,7 +14,7 @@ To inject the Istio sidecar on an existing workload in the namespace, from the * Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see `istio-proxy` alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml. -### 3. Add Deployments and Services +### Add Deployments and Services There are a few ways to add new **Deployments** in your namespace @@ -38,7 +39,7 @@ You can also create deployments and services using the kubectl **shell** 1. Run `kubectl create -f .yaml` if your file is stored locally in the cluster 1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command. -### 4. Example Deployments and Services +### Example Deployments and Services Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation. diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md similarity index 89% rename from content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md index 59df49bae16..9bee04ac7ab 100644 --- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md @@ -3,8 +3,10 @@ title: 1. Enable Istio in the Cluster weight: 1 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster + - /rancher/v2.x/en/istio/setup/enable-istio-in-cluster --- + Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. - `cluster-admin` @@ -22,21 +24,23 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/ Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed. ->**Note:** In clusters where: -> -> - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. -> - The Project Network Isolation option is enabled. -> - You install the Istio Ingress module -> ->The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options: -> 1. You add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: -> ``` -> ... -> - podSelector: -> matchLabels: -> app: istio-ingressgateway ->``` -> 2. You move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation +**Note:** In clusters where: + + - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. + - The Project Network Isolation option is enabled. + - You install the Istio Ingress module + +The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options. + + +The first option is to add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: + +``` +- podSelector: + matchLabels: + app: istio-ingressgateway +``` +The second option is to move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation ## Additonal Config Options diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-namespace/_index.md similarity index 97% rename from content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-namespace/_index.md index 4e74c56d523..24afaf78f7c 100644 --- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-namespace/_index.md @@ -3,6 +3,7 @@ title: 2. Enable Istio in a Namespace weight: 2 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace + - /rancher/v2.x/en/istio/setup/enable-istio-in-namespace --- You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace. diff --git a/content/rancher/v2.x/en/istio/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/gateway/_index.md similarity index 99% rename from content/rancher/v2.x/en/istio/setup/gateway/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/gateway/_index.md index 68743ee852e..502dd76f48a 100644 --- a/content/rancher/v2.x/en/istio/setup/gateway/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/gateway/_index.md @@ -3,6 +3,7 @@ title: 5. Set up the Istio Gateway weight: 5 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway + - /rancher/v2.x/en/istio/setup/gateway --- The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. diff --git a/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/set-up-traffic-management/_index.md similarity index 98% rename from content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/set-up-traffic-management/_index.md index aa3ff5c1e8c..e2449894cb6 100644 --- a/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/set-up-traffic-management/_index.md @@ -3,6 +3,7 @@ title: 6. Set up Istio's Components for Traffic Management weight: 6 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management + - /rancher/v2.x/en/istio/setup/set-up-traffic-management --- A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*. diff --git a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/view-traffic/_index.md similarity index 97% rename from content/rancher/v2.x/en/istio/setup/view-traffic/_index.md rename to content/rancher/v2.x/en/istio/v2.5/setup/view-traffic/_index.md index 163b716f0d2..15325d222d2 100644 --- a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/view-traffic/_index.md @@ -3,6 +3,7 @@ title: 7. Generate and View Traffic weight: 7 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic + - /rancher/v2.x/en/istio/setup/view-traffic --- This section describes how to view the traffic that is being managed by Istio. diff --git a/content/rancher/v2.x/en/k8s-in-rancher/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/_index.md index a2c55355aa3..d9095f9f097 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/_index.md @@ -40,7 +40,7 @@ For more information, see [load balancers]({{}}/rancher/v2.x/en/k8s-in- Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive. You can get around this issue by using an ingress. -Ingress is a set or rules that act as a load balancer. Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster program the load balancer to direct the request to the correct service based on service subdomains or path rules that you've configured. +Ingress is a set of rules that act as a load balancer. Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster program the load balancer to direct the request to the correct service based on service subdomains or path rules that you've configured. For more information, see [Ingress]({{}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress). diff --git a/content/rancher/v2.x/en/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md index 7f70bb593c5..3693aedd9f8 100644 --- a/content/rancher/v2.x/en/logging/_index.md +++ b/content/rancher/v2.x/en/logging/_index.md @@ -8,238 +8,7 @@ aliases: - /rancher/v2.x/en/dashboard/logging --- -- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) -- [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster) -- [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) -- [Configuring the Logging Application](#configuring-the-logging-application) - - -### Changes in Rancher v2.5 - -The following changes were introduced to logging in Rancher v2.5: - -- Rancher's logging feature is now powered the [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging-operator/) instead of Rancher's in-house logging solution. -- [Fluent Bit](https://fluentbit.io/) is now used to aggregate the logs. [Fluentd](https://www.fluentd.org/) is used for filtering the messages and routing them to the outputs. Previously, only Fluentd was used. -- Logging can be configured with a Kubernetes manifest, because now the logging uses a Kubernetes operator with Custom Resource Definitions. -- We now support filtering logs. -- We now support writing logs to multiple outputs. -- We now always collect Control Plane and etcd logs. - - -The following figure from the [Banzai documentation](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) shows the new logging architecture: - -
How the Banzai Cloud Logging Operator Works with Fluentd and Fluent Bit
- -![How the Banzai Cloud Logging Operator Works with Fluentd]({{}}/img/rancher/banzai-cloud-logging-operator.png) - -### Configuring the Logging Output for the Rancher Kubernetes Cluster - -If you install Rancher as a Helm chart, you'll configure the Helm chart options to select a logging output for all the logs in the local Kubernetes cluster. - -If you install Rancher using the Rancher CLI on an Linux OS, the Rancher Helm chart will be installed on a Kubernetes cluster with default options. Then when the Rancher UI is available, you'll enable the logging app from the Apps section of the UI. Then during the process of installing the logging application, you will configure the logging output. - -### Enabling Logging for Rancher Managed Clusters - -If you have Enterprise Cluster Manager enabled, you can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. - -### Configuring the Logging Application - -The following Custom Resource Definitions are used to configure logging: - -- [Flow and ClusterFlow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#flows-clusterflows) -- [Output and ClusterOutput](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#outputs-clusteroutputs) - -According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) - -> You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify. - -### RBAC -Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs. The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs. Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster. Cluster admin is the only role with full access to all rancher-logging resources. Cluster members are not able to edit or read any logging resources. Project owners are able to create namespaced flows and outputs in the namespaces under their projects. This means that project owners can collect logs from anything in their project namespaces. Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging. If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. - - -### Examples - -Let's say you wanted to send all logs in your cluster to an elasticsearch cluster. - -First lets create our cluster output: -```yaml -apiVersion: logging.banzaicloud.io/v1beta1 -kind: ClusterOutput -metadata: - name: "example-es" - namespace: "cattle-logging-system" -spec: - elasticsearch: - host: elasticsearch.example.com - port: 9200 - scheme: http -``` - -We have created a cluster output, without elasticsearch configuration, in the same namespace as our operator `cattle-logging-system.`. Any time we create a cluster flow or cluster output we have to put it in the `cattle-logging-system` namespace. - -Now we have configured where we want the logs to go, lets configure all logs to go to that output. - -```yaml -apiVersion: logging.banzaicloud.io/v1beta1 -kind: ClusterFlow -metadata: - name: "all-logs" - namespace: "cattle-logging-system" -spec: - globalOutputRefs: - - "example-es -``` - -We should now see our configured index with logs in it. - -What if we have an application team who only wants logs from a specific namespaces sent to a splunk server? For this case can use namespaced outputs and flows. - -Before we start lets set up a scenario. - -```yaml -apiVersion: v1 -kind: Namespace -metadata: - name: devteam ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: coolapp - namespace: devteam - labels: - app: coolapp -spec: - replicas: 2 - selector: - matchLabels: - app: coolapp - template: - metadata: - labels: - app: coolapp - spec: - containers: - - name: generator - image: paynejacob/loggenerator:latest -``` - -like before we start with an output, unlike cluster outputs we create our output in our application's namespace: - -```yaml -apiVersion: logging.banzaicloud.io/v1beta1 -kind: Output -metadata: - name: "devteam-splunk" - namespace: "devteam" -spec: - SplunkHec: - host: splunk.example.com - port: 8088 - protocol: http -``` - -Once again, lets give our output some logs: - -```yaml -apiVersion: logging.banzaicloud.io/v1beta1 -kind: Flow -metadata: - name: "devteam-logs" - namespace: "devteam" -spec: - localOutputRefs: - - "devteam-splunk" -``` - -For the final example we create an output to write logs to a destination that is not supported out of the box (e.g. syslog): - -```yaml -apiVersion: v1 -kind: Secret -metadata: - name: syslog-config - namespace: cattle-logging-system -type: Opaque -stringData: - fluent-bit.conf: | - [INPUT] - Name forward - Port 24224 - - [OUTPUT] - Name syslog - InstanceName syslog-output - Match * - Addr syslog.example.com - Port 514 - Cluster ranchers - ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: fluentbit-syslog-forwarder - namespace: cattle-logging-system - labels: - output: syslog -spec: - selector: - matchLabels: - output: syslog - template: - metadata: - labels: - output: syslog - spec: - containers: - - name: fluentbit - image: paynejacob/fluent-bit-out-syslog:latest - ports: - - containerPort: 24224 - volumeMounts: - - mountPath: "/fluent-bit/etc/" - name: configuration - volumes: - - name: configuration - secret: - secretName: syslog-config ---- -apiVersion: v1 -kind: Service -metadata: - name: syslog-forwarder - namespace: cattle-logging-system -spec: - selector: - output: syslog - ports: - - protocol: TCP - port: 24224 - targetPort: 24224 ---- -apiVersion: logging.banzaicloud.io/v1beta1 -kind: ClusterFlow -metadata: - name: all-logs - namespace: cattle-logging-system -spec: - globalOutputRefs: - - syslog ---- -apiVersion: logging.banzaicloud.io/v1beta1 -kind: ClusterOutput -metadata: - name: syslog - namespace: cattle-logging-system -spec: - forward: - servers: - - host: "syslog-forwarder.cattle-logging-system" - require_ack_response: false - ignore_network_errors_at_startup: false -``` - -if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd. Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination. +If you are using Rancher v2.5, refer to [this section.](./v2.5) +If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/logging/legacy/_index.md b/content/rancher/v2.x/en/logging/legacy/_index.md deleted file mode 100644 index bc1e2b9939a..00000000000 --- a/content/rancher/v2.x/en/logging/legacy/_index.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: Cluster Manager Logging Documentation -shortTitle: Cluster Manager -weight: 1 ---- - -This section contains documentation for the logging features that were available in Rancher prior to v2.5. \ No newline at end of file diff --git a/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md new file mode 100644 index 00000000000..f1f4043f0f0 --- /dev/null +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md @@ -0,0 +1,11 @@ +--- +title: Logging in Rancher v2.0.x-v2.4.x +shortTitle: Rancher v2.0.x-v2.4.x +weight: 2 +--- + + +This section contains documentation for the logging features that were available in Rancher prior to v2.5. + +- [Cluster logging](./cluster-logging) +- [Project logging](./project-logging) \ No newline at end of file diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/_index.md similarity index 97% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/_index.md index 3876450ee5e..d2bd9b44302 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/_index.md @@ -1,14 +1,16 @@ --- -title: Cluster Logging +title: Cluster Logging in Rancher v2.0.x-v2.4.x +shortTitle: Cluster Logging description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster. metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster." weight: 3 aliases: - /rancher/v2.x/en/tasks/logging/ - /rancher/v2.x/en/cluster-admin/tools/logging + - /rancher/v2.x/en/logging/legacy/cluster-logging --- -> In Rancher 2.5, the logging application was improved. There are now two ways to enable logging. The older way is documented in this section, and the new application for logging is documented [dashboard section.]({{}}/rancher/v2.x/en/logging) +> In Rancher 2.5, the logging application was improved. There are now two ways to enable logging. The older way is documented in this section, and the new application for logging is documented [here.]({{}}/rancher/v2.x/en/logging/v2.5) Logging is helpful because it allows you to: diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/elasticsearch/_index.md similarity index 97% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/elasticsearch/_index.md index a27b5674187..5c73295a132 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/elasticsearch/_index.md @@ -4,6 +4,7 @@ weight: 200 aliases: - /rancher/v2.x/en/tools/logging/elasticsearch/ - /rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch + - /rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch --- If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs. diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/fluentd/_index.md similarity index 96% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/fluentd/_index.md index 111cb33e007..a949f8628e1 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/fluentd/_index.md @@ -3,6 +3,7 @@ title: Fluentd weight: 600 aliases: - /rancher/v2.x/en/cluster-admin/tools/logging/fluentd + - /rancher/v2.x/en/logging/legacy/cluster-logging/fluentd --- If your organization uses [Fluentd](https://www.fluentd.org/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Fluentd server to view logs. diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/kafka/_index.md similarity index 97% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/kafka/_index.md index 06ef0b12b2b..272edef39e5 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/kafka/_index.md @@ -4,6 +4,7 @@ weight: 400 aliases: - /rancher/v2.x/en/tools/logging/kafka/ - /rancher/v2.x/en/cluster-admin/tools/logging/kafka + - /rancher/v2.x/en/logging/legacy/cluster-logging/kafka --- If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Kafka server to view logs. diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/splunk/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk/_index.md similarity index 98% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/splunk/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk/_index.md index dfb44d3c4b3..f2b336d1f9d 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/splunk/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk/_index.md @@ -5,6 +5,7 @@ aliases: - /rancher/v2.x/en/tasks/logging/splunk/ - /rancher/v2.x/en/tools/logging/splunk/ - /rancher/v2.x/en/cluster-admin/tools/logging/splunk + - /rancher/v2.x/en/logging/legacy/cluster-logging/splunk --- If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs. diff --git a/content/rancher/v2.x/en/logging/legacy/cluster-logging/syslog/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/syslog/_index.md similarity index 97% rename from content/rancher/v2.x/en/logging/legacy/cluster-logging/syslog/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/syslog/_index.md index a3d17dc5d73..3311547c173 100644 --- a/content/rancher/v2.x/en/logging/legacy/cluster-logging/syslog/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/syslog/_index.md @@ -4,6 +4,7 @@ weight: 500 aliases: - /rancher/v2.x/en/tools/logging/syslog/ - /rancher/v2.x/en/cluster-admin/tools/logging/syslog + - /rancher/v2.x/en/logging/legacy/cluster-logging/syslog --- If your organization uses [Syslog](https://tools.ietf.org/html/rfc5424), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Syslog server to view logs. diff --git a/content/rancher/v2.x/en/logging/legacy/project-logging/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/project-logging/_index.md similarity index 97% rename from content/rancher/v2.x/en/logging/legacy/project-logging/_index.md rename to content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/project-logging/_index.md index 6099cbdd09f..febca09d719 100644 --- a/content/rancher/v2.x/en/logging/legacy/project-logging/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/project-logging/_index.md @@ -1,8 +1,10 @@ --- -title: Project Logging +title: Project Logging in Rancher v2.0.x-v2.4.x +shortTitle: Project Logging weight: 2527 aliases: - /rancher/v2.x/en/project-admin/tools/logging + - /rancher/v2.x/en/logging/legacy/project-logging --- Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters. diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md new file mode 100644 index 00000000000..c666d66bbc1 --- /dev/null +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -0,0 +1,239 @@ +--- +title: Logging in Rancher v2.5 +shortTitle: Rancher v2.5 +weight: 1 +--- + +- [Changes in Rancher v2.5](#changes-in-rancher-v2-5) +- [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster) +- [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) +- [Configuring the Logging Application](#configuring-the-logging-application) + + +### Changes in Rancher v2.5 + +The following changes were introduced to logging in Rancher v2.5: + +- Rancher's logging feature is now powered the [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging-operator/) instead of Rancher's in-house logging solution. +- [Fluent Bit](https://fluentbit.io/) is now used to aggregate the logs. [Fluentd](https://www.fluentd.org/) is used for filtering the messages and routing them to the outputs. Previously, only Fluentd was used. +- Logging can be configured with a Kubernetes manifest, because now the logging uses a Kubernetes operator with Custom Resource Definitions. +- We now support filtering logs. +- We now support writing logs to multiple outputs. +- We now always collect Control Plane and etcd logs. + + +The following figure from the [Banzai documentation](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) shows the new logging architecture: + +
How the Banzai Cloud Logging Operator Works with Fluentd and Fluent Bit
+ +![How the Banzai Cloud Logging Operator Works with Fluentd]({{}}/img/rancher/banzai-cloud-logging-operator.png) + +### Configuring the Logging Output for the Rancher Kubernetes Cluster + +If you install Rancher as a Helm chart, you'll configure the Helm chart options to select a logging output for all the logs in the local Kubernetes cluster. + +If you install Rancher using the Rancher CLI on an Linux OS, the Rancher Helm chart will be installed on a Kubernetes cluster with default options. Then when the Rancher UI is available, you'll enable the logging app from the Apps section of the UI. Then during the process of installing the logging application, you will configure the logging output. + +### Enabling Logging for Rancher Managed Clusters + +If you have Enterprise Cluster Manager enabled, you can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. + +### Configuring the Logging Application + +The following Custom Resource Definitions are used to configure logging: + +- [Flow and ClusterFlow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#flows-clusterflows) +- [Output and ClusterOutput](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#outputs-clusteroutputs) + +According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) + +> You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify. + +### RBAC +Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs. The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs. Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster. Cluster admin is the only role with full access to all rancher-logging resources. Cluster members are not able to edit or read any logging resources. Project owners are able to create namespaced flows and outputs in the namespaces under their projects. This means that project owners can collect logs from anything in their project namespaces. Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging. If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. + + +### Examples + +Let's say you wanted to send all logs in your cluster to an elasticsearch cluster. + +First lets create our cluster output: +```yaml +apiVersion: logging.banzaicloud.io/v1beta1 +kind: ClusterOutput +metadata: + name: "example-es" + namespace: "cattle-logging-system" +spec: + elasticsearch: + host: elasticsearch.example.com + port: 9200 + scheme: http +``` + +We have created a cluster output, without elasticsearch configuration, in the same namespace as our operator `cattle-logging-system.`. Any time we create a cluster flow or cluster output we have to put it in the `cattle-logging-system` namespace. + +Now we have configured where we want the logs to go, lets configure all logs to go to that output. + +```yaml +apiVersion: logging.banzaicloud.io/v1beta1 +kind: ClusterFlow +metadata: + name: "all-logs" + namespace: "cattle-logging-system" +spec: + globalOutputRefs: + - "example-es +``` + +We should now see our configured index with logs in it. + +What if we have an application team who only wants logs from a specific namespaces sent to a splunk server? For this case can use namespaced outputs and flows. + +Before we start lets set up a scenario. + +```yaml +apiVersion: v1 +kind: Namespace +metadata: + name: devteam +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: coolapp + namespace: devteam + labels: + app: coolapp +spec: + replicas: 2 + selector: + matchLabels: + app: coolapp + template: + metadata: + labels: + app: coolapp + spec: + containers: + - name: generator + image: paynejacob/loggenerator:latest +``` + +like before we start with an output, unlike cluster outputs we create our output in our application's namespace: + +```yaml +apiVersion: logging.banzaicloud.io/v1beta1 +kind: Output +metadata: + name: "devteam-splunk" + namespace: "devteam" +spec: + SplunkHec: + host: splunk.example.com + port: 8088 + protocol: http +``` + +Once again, lets give our output some logs: + +```yaml +apiVersion: logging.banzaicloud.io/v1beta1 +kind: Flow +metadata: + name: "devteam-logs" + namespace: "devteam" +spec: + localOutputRefs: + - "devteam-splunk" +``` + +For the final example we create an output to write logs to a destination that is not supported out of the box (e.g. syslog): + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: syslog-config + namespace: cattle-logging-system +type: Opaque +stringData: + fluent-bit.conf: | + [INPUT] + Name forward + Port 24224 + + [OUTPUT] + Name syslog + InstanceName syslog-output + Match * + Addr syslog.example.com + Port 514 + Cluster ranchers + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fluentbit-syslog-forwarder + namespace: cattle-logging-system + labels: + output: syslog +spec: + selector: + matchLabels: + output: syslog + template: + metadata: + labels: + output: syslog + spec: + containers: + - name: fluentbit + image: paynejacob/fluent-bit-out-syslog:latest + ports: + - containerPort: 24224 + volumeMounts: + - mountPath: "/fluent-bit/etc/" + name: configuration + volumes: + - name: configuration + secret: + secretName: syslog-config +--- +apiVersion: v1 +kind: Service +metadata: + name: syslog-forwarder + namespace: cattle-logging-system +spec: + selector: + output: syslog + ports: + - protocol: TCP + port: 24224 + targetPort: 24224 +--- +apiVersion: logging.banzaicloud.io/v1beta1 +kind: ClusterFlow +metadata: + name: all-logs + namespace: cattle-logging-system +spec: + globalOutputRefs: + - syslog +--- +apiVersion: logging.banzaicloud.io/v1beta1 +kind: ClusterOutput +metadata: + name: syslog + namespace: cattle-logging-system +spec: + forward: + servers: + - host: "syslog-forwarder.cattle-logging-system" + require_ack_response: false + ignore_network_errors_at_startup: false +``` + +if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd. Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination. \ No newline at end of file diff --git a/content/rancher/v2.x/en/longhorn/_index.md b/content/rancher/v2.x/en/longhorn/_index.md index 350e67e1068..14a4cf19f1e 100644 --- a/content/rancher/v2.x/en/longhorn/_index.md +++ b/content/rancher/v2.x/en/longhorn/_index.md @@ -21,7 +21,9 @@ With Longhorn, you can: ### New in Rancher v2.5 -Prior to Rancher v2.5, Longhorn could be installed as a Rancher catalog app. In Rancher v2.5, the catalog system was replaced by the **Apps & Marketplace,** and it became possible to install Longhorn as an app from that page. The **Cluster Explorer** now allows you to manipulate Longhorn's Kubernetes resources from the Rancher UI. So now you can control the Longhorn functionality with the Longhorn UI, or with kubectl, or by manipulating Longhorn's Kubernetes custom resources in the Rancher UI. +Prior to Rancher v2.5, Longhorn could be installed as a Rancher catalog app. In Rancher v2.5, the catalog system was replaced by the **Apps & Marketplace,** and it became possible to install Longhorn as an app from that page. + +The **Cluster Explorer** now allows you to manipulate Longhorn's Kubernetes resources from the Rancher UI. So now you can control the Longhorn functionality with the Longhorn UI, or with kubectl, or by manipulating Longhorn's Kubernetes custom resources in the Rancher UI. These instructions assume you are using Rancher v2.5, but Longhorn can be installed with earlier Rancher versions. For documentation about installing Longhorn as a catalog app using the legacy Rancher UI, refer to the [Longhorn documentation.](https://longhorn.io/docs/1.0.2/deploy/install/install-with-rancher/) diff --git a/content/rancher/v2.x/en/monitoring-alerting/_index.md b/content/rancher/v2.x/en/monitoring-alerting/_index.md index c9d75dae3b0..9b6e00b6190 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/_index.md @@ -9,185 +9,6 @@ aliases: - /rancher/v2.x/en/cluster-admin/tools/monitoring/ --- -Using Rancher, you can quickly deploy leading open-source monitoring & alerting solutions such as [Prometheus](https://prometheus.io/), [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/), and [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) onto your cluster. +If you are using Rancher v2.5, refer to [this section.](./v2.5) -Rancher's solution (powered by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) allows users to: - -- Monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments via [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. - -- Defines alerts based on metrics collected via [Prometheus](https://prometheus.io/) -- Creates custom dashboards to make it easy to visualize collected metrics via [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) -- Configures alert-based notifications via Email, Slack, PagerDuty, etc. using [Prometheus Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) -- Defines precomputed frequently needed / computationally expensive expressions as new time series based on metrics collected via [Prometheus](https://prometheus.io/) (only available in 2.5.x) -- Exposes collected metrics from Prometheus to the Kubernetes Custom Metrics API via [Prometheus Adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter) for use in HPA (only available in 2.5) - -More information about the resources that get deployed onto your cluster to support this solution can be found in the [`rancher-monitoring`](https://github.com/rancher/charts/tree/main/charts/rancher-monitoring) Helm chart, which closely tracks the upstream [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) Helm chart maintained by the Prometheus community with certain changes tracked in the [CHANGELOG.md](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/CHANGELOG.md). - -This page describes how to enable monitoring & alerting within a cluster using Rancher's new monitoring application, which was introduced in Rancher v2.5. - -If you previously enabled Monitoring, Alerting, or Notifiers in Rancher prior to v2.5, there is no upgrade path for switching to the new monitoring/ alerting solution. You will need to disable monitoring/ alerting/notifiers in Cluster Manager before deploying the new monitoring solution via Cluster Explorer. - -For more information about upgrading the Monitoring app in Rancher 2.5, please refer to the [migration docs](../migrating). - -For the docs about monitoring for earlier Rancher versions, refer to [this section.](../legacy) - -> Before enabling monitoring, be sure to review the resource requirements. The default values in [this section](#setting-resource-limits-and-requests) are the minimum required resource limits and requests. - -- [Monitoring Components](#monitoring-components) - - [Prometheus](#about-prometheus) - - [Grafana](#about-grafana) - - [Alertmanager](#about-alertmanager) - - [Prometheus Operator](#about-prometheus-operator) - - [Prometheus Adapter](#about-prometheus-adapter) -- [Enable Monitoring](#enable-monitoring) - - [Default Alerts, Targets and Grafana Dashboards](#default-alerts-targets-and-grafana-dashboards) -- [Using Monitoring](#using-monitoring) - - [Grafana UI](#grafana-ui) - - [Prometheus UI](#prometheus-ui) - - [Viewing the Prometheus Targets](#viewing-the-prometheus-targets) - - [Viewing the Prometheus Rules](#viewing-the-prometheus-rules) - - [Viewing Active Alerts in Alertmanager](#viewing-active-alerts-in-alertmanager) -- [Uninstall Monitoring](#uninstall-monitoring) -- [Setting Resource Limits and Requests](#setting-resource-limits-and-requests) -- [Known Issues](#known-issues) - -# Monitoring Components - -The `rancher-monitoring` operator is powered by Prometheus, Grafana, Alertmanager, the Prometheus Operator, and the Prometheus adapter. - -### About Prometheus - -Prometheus provides a time series of your data, which is, according to the [Prometheus documentation:](https://prometheus.io/docs/concepts/data_model/) - -> A stream of timestamped values belonging to the same metric and the same set of labeled dimensions, along with comprehensive statistics and metrics of the monitored cluster. - -In other words, Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Using timestamps, Prometheus lets you query and view these metrics in easy-to-read graphs and visuals, either through the Rancher UI or Grafana, which is an analytics viewing platform deployed along with Prometheus. - -By viewing data that Prometheus scrapes from your cluster control plane, nodes, and deployments, you can stay on top of everything happening in your cluster. You can then use these analytics to better run your organization: stop system emergencies before they start, develop maintenance strategies, restore crashed servers, etc. - -### About Grafana - -[Grafana](https://grafana.com/grafana/) allows you to query, visualize, alert on and understand your metrics no matter where they are stored. Create, explore, and share dashboards with your team and foster a data driven culture. - -# Enabling Cluster Monitoring - -As an [administrator]({{}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster. - -> If you want to set up Alertmanager, Grafana or Ingress, it has to be done with the settings on the Helm chart deployment. It's problematic to create Ingress outside the deployment. - -> **Prerequisites:** -> -> - Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here. -> - Make sure your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. A breakdown of the resource limits and requests is [here.](#resource-requirements) - -1. In the Rancher UI, go to the cluster where you want to install monitoring and click **Cluster Explorer.** -1. Click **Apps.** -1. Click the `rancher-monitoring` app. -1. Optional: Click **Chart Options** and configure alerting, Prometheus and Grafana. For help, refer to the [configuration reference.](../configuration) -1. Scroll to the bottom of the Helm chart README and click **Install.** - -**Result:** The monitoring app is deployed in the `cattle-monitoring-system` namespace. - -### Default Alerts, Targets and Grafana Dashboards - -By default, Rancher Monitoring deploys exporters (such as [node-exporter](https://github.com/prometheus/node_exporter) and [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics)) as well as default Prometheus alerts and Grafana dashboards (curated by the [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) project) onto a cluster. - -To see the default alerts, go to the [Alertmanager UI](#alertmanager-ui) and click **Expand all groups.** - -To see what services you are monitoring, you will need to see your targets. To view the default targets, refer to [Viewing the Prometheus Targets.](#viewing-the-prometheus-targets) - -To see the default dashboards, go to the [Grafana UI.](#grafana-ui) In the left navigation bar, click the icon with four boxes and click **Manage.** - -### Next Steps - -To configure Prometheus resources from the Rancher UI, click **Apps & Marketplace > Monitoring** in the upper left corner. - -# Using Monitoring - -Installing `rancher-monitoring` makes the following dashboards available from the Rancher UI. - -### Grafana UI - -Rancher allows any users who are authenticated by Kubernetes and have access the Grafana service deployed by the Rancher Monitoring chart to access Grafana via the Rancher Dashboard UI. By default, all users who are able to access Grafana are given the [Viewer](https://grafana.com/docs/grafana/latest/permissions/organization_roles/#viewer-role) role, which allows them to view any of the default dashboards deployed by Rancher. - -However, users can choose to log in to Grafana as an [Admin](https://grafana.com/docs/grafana/latest/permissions/organization_roles/#admin-role) if necessary. The default Admin username and password for the Grafana instance will be `admin`/`prom-operator`, but alternative credentials can also be supplied on deploying or upgrading the chart. - -To see the Grafana UI, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Grafana. - -
Cluster Compute Resources Dashboard in Grafana
-![Cluster Compute Resources Dashboard in Grafana]({{}}/img/rancher/cluster-compute-resources-dashboard.png) - -
Default Dashboards in Grafana
-![Default Dashboards in Grafana]({{}}/img/rancher/default-grafana-dashboards.png) - -To allow the Grafana dashboard to persist after it restarts, you will need to add the configuration JSON into a ConfigMap. You can add this configuration to the ConfigMap using the Rancher UI. - -### Prometheus UI - -To see the Prometheus UI, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Graph.** - -
Prometheus Graph UI
-![Prometheus Graph UI]({{}}/img/rancher/prometheus-graph-ui.png) - -### Viewing the Prometheus Targets - -To see the Prometheus Targets, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Targets.** - -
Targets in the Prometheus UI
-![Prometheus Targets UI]({{}}/img/rancher/prometheus-targets-ui.png) - -### Viewing the Prometheus Rules - -To see the Prometheus Rules, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Rules.** - -
Rules in the Prometheus UI
-![Prometheus Rules UI]({{}}/img/rancher/prometheus-rules-ui.png) - -### Viewing Active Alerts in Alertmanager - -When `rancher-monitoring` is installed, the Prometheus Alertmanager UI is deployed. - -The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. - -In the Alertmanager UI, you can view your alerts and the current Alertmanager configuration. - -To see the Prometheus Rules, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Alertmanager.** - -**Result:** The Alertmanager UI opens in a new tab. For help with configuration, refer to the [official Alertmanager documentation.](https://prometheus.io/docs/alerting/latest/alertmanager/) - -
The Alertmanager UI
-![Alertmanager UI]({{}}/img/rancher/alertmanager-ui.png) - -# Uninstall Monitoring - -1. From the **Cluster Explorer,** click Apps & Marketplace. -1. Click **Installed Apps.** -1. Go to the `cattle-monitoring-system` namespace and check the boxes for `rancher-monitoring-crd` and `rancher-monitoring`. -1. Click **Delete.** -1. Confirm **Delete.** - -**Result:** `rancher-monitoring` is uninstalled. - -# Setting Resource Limits and Requests - -The resource requests and limits can be configured when installing `rancher-monitoring`. - -The default values are in the [values.yaml](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/values.yaml) in the `rancher-monitoring` Helm chart. - -The default values in the table below are the minimum required resource limits and requests. - -| Resource Name | Memory Limit | CPU Limit | Memory Request | CPU Request | -| ------------- | ------------ | ----------- | ---------------- | ------------------ | -| alertmanager | 500Mi | 1000m | 100Mi | 100m | -| grafana | 200Mi | 200m | 100Mi | 100m | -| kube-state-metrics subchart | 200Mi | 100m | 130Mi | 100m | -| prometheus-node-exporter subchart | 50Mi | 200m | 30Mi | 100m | -| prometheusOperator | 500Mi | 200m | 100Mi | 100m | -| prometheus | 2500Mi | 1000m | 1750Mi | 750m | -| **Total** | **3950Mi** | **2700m** | **2210Mi** | **1250m** | - -At least 50Gi storage is recommended. - -# Known Issues - -There is a [known issue](https://github.com/rancher/rancher/issues/28787#issuecomment-693611821) that K3s clusters require more default memory. If you are enabling monitoring on a K3s cluster, we recommend to setting `prometheus.prometheusSpec.resources.memory.limit` to 2500Mi` and `prometheus.prometheusSpec.resources.memory.request` to 1750Mi. +If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md deleted file mode 100644 index 7027d801495..00000000000 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: Cluster Manager Monitoring/Alerting Documentation -shortTitle: Cluster Manager -weight: 1 ---- - -This section contains documentation related to the monitoring features available in Rancher prior to v2.5. \ No newline at end of file diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md deleted file mode 100644 index 1cb62c544bf..00000000000 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Monitoring -weight: 1 ---- \ No newline at end of file diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md new file mode 100644 index 00000000000..002a763d472 --- /dev/null +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md @@ -0,0 +1,15 @@ +--- +title: Monitoring in Rancher v2.0.x-v2.4.x +shortTitle: Rancher v2.0.x-v2.4.x +weight: 2 +--- + +This section contains documentation related to the monitoring features available in Rancher prior to v2.5. + + + +- [Cluster Monitoring](./cluster-monitoring) + - [Project Monitoring](./cluster-monitoring/project-monitoring) +- [Cluster Alerts](./cluster-alerts) + - [Project Alerts](./cluster-alerts/project-alerts) +- [Notifiers](./notifiers) diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/_index.md similarity index 99% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/_index.md index 08abf054a10..7ab29bf56df 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/_index.md @@ -2,7 +2,8 @@ title: Cluster Alerts weight: 2 aliases: - - rancher/v2.x/en/cluster-admin/tools/alerts + - /rancher/v2.x/en/cluster-admin/tools/alerts + - /rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts --- > In Rancher 2.5, the monitoring application was improved. There are now two ways to enable monitoring and alerting. The older way is documented in this section, and the new application for monitoring and alerting is documented [here.]({{}}/rancher/v2.x/en/monitoring-alerting) diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/default-alerts/_index.md similarity index 96% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/default-alerts/_index.md index 7242fb7cdc5..aaeff9e5a3b 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/default-alerts/_index.md @@ -2,7 +2,8 @@ title: Default Alerts for Cluster Monitoring weight: 1 aliases: - - rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts + - /rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts + - /rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts --- When you create a cluster, some alert rules are predefined. These alerts notify you about signs that the cluster could be unhealthy. You can receive these alerts if you configure a [notifier]({{}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them. diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/project-alerts/_index.md similarity index 98% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/project-alerts/_index.md index a9386817c72..0bb9c6a6f4c 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-alerts/project-alerts/_index.md @@ -2,7 +2,8 @@ title: Project Alerts weight: 2526 aliases: - - rancher/v2.x/en/project-admin/tools/alerts + - /rancher/v2.x/en/project-admin/tools/alerts + - /rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts --- To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions. diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/_index.md similarity index 97% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/_index.md index e0aef4ad107..ef0f37d26d5 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/_index.md @@ -2,9 +2,11 @@ title: Integrating Rancher and Prometheus for Cluster Monitoring shortTitle: Cluster Monitoring description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring -weight: 4 +weight: 1 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring + - /rancher/v2.x/en/project-admin/tools/monitoring + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring + - /rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/monitoring/cluster-monitoring --- _Available as of v2.2.0_ diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/cluster-metrics/_index.md similarity index 98% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/cluster-metrics/_index.md index 02f6b191c45..0a7a7981f0d 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/cluster-metrics/_index.md @@ -4,6 +4,7 @@ weight: 3 aliases: - /rancher/v2.x/en/project-admin/tools/monitoring/cluster-metrics - /rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics --- _Available as of v2.2.0_ diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/custom-metrics/_index.md similarity index 99% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/custom-metrics/_index.md index 875bc0c0a65..14c6e8af88f 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/custom-metrics/_index.md @@ -2,7 +2,8 @@ title: Prometheus Custom Metrics Adapter weight: 5 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring/custom-metrics + - /rancher/v2.x/en/project-admin/tools/monitoring/custom-metrics + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics --- After you've enabled [cluster level monitoring]({{< baseurl >}}/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/#enabling-cluster-monitoring), You can view the metrics data from Rancher. You can also deploy the Prometheus custom metrics adapter then you can use the HPA with metrics stored in cluster monitoring. diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/expression/_index.md similarity index 99% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/expression/_index.md index b413a3f6932..daa7524e606 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/expression/_index.md @@ -2,8 +2,9 @@ title: Prometheus Expressions weight: 4 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring/expression + - /rancher/v2.x/en/project-admin/tools/monitoring/expression - /rancher/v2.x/en/cluster-admin/tools/monitoring/expression + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression --- The PromQL expressions in this doc can be used to configure [alerts.]({{}}/rancher/v2.x/en/cluster-admin/tools/alerts/) diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/project-monitoring/_index.md similarity index 97% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/project-monitoring/_index.md index a938712446f..de970e2a923 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/project-monitoring/_index.md @@ -1,8 +1,9 @@ --- title: Project Monitoring -weight: 2528 +weight: 2 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring + - /rancher/v2.x/en/project-admin/tools/monitoring + - /rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/monitoring/project-monitoring --- _Available as of v2.2.4_ diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/prometheus/_index.md similarity index 97% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/prometheus/_index.md index d99e02b8069..f817e8603ca 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/prometheus/_index.md @@ -2,8 +2,9 @@ title: Prometheus Configuration weight: 1 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring/prometheus + - /rancher/v2.x/en/project-admin/tools/monitoring/prometheus - /rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/ + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus --- _Available as of v2.2.0_ diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/viewing-metrics/_index.md similarity index 96% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/viewing-metrics/_index.md index b4ceac3bb92..070c6dbf706 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/cluster-monitoring/viewing-metrics/_index.md @@ -2,8 +2,9 @@ title: Viewing Metrics weight: 2 aliases: - - rancher/v2.x/en/project-admin/tools/monitoring/viewing-metrics - - rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics + - /rancher/v2.x/en/project-admin/tools/monitoring/viewing-metrics + - /rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics + - /rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics --- _Available as of v2.2.0_ diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/notifiers/_index.md similarity index 98% rename from content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/notifiers/_index.md index 9292f5fe087..a4bb73060ce 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/notifiers/_index.md @@ -1,10 +1,10 @@ --- title: Notifiers -weight: 1 +weight: 4 aliases: - - rancher/v2.x/en/project-admin/tools/notifiers - - rancher/v2.x/en/cluster-admin/tools/notifiers + - /rancher/v2.x/en/project-admin/tools/notifiers - /rancher/v2.x/en/cluster-admin/tools/notifiers + - /rancher/v2.x/en/monitoring-alerting/legacy/notifiers --- > In Rancher 2.5, the notifier application was improved. There are now two ways to enable notifiers. The older way is documented in this section, and the new application for notifiers is documented [here.]({{}}/rancher/v2.x/en/monitoring-alerting) diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md new file mode 100644 index 00000000000..539474123fa --- /dev/null +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -0,0 +1,189 @@ +--- +title: Monitoring in Rancher v2.5 +shortTitle: Rancher v2.5 +weight: 1 +--- + + +Using Rancher, you can quickly deploy leading open-source monitoring & alerting solutions such as [Prometheus](https://prometheus.io/), [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/), and [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) onto your cluster. + +Rancher's solution (powered by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) allows users to: + +- Monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments via [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. + +- Defines alerts based on metrics collected via [Prometheus](https://prometheus.io/) +- Creates custom dashboards to make it easy to visualize collected metrics via [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) +- Configures alert-based notifications via Email, Slack, PagerDuty, etc. using [Prometheus Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) +- Defines precomputed frequently needed / computationally expensive expressions as new time series based on metrics collected via [Prometheus](https://prometheus.io/) (only available in 2.5.x) +- Exposes collected metrics from Prometheus to the Kubernetes Custom Metrics API via [Prometheus Adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter) for use in HPA (only available in 2.5) + +More information about the resources that get deployed onto your cluster to support this solution can be found in the [`rancher-monitoring`](https://github.com/rancher/charts/tree/main/charts/rancher-monitoring) Helm chart, which closely tracks the upstream [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) Helm chart maintained by the Prometheus community with certain changes tracked in the [CHANGELOG.md](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/CHANGELOG.md). + +This page describes how to enable monitoring & alerting within a cluster using Rancher's new monitoring application, which was introduced in Rancher v2.5. + +If you previously enabled Monitoring, Alerting, or Notifiers in Rancher prior to v2.5, there is no upgrade path for switching to the new monitoring/ alerting solution. You will need to disable monitoring/ alerting/notifiers in Cluster Manager before deploying the new monitoring solution via Cluster Explorer. + +For more information about upgrading the Monitoring app in Rancher 2.5, please refer to the [migration docs](../migrating). + +For the docs about monitoring for earlier Rancher versions, refer to [this section.](../legacy) + +> Before enabling monitoring, be sure to review the resource requirements. The default values in [this section](#setting-resource-limits-and-requests) are the minimum required resource limits and requests. + +- [Monitoring Components](#monitoring-components) + - [Prometheus](#about-prometheus) + - [Grafana](#about-grafana) + - [Alertmanager](#about-alertmanager) + - [Prometheus Operator](#about-prometheus-operator) + - [Prometheus Adapter](#about-prometheus-adapter) +- [Enable Monitoring](#enable-monitoring) + - [Default Alerts, Targets and Grafana Dashboards](#default-alerts-targets-and-grafana-dashboards) +- [Using Monitoring](#using-monitoring) + - [Grafana UI](#grafana-ui) + - [Prometheus UI](#prometheus-ui) + - [Viewing the Prometheus Targets](#viewing-the-prometheus-targets) + - [Viewing the Prometheus Rules](#viewing-the-prometheus-rules) + - [Viewing Active Alerts in Alertmanager](#viewing-active-alerts-in-alertmanager) +- [Uninstall Monitoring](#uninstall-monitoring) +- [Setting Resource Limits and Requests](#setting-resource-limits-and-requests) +- [Known Issues](#known-issues) + +# Monitoring Components + +The `rancher-monitoring` operator is powered by Prometheus, Grafana, Alertmanager, the Prometheus Operator, and the Prometheus adapter. + +### About Prometheus + +Prometheus provides a time series of your data, which is, according to the [Prometheus documentation:](https://prometheus.io/docs/concepts/data_model/) + +> A stream of timestamped values belonging to the same metric and the same set of labeled dimensions, along with comprehensive statistics and metrics of the monitored cluster. + +In other words, Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Using timestamps, Prometheus lets you query and view these metrics in easy-to-read graphs and visuals, either through the Rancher UI or Grafana, which is an analytics viewing platform deployed along with Prometheus. + +By viewing data that Prometheus scrapes from your cluster control plane, nodes, and deployments, you can stay on top of everything happening in your cluster. You can then use these analytics to better run your organization: stop system emergencies before they start, develop maintenance strategies, restore crashed servers, etc. + +### About Grafana + +[Grafana](https://grafana.com/grafana/) allows you to query, visualize, alert on and understand your metrics no matter where they are stored. Create, explore, and share dashboards with your team and foster a data driven culture. + +# Enabling Cluster Monitoring + +As an [administrator]({{}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster. + +> If you want to set up Alertmanager, Grafana or Ingress, it has to be done with the settings on the Helm chart deployment. It's problematic to create Ingress outside the deployment. + +> **Prerequisites:** +> +> - Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here. +> - Make sure your cluster fulfills the resource requirements. The cluster should have at least 1950Mi memory available, 2700m CPU, and 50Gi storage. A breakdown of the resource limits and requests is [here.](#resource-requirements) + +1. In the Rancher UI, go to the cluster where you want to install monitoring and click **Cluster Explorer.** +1. Click **Apps.** +1. Click the `rancher-monitoring` app. +1. Optional: Click **Chart Options** and configure alerting, Prometheus and Grafana. For help, refer to the [configuration reference.](../configuration) +1. Scroll to the bottom of the Helm chart README and click **Install.** + +**Result:** The monitoring app is deployed in the `cattle-monitoring-system` namespace. + +### Default Alerts, Targets and Grafana Dashboards + +By default, Rancher Monitoring deploys exporters (such as [node-exporter](https://github.com/prometheus/node_exporter) and [kube-state-metrics](https://github.com/kubernetes/kube-state-metrics)) as well as default Prometheus alerts and Grafana dashboards (curated by the [kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) project) onto a cluster. + +To see the default alerts, go to the [Alertmanager UI](#alertmanager-ui) and click **Expand all groups.** + +To see what services you are monitoring, you will need to see your targets. To view the default targets, refer to [Viewing the Prometheus Targets.](#viewing-the-prometheus-targets) + +To see the default dashboards, go to the [Grafana UI.](#grafana-ui) In the left navigation bar, click the icon with four boxes and click **Manage.** + +### Next Steps + +To configure Prometheus resources from the Rancher UI, click **Apps & Marketplace > Monitoring** in the upper left corner. + +# Using Monitoring + +Installing `rancher-monitoring` makes the following dashboards available from the Rancher UI. + +### Grafana UI + +Rancher allows any users who are authenticated by Kubernetes and have access the Grafana service deployed by the Rancher Monitoring chart to access Grafana via the Rancher Dashboard UI. By default, all users who are able to access Grafana are given the [Viewer](https://grafana.com/docs/grafana/latest/permissions/organization_roles/#viewer-role) role, which allows them to view any of the default dashboards deployed by Rancher. + +However, users can choose to log in to Grafana as an [Admin](https://grafana.com/docs/grafana/latest/permissions/organization_roles/#admin-role) if necessary. The default Admin username and password for the Grafana instance will be `admin`/`prom-operator`, but alternative credentials can also be supplied on deploying or upgrading the chart. + +To see the Grafana UI, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Grafana. + +
Cluster Compute Resources Dashboard in Grafana
+![Cluster Compute Resources Dashboard in Grafana]({{}}/img/rancher/cluster-compute-resources-dashboard.png) + +
Default Dashboards in Grafana
+![Default Dashboards in Grafana]({{}}/img/rancher/default-grafana-dashboards.png) + +To allow the Grafana dashboard to persist after it restarts, you will need to add the configuration JSON into a ConfigMap. You can add this configuration to the ConfigMap using the Rancher UI. + +### Prometheus UI + +To see the Prometheus UI, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Graph.** + +
Prometheus Graph UI
+![Prometheus Graph UI]({{}}/img/rancher/prometheus-graph-ui.png) + +### Viewing the Prometheus Targets + +To see the Prometheus Targets, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Targets.** + +
Targets in the Prometheus UI
+![Prometheus Targets UI]({{}}/img/rancher/prometheus-targets-ui.png) + +### Viewing the Prometheus Rules + +To see the Prometheus Rules, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Prometheus Rules.** + +
Rules in the Prometheus UI
+![Prometheus Rules UI]({{}}/img/rancher/prometheus-rules-ui.png) + +### Viewing Active Alerts in Alertmanager + +When `rancher-monitoring` is installed, the Prometheus Alertmanager UI is deployed. + +The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. + +In the Alertmanager UI, you can view your alerts and the current Alertmanager configuration. + +To see the Prometheus Rules, install `rancher-monitoring`. Then go to the **Cluster Explorer.** In the top left corner, click **Cluster Explorer > Monitoring.** Then click **Alertmanager.** + +**Result:** The Alertmanager UI opens in a new tab. For help with configuration, refer to the [official Alertmanager documentation.](https://prometheus.io/docs/alerting/latest/alertmanager/) + +
The Alertmanager UI
+![Alertmanager UI]({{}}/img/rancher/alertmanager-ui.png) + +# Uninstall Monitoring + +1. From the **Cluster Explorer,** click Apps & Marketplace. +1. Click **Installed Apps.** +1. Go to the `cattle-monitoring-system` namespace and check the boxes for `rancher-monitoring-crd` and `rancher-monitoring`. +1. Click **Delete.** +1. Confirm **Delete.** + +**Result:** `rancher-monitoring` is uninstalled. + +# Setting Resource Limits and Requests + +The resource requests and limits can be configured when installing `rancher-monitoring`. + +The default values are in the [values.yaml](https://github.com/rancher/charts/blob/main/charts/rancher-monitoring/values.yaml) in the `rancher-monitoring` Helm chart. + +The default values in the table below are the minimum required resource limits and requests. + +| Resource Name | Memory Limit | CPU Limit | Memory Request | CPU Request | +| ------------- | ------------ | ----------- | ---------------- | ------------------ | +| alertmanager | 500Mi | 1000m | 100Mi | 100m | +| grafana | 200Mi | 200m | 100Mi | 100m | +| kube-state-metrics subchart | 200Mi | 100m | 130Mi | 100m | +| prometheus-node-exporter subchart | 50Mi | 200m | 30Mi | 100m | +| prometheusOperator | 500Mi | 200m | 100Mi | 100m | +| prometheus | 2500Mi | 1000m | 1750Mi | 750m | +| **Total** | **3950Mi** | **2700m** | **2210Mi** | **1250m** | + +At least 50Gi storage is recommended. + +# Known Issues + +There is a [known issue](https://github.com/rancher/rancher/issues/28787#issuecomment-693611821) that K3s clusters require more default memory. If you are enabling monitoring on a K3s cluster, we recommend to setting `prometheus.prometheusSpec.resources.memory.limit` to 2500Mi` and `prometheus.prometheusSpec.resources.memory.request` to 1750Mi. diff --git a/content/rancher/v2.x/en/monitoring-alerting/configuration/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/_index.md similarity index 99% rename from content/rancher/v2.x/en/monitoring-alerting/configuration/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/_index.md index e8c9ecf627d..4ad287a383f 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/configuration/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/_index.md @@ -1,6 +1,8 @@ --- title: Configuration weight: 3 +aliases: + - /rancher/v2.x/en/monitoring-alerting/configuration --- This page captures some of the most important options for configuring the custom resources for monitoring. diff --git a/content/rancher/v2.x/en/monitoring-alerting/migrating/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md similarity index 98% rename from content/rancher/v2.x/en/monitoring-alerting/migrating/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md index 9c1e61e9ff9..918337a8194 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/migrating/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md @@ -1,6 +1,8 @@ --- title: Migrating to Rancher v2.5 Monitoring weight: 5 +aliases: + - /rancher/v2.x/en/monitoring-alerting/migrating --- If you previously enabled Monitoring, Alerting, or Notifiers in Rancher prior to v2.5, there is no upgrade path for switching to the new monitoring/alerting solution. You will need to disable monitoring/alerting/notifiers in the same way it was disabled in Rancher v2.4 before deploying the new monitoring solution via Cluster Explorer. diff --git a/content/rancher/v2.x/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/rbac/_index.md similarity index 99% rename from content/rancher/v2.x/en/monitoring-alerting/rbac/_index.md rename to content/rancher/v2.x/en/monitoring-alerting/v2.5/rbac/_index.md index cb39c6c0c6c..14d2b1bcb16 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/rbac/_index.md @@ -3,6 +3,7 @@ title: RBAC weight: 3 aliases: - /rancher/v2.x/en/cluster-admin/tools/monitoring/rbac + - /rancher/v2.x/en/monitoring-alerting/rbac --- This section describes the expectations for RBAC for Rancher Monitoring. From aaf97b6e7bc4951bcfabe9be7ae71cb09cf1d226 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 11:54:03 -0700 Subject: [PATCH 3/6] Update docs nav based on feedback --- config.toml | 2 +- content/rancher/v2.x/en/backups/_index.md | 2 +- content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md | 2 +- content/rancher/v2.x/en/deploy-across-clusters/_index.md | 6 ++++-- .../en/deploy-across-clusters/multi-cluster-apps/_index.md | 2 +- .../rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md | 4 ++-- content/rancher/v2.x/en/istio/_index.md | 2 +- content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md | 6 +++--- content/rancher/v2.x/en/logging/_index.md | 2 +- content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md | 4 ++-- content/rancher/v2.x/en/monitoring-alerting/_index.md | 2 +- .../v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md | 4 ++-- 12 files changed, 20 insertions(+), 18 deletions(-) diff --git a/config.toml b/config.toml index 4cdea8ac743..d83fb46671b 100644 --- a/config.toml +++ b/config.toml @@ -5,7 +5,7 @@ title = "Rancher Labs" theme = "rancher-website-theme" themesDir = "node_modules" pluralizeListTitles = false -timeout = 30000 +timeout = 60000 enableRobotsTXT = true pygmentsCodeFences = true diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md index 0f855ff2540..42a09dd9025 100644 --- a/content/rancher/v2.x/en/backups/_index.md +++ b/content/rancher/v2.x/en/backups/_index.md @@ -5,4 +5,4 @@ weight: 5 If you are using Rancher v2.5, refer to [this section.](./v2.5) -If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file +If you are using Rancher v2.0-v2.4, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md index 8c0011fae6c..19997c81903 100644 --- a/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md +++ b/content/rancher/v2.x/en/backups/v2.0.x-v2.4.x/_index.md @@ -1,5 +1,5 @@ --- -title: Rancher v2.0.x-v2.4.x +title: Rancher v2.0-v2.4 weight: 2 --- diff --git a/content/rancher/v2.x/en/deploy-across-clusters/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/_index.md index 9f4a3126428..da1d2ef7317 100644 --- a/content/rancher/v2.x/en/deploy-across-clusters/_index.md +++ b/content/rancher/v2.x/en/deploy-across-clusters/_index.md @@ -3,14 +3,16 @@ title: Deploying Applications across Clusters weight: 13 --- -Rancher v2.5 introduced Fleet, a new way to deploy applications across clusters. + ### Fleet _Available in v2.5_ +Rancher v2.5 introduced Fleet, a new way to deploy applications across clusters. + Fleet is GitOps at scale. For more information, refer to the [Fleet section.](./fleet) -### Cluster Manager UI Documentation for Multi-cluster Apps +### Multi-cluster Apps In Rancher prior to v2.5, the multi-cluster apps feature was used to deploy applications across clusters. Refer to the documentation [here.](./multi-cluster-apps) \ No newline at end of file diff --git a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md index b69ddac0928..f0adc3323b9 100644 --- a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md +++ b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md @@ -1,6 +1,6 @@ --- title: Multi-cluster Apps -shortTitle: Rancher v2.2.0-v2.4.x +shortTitle: Rancher v2.2-v2.4 weight: 2 --- diff --git a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md index 8ad67dd78f6..2e97a46c202 100644 --- a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md +++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md @@ -1,6 +1,6 @@ --- -title: Rancher v2.0.x-v2.4.x Catalogs (Deprecated) -shortTitle: Rancher v2.0.x-v2.4.x +title: Rancher v2.0-v2.4 Catalogs (Deprecated) +shortTitle: Rancher v2.0-v2.4 description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps. weight: 1 aliases: diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md index e34233f81d0..0534d1d2bb4 100644 --- a/content/rancher/v2.x/en/istio/_index.md +++ b/content/rancher/v2.x/en/istio/_index.md @@ -10,4 +10,4 @@ In Rancher 2.5, the Istio application was improved. If you are using Rancher v2.5, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.5) -If you are using Rancher v2.3.x-v2.4.x, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.3.x-v2.4.x) \ No newline at end of file +If you are using Rancher v2.3-v2.4, refer to the Istio documentation [here.]({{}}/rancher/v2.x/en/istio/v2.3.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md index 09c4c721535..342cac2df6b 100644 --- a/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md +++ b/content/rancher/v2.x/en/istio/v2.3.x-v2.4.x/_index.md @@ -1,7 +1,7 @@ --- -title: Istio in Rancher v2.3.x-v2.4.x -shortTitle: Rancher v2.3.x-v2.4.x -weight: 1 +title: Istio in Rancher v2.3-v2.4 +shortTitle: Rancher v2.3-v2.4 +weight: 2 aliases: - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/ - /rancher/v2.x/en/cluster-admin/tools/istio/ diff --git a/content/rancher/v2.x/en/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md index 3693aedd9f8..61e901e7c30 100644 --- a/content/rancher/v2.x/en/logging/_index.md +++ b/content/rancher/v2.x/en/logging/_index.md @@ -11,4 +11,4 @@ aliases: If you are using Rancher v2.5, refer to [this section.](./v2.5) -If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file +If you are using Rancher v2.0-v2.4, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md index f1f4043f0f0..b9e9e219e14 100644 --- a/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md +++ b/content/rancher/v2.x/en/logging/v2.0.x-v2.4.x/_index.md @@ -1,6 +1,6 @@ --- -title: Logging in Rancher v2.0.x-v2.4.x -shortTitle: Rancher v2.0.x-v2.4.x +title: Logging in Rancher v2.0-v2.4 +shortTitle: Rancher v2.0-v2.4 weight: 2 --- diff --git a/content/rancher/v2.x/en/monitoring-alerting/_index.md b/content/rancher/v2.x/en/monitoring-alerting/_index.md index 9b6e00b6190..987477db339 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/_index.md @@ -11,4 +11,4 @@ aliases: If you are using Rancher v2.5, refer to [this section.](./v2.5) -If you are using Rancher v2.0.x-v2.4.x, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file +If you are using Rancher v2.0-v2.4, refer to [this section.](./v2.0.x-v2.4.x) \ No newline at end of file diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md index 002a763d472..d95422eb05c 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x/_index.md @@ -1,6 +1,6 @@ --- -title: Monitoring in Rancher v2.0.x-v2.4.x -shortTitle: Rancher v2.0.x-v2.4.x +title: Monitoring in Rancher v2.0-v2.4 +shortTitle: Rancher v2.0-v2.4 weight: 2 --- From 68af0fdbcdcc1078bd4337d87ccdf4b51c566e19 Mon Sep 17 00:00:00 2001 From: Nick Gerace Date: Wed, 14 Oct 2020 17:31:24 -0400 Subject: [PATCH 4/6] Add taints and tolerations section to logging Add taints and tolerations section to logging. Include example YAML, and provide both the overall backdrop, and the Rancher-specific use cases. --- .../rancher/v2.x/en/logging/v2.5/_index.md | 73 +++++++++++++++++-- 1 file changed, 67 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index c666d66bbc1..42fea2004b4 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -8,14 +8,15 @@ weight: 1 - [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster) - [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) - [Configuring the Logging Application](#configuring-the-logging-application) +- [Working with Taints and Tolerations](#working-with-taints-and-tolerations) ### Changes in Rancher v2.5 The following changes were introduced to logging in Rancher v2.5: -- Rancher's logging feature is now powered the [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging-operator/) instead of Rancher's in-house logging solution. -- [Fluent Bit](https://fluentbit.io/) is now used to aggregate the logs. [Fluentd](https://www.fluentd.org/) is used for filtering the messages and routing them to the outputs. Previously, only Fluentd was used. +- The [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging-operator/) now powers Rancher's logging in place of the former, in-house logging solution. +- [Fluent Bit](https://fluentbit.io/) is now used to aggregate the logs. [Fluentd](https://www.fluentd.org/) is used for filtering the messages and routing them to the outputs. Previously, only Fluentd was used. - Logging can be configured with a Kubernetes manifest, because now the logging uses a Kubernetes operator with Custom Resource Definitions. - We now support filtering logs. - We now support writing logs to multiple outputs. @@ -49,11 +50,11 @@ According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one- > You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify. -### RBAC +**RBAC** + Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs. The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs. Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster. Cluster admin is the only role with full access to all rancher-logging resources. Cluster members are not able to edit or read any logging resources. Project owners are able to create namespaced flows and outputs in the namespaces under their projects. This means that project owners can collect logs from anything in their project namespaces. Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging. If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. - -### Examples +**Examples** Let's say you wanted to send all logs in your cluster to an elasticsearch cluster. @@ -236,4 +237,64 @@ spec: ignore_network_errors_at_startup: false ``` -if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd. Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination. \ No newline at end of file +if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd. Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination. + +### Working with Taints and Tolerations + +"Tainting" a Kubernetes node causes pods to repel running on that node. +Unless the pods have a ```toleration``` for that node's taint, they will run on other nodes in the cluster. +[Taints and tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) can work in conjunction with the ```nodeSelector``` [field](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) within the ```PodSpec```, which enables the *opposite* effect of a taint. +Using ```nodeSelector``` gives pods an affinity towards certain nodes. +Both provide choice for the what node(s) the pod will run on. + +**Default Implementation in Rancher's Logging Stack** + +By default, Rancher taints all Linux nodes with ```cattle.io/os=linux```, and does not taint Windows nodes. +The logging stack pods have ```tolerations``` for this taint, which enables them to run on Linux nodes. +Moreover, we can populate the ```nodeSelector``` to ensure that our pods *only* run on Linux nodes. +Let's look at an example pod YAML file with these settings... + +```yaml +apiVersion: v1 +kind: Pod +# metadata: +spec: + # containers: + tolerations: + - key: cattle.io/os + operator: "Equal" + value: "linux" + effect: NoSchedule + nodeSelector: + kubernetes.io/os: linux +``` + +In the above example, we ensure that our pod only runs on Linux nodes, and we add a ```toleration``` for the taint we have on all of our Linux nodes. +You can do the same with Rancher's existing taints, or with your own custom ones. + +**Why do we not schedule logging-related pods on Windows nodes?** + +No parts of the logging stack are compatible with Windows Kubernetes nodes. +For instance, if a logging pod is attempting to pull its image from a container registry, there may only be Linux-compatible images available. +In this scenario, the pod would be stuck in an ```ImagePullBackOff``` status; and would eventually change to a ```ErrImagePull``` status. + +**Adding NodeSelector Settings and Tolerations for Custom Taints** + +If you would like to add your own ```nodeSelector``` settings, or if you would like to add ```tolerations``` for additional taints, you can pass the following to the chart's values. + +```yaml +tolerations: + # insert tolerations list +nodeSelector: + # insert nodeSelector settings +``` + +These values will add both settings to the ```fluentd```, ```fluentbit```, and ```logging-operator``` containers. +Essentially, these are global settings for all pods in the logging stack. + +However, if you would like to add tolerations for *only* the ```fluentbit``` container, you can add the following to the chart's values. + +```yaml +fluentbit_tolerations: + # insert tolerations list for fluentbit containers only +``` From 4c3cd2b444c3b336a2dd11ff3a09549c456c585c Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 14:22:14 -0700 Subject: [PATCH 5/6] Replace Grafana default dashboard screenshot --- .../v2.x/en/monitoring-alerting/v2.5/_index.md | 2 +- .../img/rancher/grafana-default-dashboard.png | Bin 0 -> 248916 bytes 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 static/img/rancher/grafana-default-dashboard.png diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md index 539474123fa..5aecaea6bde 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -114,7 +114,7 @@ To see the Grafana UI, install `rancher-monitoring`. Then go to the **Cluster Ex ![Cluster Compute Resources Dashboard in Grafana]({{}}/img/rancher/cluster-compute-resources-dashboard.png)
Default Dashboards in Grafana
-![Default Dashboards in Grafana]({{}}/img/rancher/default-grafana-dashboards.png) +![Default Dashboards in Grafana]({{}}/img/rancher/grafana-default-dashboard.png) To allow the Grafana dashboard to persist after it restarts, you will need to add the configuration JSON into a ConfigMap. You can add this configuration to the ConfigMap using the Rancher UI. diff --git a/static/img/rancher/grafana-default-dashboard.png b/static/img/rancher/grafana-default-dashboard.png new file mode 100644 index 0000000000000000000000000000000000000000..1423442981fedff932d5e3385c4c79206105d947 GIT binary patch literal 248916 zcmeFZWmH^Swl-Y2Bm@m^!66~IySrZ?5OEO!005GNxUeDs0D}VnKr6z-g3pjy-=+fqi1TJb zLh=$qLd5d+HpXU_MgV|#XnZ1^veE)((0J=XBxZ=C;F&n3@AnBPs@5<`aYzL6pl?}_ zG$a9}?3l{JRXI>3h*43#5ir%ddh(X@aKaeh?WzDYG!A}ZNy&|?9!Do-aiH>aubYL( zGLM>9TD1IbM1UcDZO_Jw_SJloE9WT(F(f<=ps9)j4V8(R8C#E@>2*c)>_c_P zN<-Sn^;!F?n$qSa89pEj`deHRnk;Nr`2hB2NY58QRur-Kv(c9viMG(H8fDv(BWTIVB0T|nk0MY|G4yBg_K8b|PQQ4RaM;)c0TU2r3gX8zFdy`K#!{Ui! z$9mu1GV0)?@GkJ#d*4nazz(V>)e##8!7LZwQSVAY-_q(uC zNMh0rUB;e}OCrbjf_^<4c}qBdv$Vpzv>mHJici<0;i7j8@Gp})onSLPnCP+ppr}3N!$$9HV`#`(p39@7%UHKtY37b1WS9G8k zv!ZY zcYZ!sq@YeJ>|kPeI0a&wJlF&NplA-mHw?rs16YVbUD@nZsFHr)qA`X7W(CRRsg)s4 zg3Yrtvy>*>_GzYJczoTn1@;N9a6~%|)p2J1BiDb>Lm77o*pjut%la{G;5VVH!Y6jC zoTE0O@*?X5pLOw^Tew2Q$dh3p<%ib@Gsv$Np(u0H;E;=!3%<`Cl2<8mSAJ7M;Dk35 zfGg-FXfUbFOkfr2ECQF6JAv;=;r`wo>L;WZ{7Oh$NL%Eo2y$+_9u>As1Vu0ETtiveC$`TS=~B4_B}?&6IR zJL@JCe7wZKk6kA{1fA*KD_z%HyqglP1TD0y$V5P_%{S*pcinfjcN%wzcXs}eozd%p z@E>duKEkKM!y(Xq!~5pl#jX%zD(y%ril!855wg?czDd4mu<3yonkQyY5f}rV=c&kX zfPH{ioOl&lCd^9e5r;mYcqwX+^dtVs_bEd#8(V>!`r`YiAyG-%9mpN(om_mCG07qHR?Gk7pc=oZh=+#4C;1uUa>ammv2u<_a9*V{bT$aAvN^k1@pV81FZv5MM`oa z^+WW7Heq|a!_?lxeYceqm28vL%oogulEnJ{P()S2JCiz;U6D_ir=4^2(I7rD{>xDD z5c!Z;JXd_M%6H{sl^m6XQst5~g@f#DQ&DD2+VqA{=QL;Fja$?#{x1G%+O@;s-f{|4 zK}q&u@sJX&s+D|e>BE=EirvzLf(DUtiIY&yuPf3#(q73Agx6AsLbyY?6}b43`jK0> z$Sis?Ory4=nxjxD1SzCn7r(xIB`Ht;id7d>XSSHJSiHDYH*Su6DDSlF1kJhRICjvI zQ#z4+<>=1wOyZ@kro_gtR?@7~sN|wKu1+Ue$zLgO7RsxTnVnhIF4HdKGtb|z+a{19 zklraIlYvq;owZQ$|BgUiS1I@kYz3LtB^%O|zq7;O8<8nTJ zZG+SS4Gm+7uy1Tu&0h9();3FNeW)W`U^^=$D=f>T)3|eUJ>mZRspDQ_k55~-iN7g} z8v0w6U_%f$0?WJ6x6kBn@i1{!ac)SKDY)rcc>Hmz$u@0!O!L&X3kJj#C=`AbHJIM- zf7@T&ug1~&%=8DA7;nmxQRnfBk(Z`V?hBziVZ(vL zT&hXs>g}6GQ95J5AN!iJ)*2bst0^t3@gwn%Y67LPs`cfwI$BLX`PTSeCvZ1Y>R8$_ z)v>-~daC2qHss5f(zjQgalM`$hHZ!Sh^!oG&Ye6HKDVwvj$Jz+xm3KWj?lKL>T4;g zUK&A}bk`GEdQ-jX=^I@3jmbo%-dOfoV_LU0_8JUlEB5|M`_)zsYGk#}wfVSuqxTql zqBeXyd~-^C8hyG?jr`eW)vU?^G)DLSDXckOJ07W-*`<7qr6INXah7nL=h~zGCgJ$G zMXu`X#ryR+Qbkn72(AjQ2DybD+pFqXtPfZ}b2vjjqhs-ng(tWRS*y&cq@1VB%~gp& zld>F-JJxo4S0OWZ^g7}C5ziEfyuX9tpjwTO{KfIib>gA{Jp%oj5AUVri0ssaNBy@cORDL#Y@`#rLEA2Py|$sk&IYKD#MP! zK|o8XK%E^vKv_5u9ZS~Yh&rHP4XyzGi85n$O=%atW6~2qVU(-&5zv2Gxbq1HCp!Zm z><&3UCd>L_6l=(}bf8HlT&g=nL9t4@h-!k^F?SjodQlJ>S~(+LjSOK*kUo1ASK!+s zcN|`0EDEDDss;06Hs$_G$MfO<8~1)bz-P<{a=HPBGDcRC9h~Z_8mUVd%g6v|!29q3 zh+s1SG?`o8rWEU)-$xxH~Q>qW&2wM!0pNj-nBAv)FXDavb1*K zbmbxW>kdxv{_oRtB*cH+;%LD`qAnv(EM#MEM9lJ;`7=EUFCsB9F}J;;F{h%i=zocW zk9bH-9UW~s>F8WsTt2%neYUYTp=03S;Gm;tq+?{H1>ZsI;AZWp=SpksK>CkC{yC1Y zk%NJ~nXRLljWzM_arN|VoE&*bNPbWBufKmhr;)4Kzh|;`_^;OjzaZW3D|8H>>FNG8 zHdvJV_gPMPGgl)^bzw6rFg)Nnco~@JS-Afa_#c=4J>@?{RUC}$g>0ns>)UPNxXf2|rXBC~_pHUPj6 zkPsG7c7-_hg7ei@nY^)FQx-&o7DRxCgonrzh8E_JCXp25SD^M^50*q#w$#1v8IQ^; zBF=&*c_^jw&m!>;B$1GZe#?UZ5gT1|aFS`VJ3@Qb*1WJnw!JdyKzz2$VKSDMyqDo| zw!GkQR*u&;N%1isIo{1d`+adK6Yx;D*lJO=AyO2}?nlle!3>sBlMHkS0F@Y0*cToJ zf`tFS9q>o-d$lbDH~frcJqeR0^8Z%xzufdsaliUN{;d>M&wb4Dnp+B5`+Lw)O&9QVfOtFLIla8pLA6Zfv4KXC5kx2_zP`U$Mq9DyGTwS0sH5Q+{;Mxf9uP z|BqMtucs~Jf(}9=`dn)~8cQyfSiwc=xV>9IA>;h+$S$_J@vgd0@rO7~29tGk`;k18 z`_fyp@5nSd9!6SZJQm0>Uxoi0PXB_SErMUj>zPxI9#V&l0}mJ1{jHPDg+XMQA^yBF z<=H}8`&-Ldm4F7rDp}PEP3mCF1sYI7MReirr?^KQO-tR=T%aQ92M)VFv}F1%mN7D{ z1SU*YkCwQFnE!2c{y8f|j5Rq<<3g4KEc1+pKg#-tA0abg;`sVp9=+KV*e9(aDT7?r zsV~}jB z=-2Yf|E{b5Tv&2w)nvmS(y@V0n*`x8x|Z$w)v~9a*4dh`cTbA;)xV6%J^~4*xn?CJ6!za|y?q7LVl2d4i{Zy-n}*ih!pOUsSs&rx?r zMsO+zn8vxaKvDH|bp!j88pBzg0nLU-vAyA=m2MzaAJlc4xQHrvognX03h3(CNmb@q z1Ebs!N^G4IMgQvkh4IX&%_iEs; zztpI|<2eo)neP?v({iX6eoPS`G8&qjfVK3vr9L}qXz;pOk*iQyTi-hT{+S%-%vCQN z|EEkTIrb6DMNp4cE5%xcr=fNsf@n*lov*jkLq5z$!-uCGa<1x2RG_4f_ZrgnMETd9 zSxT&g#W`|^tLpw?>NAcNLiEZ?HQS~g)ZuoT!}zdt1T+~<^hC?);+c_E zx)r|5a<%=Hg4kd$(PNWzGGl)Fe(LHK#eK&YlcBlx3mLcl?BK=vTK~VbG2KyOdQCOj zwygmJ=u(J6nQQLRaqAxv=-~mMHeB->tT@e?r23v8)Y_wQe*UaZ7*f@+vD)p}tyshi zl_*>Ee7bloOW@LyWR!JvE0#|Cq3*oW^aZZF8Ry8*eTnhM)`G|hEYZ9sWxv&$PSjF` z3hcpLUirR$hg-PX0D&A`!VzIQot2d5%%+zT)^Peb-S=*0zaO%(5pDC;>BtIp1AdP^ z1;;f<)|d4*UX)wab}zwW2?#*$w3+9FHn`f83QJ37ebNQJV1hgqN}Kwcjpz@vQG+9b zf8)a-NUEGs_-l|5L_aa6GMo8Zwm-kS!Dfhcx(gP|7mLItN9MUhUNA3Zpa?hArY$$M zG`o3HR6~#8XFLYJPbm$sPK=Gf);$)DRGh>3@+01Ur5&>l4-28shJaJJ0SDJyNZZiX zpf!!YLgn4u_SWkvo7&6e6WWnaZ@1ND?N$)tgXm>-y1wdv3^XACReF+6*H^FG#r92k zm;IxQFe4z(n!MqUa(H3ZDkb^`f>|o4$Hzy6t&dYaZf(yFi)+04ArUx>xmQ`i<32{Ze0dwg17 zwLO$^KjK`lv#c%+#F9?blWm2-7B^DnU!cB^IRGUzYB;&x-O$#Y^dYJGoZ9RS_?T?# zq>5gir}&H|+7SKlBS&X=qD00eJ8RxiakE=R)S4;c>TR!#)lh}f*m7Q-Aw&wMHfUIA zNEay*`gL9Z3F_K_X-?ZC(z0#An9*)i7>8chH_dS~)PC*xc31>UE3GvTJ+xPbbwPOS zmkZ}u>KuiPOr(7es!bev6rZ;Dd4R=s3y7D5?hwxWD@%;)-A1ql$)z~Q&HR?(hM*4{ z1zPf)HV6ub%ejpEVLzAA{mRsBoVsuzUQL^P?&UnVGJhC9{O^p|0ttc)4VnF1SBir7 z;#+$n3ishf5_4>*#?j-u3#x0PSKGvqr28<-#+7&Wiw7nMs_ZvGm9mvA=ZIly$%fp| zNY6WOpG^jtvx?6Q)7orB1OjbN8)a&FWoa)*Jr*Sq`cN!2S`=UQ)Eu^h;(`V!0`Lr@ zhcepKeD0sLtnAO2+BO*sEdsrF@YE#lyXi=*e&*P$^ZSTx!tpt_C4YT7m(o~ju}*DY zvTpt&SXHytV6a5V`g%5;I4nvkx*u$|`Z11DuHmydp|=YT^wUGbQrW3b`yI@J zCunphFHSCjGQ(BztA>VE1hVJ)ryrnOm!aw6Dd{M_zty=>`1Jrf^&jd_x`=2I;_M{F zA^vnSK*AFuRe_bfQ1tCPbXl}3qu9w???Q<_IRZ}k)dqubFPTM5+`|%{ZJZc6N$oO?8P-^DEo!0QcQaynYs71>FUU2}qz}(Gjg7;>V?1iB&!;XD41;%1 zpm7rf(E;$0%Rn!d7MUF1vtxp;@H2tSs-8q2ZNoBTnI*kz)%x)4>sexZ9W?17Chb?U z#%23(e8&lm?a_y%YdP;rbmiK=b4FQm#1qS%!EW6g8Xk#BUth$}7WO=;q`hU#f+hOU zZ%yM#ooAqPDKL-Ti}+yWP6=L)&3qlZlbe-jJ*RwDpyeGy_g!0AeM5E|M?LZP!PZ*k2T)!2(71KH?WzB|27 z24$|AKV`=_pD`SEJmy~5HEGJ7TP`(p;xw+&cUQo*!AOjnj#s@_A`EC)=bSJbD3SZ= z%koQaPK>%R1y92g^|8JP8EUn%>wb`sRO@N`YbE1z??FE2-}}~b_;tHI3vb(ce7EUp zMnNJUQGp!PGb4N!b0#xu>uRyWiy5=;odK{*V*1|K!$T)r&?diR|SxMRXNcrwNvL;*Qci&IA z^v-$S!muB4;#LKo!^-QcBY~w^o>wiegJ>a3mRzc19JkzF!njr$B&~;Gl_o$rp_d~y z&&EU2X;Te!7@a`TPSUA(9XCQgZ#j+p5V1V9M(K3M8Rg~2J&&Cfi%Kmmr(?OlTj&%~ zz#yyV7fw}(&$BSvcSTb5mm^GaU-aL3%?jIBEMoH%dx+`)8-d=ak1K^Ol}jsgJs#wx z6gY(kl07b7E)|~FD^Nzq6iDVtmE6Mm6GTZ`)FuSWa^6gO5(&~hC4FyftmDQB+4!v= z_hIeF4Wx_~ONWh`W$h;i0Kp6R5W z4|Jywl@0dw6ADqdXB;=5wb}2es2P>O9dTi}OpB!vdEe=Msm|F_$@>zlV#)o|gMRa_ zuN#@KOe@xIFWn_U;yuu!Qjj1u^xuUC|DQm}gW%UM_9h>&nKPDF-1fAb>NhcDm|td( z`$&I@3(BT2cN!9FSim5RTU7p7B-{~&bWExk>M>XmCmx#?>r%+EUaTu-v^vD-JQO3N zj8WEF+2rV^`C8EWQ&9G&eud`^7Rbnb3DKhm=OfCAf=PbBHPkQ`;X?Z~y4Tp#3pdA6 zireM6gVav@Lq)H?zny$LCx;u~D`I`+cV(WR^yg)bv+MSKu_pDM#GQ95XWHeN5=0*} zUzd$)jw+hXgWPTIZ{DlTt5vo;-Y3q5WV<>(9-ev0QEsZ*-|y(e@;I+)smVnp%4uIB z+;`r#Q*QM|YLITpBY;co|JBKxLqL%2gH>7w9@GA$7>GQc#vueEF*rV&yz^&{bt)3V z1A`$|iVY=1_U5ALD&Rp|lzTQ(6HV37zn_mAHtOf@uJP7I{4vXp*i3wc9`?Q!GHta_ z>bvs9VcAoFQ5AnnH?86UIwcl>pDjF4+l_=V(SW9u8Fx*JdNGv z5(yQ=wo{{Q!%z31on?ntv3Gn=wqAq#;Nn=%-}8=?sQBR`sbas3!r}RvZJ^}`X#2R9 zkN9_>E06ZvO*Ywi0?|c_5qZ^p#roSSG;5B;7ud9Xsq{Jqi)K@pX_tWS(VKsJyD=VJcKd167%|^}Ky~eF z+#ROP#NW^4trpH5xY3vyuE%;8-LIqm*(aq+x}XH#Fh+CP!7>;BM`MMnu*9YM;N8Iy z=1}EJL(h@L@omN0S_bc(e_kFXRe-GPcIJ&8mgkkxI=`23OV08|^Ae5uEFqUcUqpRj zOO~5cyQ-Faugu?-pjU{{(aM_XJ)1wB(ZYY7hg?~x{ERpJrr?0JSvoaHQn&*-Dy5cs_r)+olNFuzMpMdl{Ag@qj4HG7dy4lCLjKHoA`?&J7R)d zk!6g+&0Y&L>rpFsRxtDAplIXNDwtVn_uL}6pG>d+;cw@a0e_YLcS$JN;I1(ItSNDh z4)w{m5Q~9gp-zrvnx8-?OIV*UD6l<#7S03zgYY!f??;eL2gkP~Nzq|CbA7v%%e6M6 zYVPy1oto!;_XWK=A8L2F6<%98739t<@oS=&q4yCioXDn_f2RuIciU%xT#;jJYZ0t? z=tWDu{DtWDl>GiO(AAU+ z9Jcu?Pq#Ml%I1nIOupaNH#l_4sWyE1+j7L}u0L4$C@+QB&0qGn#OGibm61H(l~Ux& zRR=EpuP*MdM{I@g1BdV7D!uOfY=}%+Z5J4XzGNnop=CD*4?|&_ivWqftBaIPZR6PL z5ZK1Q3mxD%!oLS!wxn#m*H9h*AC?ZqPumv|7tyLqIVt>i$_!33<%i+v2i1o?f*bx5 zI{!D+Z>0YZtKZuFe|q&->*D_hW#BiUtGZxetJZn-W3=t)_|@d(uT*b#8=VfpEbjaBw}f?m1M4eB)w>vKlIbtOIT#kaYPeh1rhv@J`4IOrGal6v zT?Pr9=dx-GzA8f_>?|#Rx?dB}9Mg%Co!q5oAwc(9HixFJ7epUrJ;!hcuFYIR=CJOV z#=1tn$i$Iq?+=8MoSV6AC49X0#|N6NTZxT7eHfId;dIiCp)4GXfRfrGg52L>GO0$y z=sx~LZDGMX^Z%$?7To~DWYinB^Fc-u+Wi~2uaWzfpyo?)enrn^Q;+g+bXAxk=pqz1 z^AX}=SzAedy}mq*k0yUce8kNobdF|A3gaf59myvR2%Ra_^jt-EEXRByfrNkUr)f1N z#Jyp2SHCsoO8)58l0(GWb{M5c&m9(5!?zKPX9)E(4+=Vf#C&t?^DN7^eqfdkoA|A>9 z*HQDje`G5BRwNVC%ge=j(u}GdN;+%0Yy%-zwz&~#Y$GSs)=gSjq=yjsM*gum7+)|U zM-_ELT`>Y+1Klf&B|*NbCo`{-o*$~NA28ax@FQYIE&8y!v%jgLvRs*nMPSX z6J@S(@pMoq)BHqfm&W_$AKAx0Ji-(_Gc&WJIZ<4M%DTWZ7Tb_$WUcEYWPg(#>tT$M zB)o`zk+@QpnIHM#8v&r0A74pdZun539_4`FK^-Ep=VA!_jJBqJ>IeOp@5ewk*tR0d{*-FsSak9 zhR@l)UyEuUguQmDWtJzPk?n9pbpEU^Z9v*Js5PE>x&wmt<>+O*5a}QIRpI_lMPOQvMR6dqf`Zn0e5JWh3!Ts*^hKwF(Bp0T zEnpx=l`~ntyS9R`-?boFkd^kk7DL-d4Fo*Tr-=KJsKmKES)CyYR(6SbEmZ z!42V$o~TtL0+!pBiJBlDg+6a7l)t9Yy)9(XK4b1fek=ubfb{AB0T{W4;(U#~r(dDZQf6f+}MJM^XXf~-ytJ94>q%la2txP>|)Pzr)VfX_Us9yH) z2=_|iB|AN$hk|5+(9aw}l$&By5ZW9DA`Rx*KGGF1=LCH7^et&Dz?t`3Rwkc-U3x=Q z=+`I3kFt~R{>bRAP#`F9N&$O*+8KaL-|CJnZ(Kjan7+uy!&-OYwApurY>U(rbq_tH zD5HmyS>y){xSpXYU*AZhCg%8xvhAU+cWEb5EuJ}haHWKML)$P@GnW#ZI2#bZg>O!W z%|uXd-v_v@Z@0W~+K_F8I#)WEEcJa9xzLMiUHp|XhdUpD`4)ZpSR6MDDvJiTD6b+* zx00Hf@DX8i7ibNmledch(($Wm&Fq}M=T3i8ZYlU~E57?W$+@y*l{O&aE2ZMqGy$)#Dw;!`i;66Rwt1t!VF zd+76beXhc|AF-2lj}gtkyOpDy^D!6P@ykVczessHw@Fh#s z0upzS8N?GDu#GeUZ{Vv4>U~i{DVD|66i-a9MGhef$@6UY$|3WG75wOoBBT|5#*H&d zR!K>PDOE3IG^QBxEjsWb`|7zc5RbWq2#pmZ>#Fi2u}a=>5?!AZAF_y45WOU`oD@Ck z9jcH^vZh(Pd9jqx4g$@Y;SlXB8ift`b7^!BIdfrrbkzchI!)@fgS+8`=rvgmX9neu zeb|bG%fB9_r#!l`)$(Cg&fSuq=i6wq?v{ zbNkTV z?1TFbDpzAyZmgMSwe$SrJkZ*dPO%Xg=@hw#>H6nP)U97!tDaBJ1`t{Pvj6R@dp8pi z@qKoHf#wO3_f88(Sd=-^aj~_}v^jYj6B!xWCwS>`=Wh3z zQpQepuZO(rAsZeMgm^G-KZtZnHDE@6ig56L%w6lD`m&`E~J z(4{wQ6Co%H+=_M3@j(fMrVmKWf}@|#ne8fp(9v)?@a)-rP>NE*D(4iwH;TdV$|}_? zMNwIUC5*@%jjE}mpZBJkc7x}{y516my$JJ+_%?wGSTD4ZTQ`8kqsKSy^G2@5*PT#A zw_-jj42P}kHr-9`Y{Y7n8U>#xvH6Z&w8=?g`|0;5qxzd3D%q<-^AT&2SET)J#ke@h zIHZX2&R*D&TTkVRfbQp1UwE)*&OCW5hW+Nsr=wy5#;N+Mt)o9OH-FVaVwO+2CWr+4 z>_YfYGcyr)SfJqo4>Q=u`=J7zlptr`nymtQAC)YhBVDhE_UgidDjgy*UxYs1wtz=p zkER3-?!31Bg;CjXx3qwxwv7EUh`ND2f;vto<)J^izJ9#^;DVIkM0}argq%b`z9&+I zF!Td5aqD}w#rT%K80Xyd({YsvG{LM1IJY&bb87lXcXW83Xt96<6-A%}>8c1;E!N?6 zdxVgtQ8cA|VFD`Q5eu&55xL9L9@#Gm^<+M=GZk z0~Z?7LC2IsaWLiu)@L9x`&=V*xps>4@@2_r|aPuxLFj_ zEamGOE}nA(5LVqbg-U&k_8|`GxQ!seDtrF06Ld3Q52P&#{7BB4l1Z z2AleQ&$6l8ZJS%U!nu*XOygXiS5YCQszP5Oac|sn}85FYf6dcvgl-~9Q9P)8} zxIqx!hyEjnX9O$ONLJB2KOiYS1UlWl3oddU^i3`SUeLc#-DX8uwzxO`#FPUSMj%ls zg>zf^BRF`JvgoqItL9QiiLfQgAHsekN>`AYPv)s2at$QhyCp58r=%{+tC)`ofas$P9@Q>#Xyc@P*mxYB?pTv= zL_|bpuoNBj-Ww&3uyIx^oGm+XdT?5Uc=}1_YjE%Z@(zAvxdCStZ)$Xxz}qXsBskpq zu5Q}ha{Vc9dY3`{xl(}-a_Sd%R&YXXS`+^j#RAIhetKHF=&nlZ(wfcgC^5Ld9DcA ziDqzeBBmn;k6BD@`-D%Z67elyjuK9Z3*hS)iaUl)>G~E0AuOv3eMV32Jam!XjCUe5a1nQL(VgXo;HmhJdm2?6J&7>i&!=KNW& zsd4*ton3dkp)X=L%9X;igys(@5FRdRtY(K*_d%05G#Eu}$9@}#uCv|5oYac08@!iKf zbpkdLBNf-P*`E9~li51Ai-tR`!Hqr#!e_LKugEM4Hu`-Yt)L1vJXsH6uVp~pUOg-q zAa<6=wOr7tgiYVRc(tc2;I{E}Y>Aud&LC8DE4zZ8C<4YNcfXPa>#mBgzVJTgZLOV? zI<17zZZOE&I-QxVK{A||6Pzfy`vX*&9>jF%kr}q0xOJy@y?AXH+G{~dDU}TE3`9qG zDUMDjK|BlrUJodc()2gk=?lSH)a2M3CO@Mzmg6qm^`+*V_;~#L7beX#Ga_&F%Jy;p zWrkHRB;Yim-pl5;7Z=5R5G^nx8w}qeI3ZFfRfSQ72)p~`wig!4QAbmWlrZp7F~X#! zx3sq{A70>FueV8koMPXQysxBRkA z)F<_V-Rp{z`KV{k=n==?XF)U*N3O1i?@B7Wbg{U55{g^7b>PthT z?8VFfK8*F~ok-OtWE6{ggV3b*&coGT2^R%M-SH*4MhtM|~f2ahYVZKS^DIf1-IRTK>hM!^?2JWS0& z?^@i=)!1X$GZqnZXLGO66fc5DC>DCQ!c#eW?uF1BGWDF2InJNp=9{XMuopHSial)H z&3*)KMzpv$hFQVDqRNLboamyDQGS}-3&7_c^YFTLE_E7K7IzrNS{QfUaR$UHNH@12) zif);BDY9m$EG#IcDbtzvv?(AQ&l*{U)Nr(jJeJ00KE_qjuY3}5l~lVO$kyysh9;t$ z+E?%HIDr;~NmVv<1o{RjQ5YG+po9YgaIZzP+i8#=yRC_cxFOHd76F6ED?#d=z_do# zMy4l!hC{K1m$XLrA|{4Pxv!SorHwa^-O*3g7hdazg^z_fq2tsIBSh=TAL|a+X%*6u z-rg!t9FI}&CT|^2yM>T92c)!WpWUp_O>@+*Efbk^d$U!wWycV$((B$$p+ld~U$xxd z!AFcUaUtg&*nl{r6230wUjPzAY6*co z7!CVEB%O7L9h7DkN_iiaN|9@J4?&}vh~OxRY&p%UE$L;Ct0-y=F3{VKwBoWz_Bw$= z@=(EMt4llHw%LlbR1WXNwNxBYvlXsK{(De&mTH%G>0CLi%y9vbjdCy_pA@J+ipqR;5~A%%clB9ue$1xWC}z1w60Un> zS0D;Y8^<^dN?`UqTSHu(F5)+C2d07o-Qcw(WSf61`tucY1Ti5D{2&W?jC03bTb>4n zigt(a@d)T1)b!REE(mgce!ihSnTpJWos$dcDTn_d^JF0*iyLj^i(Lt+uNFyAz#pKLJ@ijM~szNFVxUMW+lNTeB49#6KBvp{~`TRHc~CN>rI z=eN3#Gt*6cC$8$T^;pjnc5y@miV?XY%^G$o=ThD?b2G!f-kJgl#3Tn4kO`)m^ixq- znS~_)N?fkb>5DBOGfR8BCj;XLyJD|nUoeNpiIseHx+}X6vk4BD{^`Q#Qt+<+^cAn( z1oczj(;GXmwh+?R!}gf?HsZ%@$WILa;BF?^e*3y1@7`yIFmh{dYw6ozTz-=5Z~Qg< zA1p$%WsBDQ_U!iqP~P8exOF0Nu(NfbS$Xf3JMmU1903S5p*vuBi>sZRC)GIiS(>%H z#+m~%=Iz@x?Xn5C0<&>sRAJA|_2gAQ0fJMM(L)0xx-w{Pgt#F=Y3AflU9QPp--uiz zQt#me_Tskoi@*gCt0_YpdWlQ{D>(nJqX-&zC8An5ddVtWB4|M}MeHV;ZsN#?h+SC> zGGFrhfbDr2yp?+6bJ@R}?=*gt4RMoW2%2V}--7{`G}OJ7#z#QiCxmphbYG|uNz!$G zuq^?7B%o&fmXhb%f`=G6^Ozt_x8&-+?M+F{zsEfBnn5nsKw-YWs^e7+yWTfxI8gC2!%bA zELBU3OxpcZDd%u_W0YJYz*znS`g5eBDZ&E4EG40`6z&+#mX~fRGVi2#v;ej@tPS&p ze9~O1F4!e=KtldtJlhIN->^+smjWbdnfY{9Mj$&)Ah|HDUSqm336U>HeJi}!-}g4c zEo+_=V!`Nc?*gb2cpjgflS<7S-cWkbM=cn_rlvnA&+4z@{egrclnRNh&FoURmHw6QEORbZYWin5W& zq;y8*CvHf@q}2u&c_4TmkUQ`b4+F-@ghr9tN$6;ikw3jTH9c+c&x9mN1QK}n^&$CcGgc8qqa5qUf8RaOFk^kMjH;69lo^w<{aL zi*T#QPVM+=jcbQ`+Lx4jN+QNKF?NvMB4uG_kaS~@5Q3a2;eYu!Q_Qi+Pu<8TX7C0a}oQ`p5d zpIkJ!XqEX8RP8rZClvgKziBl`$2jw0!&yz9hywJnaqhXO56^pc{MlBUJWdCD0R5Y- zU^r4*(Z@RT(njmk#FI5=?qd-TCv%W|y-}Th608jKjX}=j#jZ^ws(Oo|-={AnK$$IW zUl3H-s6*zgo#q~hN#-_bub622@DTUTTU4w{?L}3Jev`or^LNj8eKBN8A+510IXy$( zs-+*so1omeHIVoaU8UC5JXglAMYlv?X4pOk-{lx1O8hCLh8Ia2yawk$;2O`bkX61FT9UT4koS=(%? ze5xfn33WMi_Sj@9Rze7%oDLAn6t2ZX+o~tOHz0}bsR~UIW$HeP!)=6v<*#0NbLi>u zDC5Vv$6U*HA9s;0dX$>_aIjVKTnBCxIU+;6!bkA3TEPjXye4^<^c8-LBF(JgrHk`M z=Vu#nxdLsWo*@!&>k8jSWLlTE^CS!w^QV2HQY0f=CK~8|x93p8IST%F7@`s{*xc4l z3p(57UHC4Vi=agYi#djAqFSgKTPW_3m*JD~`y#l&jI_CONE@EmXI4ToCSJS_wi<}) zZ1M{~;5FNI0sohYWxn$ylUc5rX04KsGmWgs>sa1MnlFx6e)>76prO5Lr4i8aU1Sim zPx_2A*Jn$}r3-)Itt^P{W((MzIaEj}IBQLJVO)ehk?`FzQVaG^sQb8(O%#jwlD*F@ z@8^zsa(T6gXit3?j~|kCbfo5V2CDv`xOI7cXDlUL+=4R9?m2x-9Ag%mX4kT`V^>X# zPC{NoM_G+<1u^@6oX`d9cHNP9hY@0YMB_{7z)9)Vpc$e$8@wCz8_eP(H3@=VC|#TK zu5Rst_h$3i58XtdIzYG;fW)Oy;4~7bv?qh_m(O2 zXZmgTo^_!~yAB7gs`p8=k&&ZMDAK^29*ZTjfoNKzyYmxEc~7e}guXdUpQr|0_<1L_ zN4S|$_E+DW`Fn)A!)vDYwy$DGokV~7JfGh_&na{7L%xxvEtI887fK(JeGJJuv`)Ht zOA1ULW)f`Xq+>ThDAAd2C^1#Tw}iuYxW@dS=tMjeG{AHhP$B)p^K9`%+p)ddW2umtV` zk={Bia;YEK`nfz;5pChHJjPcF%CycVnsv!}xOyeyW*FPdXDUr8pTh|~bcFWtD^#{D zEuaRjY=|YZGBZnrSC|@pfCSeWon0I?ihQsJQ&M|OQOI1{t%5#QB#%$^pn%55C%KtL zxaWyqi=5(L?|aRJaxs0PHHBkQVGu+;w*x<7TiD4>7Dz&uyllt^+H#154wq!M%Wurd zJO-qv_iu8Bf#Nf(%Se6x$OEegfAaw|=^4QZ30Z@J((qz{;!q;=H>;bnHgYQ`ZC_HS zo@*76gagg|y@i9QN!8iS z?t2b#KR*Q`#X*mZl=0r9LT+I7S?tN-vdswf92eE;xHTdxU#GT)3i`ZX4VrRytiuE3 z^7?M2jR>^fXIqKt@og)@_Z7tzihK+f~PO>bTN+C~CooOwT; zLLB6PQGk*XHny<_oK3L$onDwO<>GK%adkXU2Ff}C9CZ5&_Uc;opP!m~uEOpE&D7I? zz4yoce(5@n-j9wq-r%C+zW2cTEVO=2Z+jpe2K>cv`p%}Ci(Pn&ci_4M19s_p_WE#P zpaPgh)fZ53#Ag2KWnj$Y-fi?-IoAIN$-kJDnP)JP1Kk*c(kr5Y!D+ZUn6A)Sp>iwf zKzDf?z{Qj7Id0abw+5d5;nsX)!%XT2!n+j6h#fy$h9W1ARvDI`KSHm+y~mCyWxJd( z(2Tk5Nr0O$MIyW**Dn47*E~Vwxj1n6#*+eYuLyTF6_(dABh(><`&qqy5w5|#9LXmP z;VnED(M#YnHk`9ZYh>(&9^ayjpAFgTGVk=`-H+CpJLZaq{PKc%Q^hxc4uiBDzD_La zzCpJY##IaH0Hm{PBVIgywz@nB1D{0K-;C8T#v%Q@+}Io&v;B2a?!X!$G0K@q-PXJ3 zaL}hwwoG7B2y3|4OL5WooFo25)6DB39uf9VDRkp>Y7 zmF}K|pdcj@N{o{3hQTJFpb{gb8$=qUn}M`+caD-8IoQU=hx_}9@BRJ*_QTF~o!9F; z&+~E4HEYE9gvr!5C-+g8%*Ve3W?fAUoxfHkzrT10S=Y>{Y-D=T9Icz8E3dshhw!oZ zJ8BOGt4RNkVg~X5B{s1`=huNrHy8SP^3U0YakbB?Jd5V|SlSF)$E2{b2za0h?a_Kj zroaZA_* zUL2EQR#&$G>B9ho0~M3P(`RqzDU|eAq6s6GI28`R{4~(YWhTK)QH3sK+=$A*sd(y# zSvqH+ZuzvYMa}vJm(TedKRA97Tpx7BO@-Juob=F|#;R)1XYo&~)coP3+-fpnzGo=X zGs8S`^ireP0BcwEG~rj@L+sr5>^t*jiF6$s9hF?SP}faZ3#U7$;Th>pt?FA0Mmmzy zzA*-52ZJAJDU&e%?z^nxabJ<6h+ ze^l8o_mUP?BIIHhZJfGx_q*gr4SoCKX>1)%Y_M@DB9KY5Eu{ zzPdTBa>qK*cF5cbF-@Uy>0pK<}IeYn@DSi0>L-qa4vOVOne>)=fCpP`5V3L?5> zs&M@Sg+I=<@?~S#fr!^&rX0DZZ;f*g{_ie;m9*}sdNlG0z~9ukq~iBEbIzvOCf*b4 zD>Ux@AO`7LaeW5=)e@=#NjHBz*4$6x0c*l>;Z5gpV_47DEPv3W;+I(E#_0WDC9f}k zjb?aXwj^~~p1A>n{(xE6C|`puP0EZn)Y#omJ_L8FO{~bh+c*&D`l`lFLAyux9}Vrc zM41J1v}?>*N8QvrmV|$@Ufp?c&dFY}$dPrtHpV%1sfp`&_W`5?jHUOM77|bQc0*eNKaL#ho-k{(&IHcq3ED{$>$Jtf zktEO!GipDK$M_ykBW!qAntWCjQ(`e6<5{<*&_)IczL%ofP8I}8B>)+;yV@!cJ_7!% zl&&JFBEk$ck_Yd*9UT{ygnxF+1)j*h3}2$h$sjH#sx$WlXzmB}-1`p(;ex;9Y#Qmpq_%9WG??0hT zBgr7v>=9{y;%RPj~!h5AC&&&0T#&Y8lhWfi~EoMdYuP^i~)1pGs8@=B@U7 zr=Pcc^iz}fQOoD2dzDmYo9x>Oedxc|cxSWT(|Xsn`osaA6yW0z5ljCRzW89R+brqX zygRu0MTEVV!Xc7<9gIF1)EmgNoqm7wXH=riu#YMX6Y94HNc``QhP}~Pa{u{ybV-mGCMSXa;h2At{UpE;TQktiOQJXe|=H);@+Iqk0uVr0GLwWWvxe0SQD;R=3dAYYM^Rt z(VFkE^E%D{vrO(tlo$Uo=AIdJA#6P18Jqe^)lGE-PN7A;RZm52L-`+M{JQhI4MG$S zzPNpO40hEu@5DEc^7dV(eoCp@N+vVI0v9Ds*O$wmO{Elr`bP{WNP0%lht5T`x+F#*h{EQt8jZWWazPzvdAH9uBHGjtZO|DV?hV%oH z`~(X<=Az{KZ_MOVM1VoYIsd5->yz*%$qu?EP(`4b~?rHXg2L;s5p-=`Vu z{NM*2ZzSa2+#E6EU*8{|+>Q##-UygMC6DQT^bB@51+p=IIBb$qCfyQu#{ZlP>hqkkDSclCI+!aV-|FCE_;#~6#U!tCOf0qkNVW!(d zTSD97v$77ALg1#5s}WtJ&vVWGq<06GK96UBW-ioR#msegUYfLI#Ks58yVBu8bS$bCwvfUaB^bh>b2*NzjJwJ|nV<3-YIO9D!_E zp^DL-{9XP!Sr}N#aQ7O5NXt#C&31%SdBRCz$GIz%i~QLbzm>|#E4=XRbOHq`*|{j) z8dd_!s%p&ZnkqoV`Yi^8-+^%!4KDGD93zA_MRC>DefK+Mc}K;MM){5^ufCi^v%l3G zC~nmpRAi@kB>cBKe2>;4^2N$YjMV!IJu(^ksDnwkrkT*(m-cRV|CQ=**8^>sGzfD7cys9iGp80wk*n@x(zJKJic<53JD{Kr$8@>oqI z4}O&_{wpCgiYH?BTx}zmzFrxA@pcfiKvdt7B+jL-`Tvjhg>4b?K zu%yQ2rOyn#GPvdGWmI69I2$6wHov+E^pfy@mqkxa>KvqCkFxT*VphXG^_m1(@LM$2 z5ZYu4hm{%}Ri!+2n>g3&dD`CVzxevU;#U8q^MjU{H4&VMG2|~@w5~Szty{}!BzxuC z&xfxOa)x~_;(ir;EOU3_^f`09lS=g?hWMgNTeaN%&|i{2uHUjn*c)l^L{1Qtr1xIKg>S zYd2J+U5LTvEU;5od^b86uV&?9r|a^6Bkxv{IT3K^+x2H5% z&fzKfoDNb6O9)Rg4le8_zr4bYhp7ebI^zG5y>uO;A^f}X5hHBN6 z9=zCPO3`NYnNtefS9IFRhv)7OTQ6S9AQa=UOSK|OFONq5{?J?3$WYrDHfChj<+fL4 z4Uk&`OSGDY#<d?^;eyr@tOZH(>X(-?7U?3du-!2VUZiIjU_kP*PDm&VSV@p+Wjns_S|}cZ($QN>V%~%1H|qRJl$GuiALaN19*xQ zo-qyZ2{tZaxu71GX%iSjWZb_?KO6cSXvz`-xfNW)=$Db5pvlI1t;s@kWmtEn!-7$5$6$MD)xBXAi zNk@@p$GX2b)Qf`Z)g#|Oy<3VQW<772ChJ`(V9_!>?C$mh$;+cHNb@m5cR@lr+NOPHeo6`#Wd_966Qml~IfCez=4SrdG*3ir&2LN!ES! zW=+P-p#E=fThFOJ|GEHKWytlO4_+#@)aj+e6Xt>wipfwy$13F)y7&F=u<&n_WZd#G z>%;5#=(57Ipxq+Yl(Ta^vqtUA|G66?>+yKO6F3+H>;19G9=(E!qp+Q@he^YFS7%HP zUaPlOzqI_`L+NHacb{D*H|J)r6sp;-6c)0SbsOjG)+XNS*%#vFnF$SE=U;#zJkJg( zgoiYQnm>5z;&~A%p6+3{dJ5KDFx%x6RdFd6V8cem&qAxIt+*TYcCWURsRxBQ`HB-A zPUHac4}V2KM>$;73Ox-fD7G7x}vT{mZCJgd7|;YNt;h-2gUD~ z=@*=_Q-1@?rz%9SWtmX;^;;8<%#DE_qq0he&n>-L*LPVX{%euM;v_%<_Q;${aCYVy ze$(hi>eY}%{W*!wqx*wZMTG$`GR|t%dwtpX?*Gs95aJpy=r4?u8+Uk$uC{CG?QhwB zAU)m@L&&}5x8mqrc)AB9Y|DLCoOkNh>f-D*WL!Q?2tRyRrKZ)>&u%cci|2n_bmi9} zrf;~#wTlOiS4XH>*%^IDcB3W0cj@cdwSN8qX3Esv)kqfD_|<{)m|7P&ksUDTB>#{aDPafUA@kiHV7(vTws|v^^a? zY6xAF-D4ki8;D%_=;T)l$kpJiZVbj~*$@|@t8#$dHr zNWaofN=qyGhoY+I6>~j$&!@|)y$+Yw?oez9Xl`xm^AvzPk_{3XjMkc~tQIXUZn)nm zue2*1Y?v%$8ckNxR~YD0moNg&Ic%epWt;+DXm~1OFRF2~$uf{23J8`!xL5cUoIv<) zD4sq#lf9iBPae2eU3m)^O9jI8Y1>>=?~Rh*7tsHjw^$4mhRanL3LKE(w;nddm|*n;o@?!XQmnB72du3NwJkCar6~7cb~bhU+||kdM@WC- z9xq6W4tU4H)A9JIv<1l;azdM$F8ozja0(YNJ&3jTjO%$;kEpPY8bh*0?b@+ZTU_LQu#FwS06ej1pzdF-?R-S|$1C&x z0nln-u98xFXz+SSULBHZ2WxN0!(@Fi|6hCb&Pk z1NRdQ&nPCDA1v>^BwY`-GzPXF79LcaM`CaElpxo>FrSdQ)qiLIX1c;3dsw~~B=lPf zEWcT^ABzukJ>PD>J@2Ki+P?cuc+HT`(qCD|5bf;Ln;WN?X1T1>Rr~pyi`pqU!zsgN zog|-e8SDA`wHtY4x;~Gp_xFPog<=6`_hSB0&j23LR8tGLi)n#R;A?+{-EW6V8T9_| zuCh+2NB?;x%0w+@eJB2WS@1h@{n<%(>NL^xRk}bHU+;u=eg7BHuYc-HD^b!d;DWZd zyp9R9cNmUx!;+skG(72w)j=;_`Y^W2Z1-auFSB5FLmbm(_BcyB>g!?E4|?q?)~%hc zaLrX;bz}q-8FaE>AF8!KIDIME9gtY*X2=QnzK-1yIGZ&>KUqT}9}Cw}C}` zAzDaXfdjkL%8^hjd=opIxy`w8eXS9jG7BDQ4q6er{ML8f$w|f)>|mpvG@{{ZTgt15 zd>1LrMcmElQIdQbInPC*CZOJ=Tm3Nhcpm%1n{bp<|36La_sbX9 zM&;LbA+`~e3pGD1dq^yP>E_fasVL`wMDf992ZnFQ=oc=TSU-dgSQ=(JPJ99NlK&-1F7f|0#i=iEB-NK9PzmRwp?L5NpytE&U$<)FdhZ-ZzW#vaZzO#SJA!?{%D0o4$YH>~x>> zfOxAPvGcmGKl=id&{1qiU)Sn!b=n(Z|eLUzJ!)m^=K$wIEyPOC8UMR9mF}D@UDYR@Trj>SRJwy zkr}5{Ul1)+yIAzktG)->?;;UR4h+g-HsA(Jc+(Vvj4h2T|QP~l;#3JVJt)LL7^s^x9o z)e=doMQGIb8BSLm&zI@JEF?AZMR(kX-7_L(s9jd^6J#ucE%J%a#pT!E_TL0NG?!h~ zC8lD+E4i#$C%D`5quxbg5odeXqiZL_1Lz*iOpTJDJZV;AAplwjRZ^2Lr(pJ8--qP} z*T-|>KK&1e($&|0H?}FC@QVyBzRZ1}6DxQ5v-{(hQMiA{ZSC2_m<10fx~Flg8%?u4 zok#<0CDxPw-`%S6D^ee9CF~vp-RA(?pgXa8gk;R0ASrA}jDB^G>y~^!)KQP(qaaRg z-Kny!fHv2taPJo*jyZie4ZTT;JvjEzri(>(8XpL*8@7jEu!B!YFDe>W_;TcKpDgHc z!sq=Cw6|fpy7f)W1>E3O$4J4E`)#|Y3%kHc*ZCNH0!7j_NRIi|d?Vudl3RU=(&8fj zm~P0+>}idUkbo(3WRt+w<4S6$XSqBmGV=BfMi<$QVytbWr;Y7iMEFHKg6FKQG8!`# zLccu=T&seP?azHT_yo)^wOKxBn7qOrJ(ou`C7~ou6D>{-x-_zXn7X$DjrLl3R=_-D zdx}6D_PV$mMSquoid)$=MbWZ%Ur&>Jx*er2Fzp7S$zY_7?_10 zc*SACWojeLGdtL+G#C*fzg1!n9KIogSqjM^=NN(!GPc69hwF;A(*ssDZ#b7icAEc* zy*9?P@IN<4kJc3O8ZXj{yuq-VeFJYKTt8+CoDjz%gJMCszBJf2us@D}_;BpZ^A#s1W_mi@#>XH8{tJL@m9!baG z-FiaYY3iG){#;dRq`kCRL-@fKj)Zg07OtR$>i{p$hAG8G0$UMcyh|iG=t-#S8Vo*u zD(07=e|DW{uocb-d`j_fGb=YA;Z&Yz6FaY)xGg_GZKH9}${)Eu_jmUnTh`rvlWiT; z(Av=RBB?bWZqy$hL}N#Wo5JwkacguEYh_zcLy>k47bj+Urhy%>!cKra0S~(a!PzC( zvsdm(8n@?lXrIrA)dxuQ_pp(V3pLwL@Tee{Ww+<|tjjgOU$M0xG&TN}(LO_n_-SFq z+#!MQjX&dd2kp1_58S6vlJzwdD7Qy{tCwoCukY8At_%6CXa{ zWa2))x+hDhW&8*KGO3t2%lF}TP!Mc`ID8Av8I+PK^6zyTEEiN|+@-Vz&JeUcoh&?C zrkEnCdi$^3a{Gz(&fwUa`uRHU_dSbCE|QwRURt!ATJ`o%fr%*k?1>x@u;vx`Me$k04Jday zd6ue|_wkj|I*~iHuLf7kGz^1s%PM$}rTZ#93N2@>o-hl}*WY`OdA?$99JgT}6<`bp z;*iB11v}a`*oKTH5OaL=(Ba#5c~`(RfTYo)?DfNa*5z#hPq1bkC0*t+8IsTPS&>phr<_*-gLMbH*a^Ep0B^Gg#g0 ztSH@mrs7qTHgf<%G<6I{OF;Kk5FhG7L)R&i>aZ6U;tL5mbp|A*EN(b;FX6laVT=nt ziFs)q7~Cx;Sko&TYMq&)-vaO4ZTU;A>x#6sA?d}}CU8I_@RTfV0?G1Y&w~sEvS$E0D zx5yKtxw{_7^&g3-D+TYI2D!M#m#B-}wj8N1fqr&)UXE?`nIir!S`!Qo3<0os+GZ)n zJzVkMA$Nbm7`1F%m9ln&bD#K9M?z|n@0rcZLgE%p@KXeKj!Mr;@w{=ux8VC3yQT4t zE$1V-q7n`9#nSlQ7J)hXnBZG$8eY!U=_mMKqXdLrooa7*Iq#Cl<0$58*OiYHK7r9d zKl7+sqETUF|46z|>m2K44qtXH;oK56xWK|2nkWp0_nV)QVKChG?0oJkkTyzIxp}m} zIN^2*EF`gGvk-g90L9PoIqa&rOwLFZFgjnki2@8T0Ir*{c%sC;zBo9i?8{X@5037e ztA9_?tLG#tKb_z0j{HLeWnlB@JRg&1lcFxR=l%jXW&_IfS`M`G$_^F5d{M7EZVQ%d zr{cS3+#pyg+w2^4O@&eP)vM7|NsW%6nUUV(hM2O)H(*~KR{H3p@j%ySH#dd$k1~5q z4mqeH^9aqrst(}ADol5ph*Q|_WpK=3-F~9stHZ1MuyaG>>MEYKQ@M)9V_1=yH{87} zUGg1F)FTtDa1oKS>WFdGzWxSyEcpH{u6sgf$(?8EK=Ggg)=^Z-ZeG!o_^BykJ^Px+ zym&H26Pgg6$Oqv1Pj~d>G?{+wQmOfFF`pkBYeu5O=xvIo)EA>G@xe0;f=Z z{$me{X+*$j6#Csoy8fW4R!g!iBLg(mpMGfzMjOd6O10@TCJq0OSw(VGl7?n;rv_zCD$}o3D zle@3)`UCTdx$@^be(_gXKEHV|N`bg)Q8e9Vl9GXPvr0hx<; z@chf8G1rm0zX`c7;HF!6&(fI`R*_C^qqOSkn-(KBJ|1hib96sQ9l8?W$SK#-M zuSD~0n9l?*FL!RugVHl`dG3R6d;91FOQx$Uj#(bl(e%)@p zFK4ar+u3WeqeAB7VEO$M>Gw=cX!R=f@1lt+C zPIB?QMx=#}02#j9$68)PRk)w8(ch37q2b6Sb3kP+jE6;7?#ecBYhtj)y1DId?j-S9 z7I$2Q!?c=>XGcG3dZ(gPM2X#BsY^7*S7rYu=3LiWw8AxgZcdtIKcvjrCx;&%i&Uu_+@&GdZ3JCzjE2=nC(i9Eq?Mx{W0JWW4bf~?IAS+v4N59QH{ zDL)eES56BHsy)TgcP+_5!#UhryOHeY7{qxH7Je?%yu->kG=XUE*~G-6InEof7m_mA z3$hsG;6g0g#|WB%03hPv{b6g4!kVeEu9wmN*ubvJTS&Z{_f_b2~b3mFD zNuz~%>*+qU+WL~*8?jB*UkJeVk)M0SmWTh2iKk2({y~q;>SK~USwD>s>mwfXqgYHA z;&xA(MX7vRq06Xc+zvLQBleh#9CTX=`C*+PdK8-Bc9UloFj4d|!&Tzc>zK&vJZ8?f zDWCQ^Q+#x^u;v=7b?G~%dZ(dQO`EWeCBa&SYv7XbCyr+Ye`a0&*ACm`MS+BwqaNMh z!+*n9p6G#dZx)#z8My!X6ZjfO@Ngd%(+zd@I((!B<}&&4+arDk=GH1G&VHRriGT1w zcgbmhCMWP`Juq;@HR#cD%0G>SgVS4!r+{X(wU*c8Q)E5j29P9px2o7Y2SYO@JZA_t znTY6Fkwpg_S}T4HSw@{D=ByQv47#8$zVMlGs4nv*#k+}Q z*nT5MlLHiP4c6u?8KA!~I2iUg(j~JBg2PtYR8F9#>{+bth}d}kTn{UBUQFQ&*fB& zdEpMPNezf&A6sV0Gy$WTBh;urV7xI&sV|n0n>-9{ zeR6Ujf85x)JqJK0C6FLs8p*b1`JB03HtPKI>S-`bPa}JVfA(d9QvW8HUb4^kaT_xN zkt=USBv028xAn2>!@El0h>`O-C~KKAiu?UsW9i5%k;lbKrm)Z7D13e#K!PIIPYdrt zs|^sDeC)pHoT=1t+wZ`8#DyR4z^33)Fc};jX#dXFM$Yv0dDC<@J74PUzu?NcygdC6 z2P7tq9mx)AUbL_K_+JS<9vrxvU}nS*x~vS?^=?sc3_%6N9#}fPntQJ(Zrcw7j?oU; zrT{7}gSCGV(CMZCPw7GA>xsKC4V~cI!onwJg|v|zGOKjakdSrY+36T$Ed4h3n|d%i z%6`s**S`JgRg5r4jk72Rw9nVyVhLXs-ZoU56eNwkaYK!0r%=!(nk=0CsY^K;BznSB zjek-{19XE>emT37z#8!1;#-#HJmE4W&p%dIy2&1dRn2p`GQZTwZj*gPi7qcW=KfIN4u*&RYhlWX-Yeqc43hd)7`G7)Y zK?XBbp($@Nr5`@HqRMGdmTV17DeIz|24)IOyZq6y=&UK2w#04fQFR%wRr$M!DsNpP zME7~NL^pPPQOHCao5Pn=3m~)-P?-1zcw&xCqS)>c7dD4~8_gcArpX4^vH6W#oc$9v zFQ9PDPFnHfcy6K)hInNbNOi^|P^R)|EVx{=CO>4hJk4vH0Z1Fn!}6_E-KumkQ`SwJ!9_qvo&ZexHx5MrIqQw&ldpp8}Vu3o6FKzC>L<28_U+ zD!O{_@bsR^;I^C-Mzn=S?bz@iss@v|v!Nwy^`$EHa`(PMO&EJK*6ks_cl?O-(ko*} z6dWeK>~$yE$LXU*9;XRIn*3FQ#tOjGJH7=Y;AsEf9jvs2uYVxSA+1EAGHC@is zAUb7ykoSC*el1_?U&wcra+Atg97;aW%ktDA@W<0O>?_k$AX~O7?86*sY350+n$eEY9YD`3JrOx?*a#S6rI9ff7zULTATGTWzk1z!{3VN%_JLQq9GTFdI{ zCD+=I?-DETma0jNx`Jf2$5Iigl~M##`U%9<^y+d|4pBLFVJf^k-g@Po?73wMf2*WS zv=isv`?oGT^8%~_j3Q?2TW}Nt1WpJ=o51q=aPD! zYa!=-vk27AEe=xzP*oUI(a(TzKSbSX!)*Ykp{yI|Q*j+xbdF401fQX7t9+np)OwE$e2p z;A3>J$sNJw{ZFWdrtC0nWVjKo6C7?A$8p|+i`GMi+VXC5b9xD5I$>j$w zWoyj;Ex{}z0p^@PzTLmN9g=ropcpzH%xIE1v-v`CER66Az{IoS##O2HECxnN9N6eN zet?VE8AhWG*u?v+7hnp9yO!c-iaQ&S8HE$DzfsGHz3k4>VcJKSmyZ=Ihfg*|zxNo& z&l}HM4@TVSY_&g#N)VBH`w6pMlF zf0R64t#+jwvlUp`#)+=>cG7bT`$nSgW30+gb1fx`f3j^vs_<}5G%51~gdY?neM2Ri{7O7Lo@XjkWaLmI`F)jz zt2#7rXZo~`nmEf81WCbjI-z{06*<>Z+_nyCGo+Ii2~zn2GB#rNZF}lUB1yR^LAA&`VCJd#%~(8XoAyeGwwtinelr8MTV!+^r#Y&1_XqPUYxV46V2hd`5j z5XMVRQmaCGk)pfi--Z5Z)S>eq_b)h2=Qqgtkdz(kjE@?D4-IfD(1Y_`>2pQee@!8m zZzx53xI3nuhaeMWtAz`n*&fktuP)dzZOV8M6_j{T+&n{n8_O~d2lzp^~1&xrq)X!fw8)7e)4{B$hy zqwq1o$G9zzA8U&dYhwKQIotGOj6uZ0FMkyHHXU)Ie7%+u(6Ekz=w!8$?*`v*v4igE z^gtA(m5_&Xpf_dlY*MJ8K_S@|c-=qbQbl7LCTDl&RCYho1#e(0ZuCzs$y0 z*hzfIK3zV$!JHo}O(X&+(^DsE(NGHX|ZTB}e zhC+@4ggh?7=Nq=}FKNhL+b=}7FZSM(p#HH`Mfs|zR-$Uu{v_Ra{EAL z06uYrKcYCQBLeGB?Q>j(xo`t zdDJW?s6NaI+6qsnF=ZN~T$&N7rQ@D}$09$jFg?`;TsD759w<#LQox0dL;*uujF#B~ zrm*jj!eA`OlnxuY!;3kZIuTewAaY#c1z98G0R%ls01zCWZ5MGyvWgHIxy9@^X2`D| z$L;jkD^{YGG;%Bhgd4*Nucpe24yqQrC$GPU!D`z#_c(Fu5J=v|oz~G1kF^f4-#IXN zgDZdnUOo>HX|jB@Ss+P5o=>4($;Xa)R=AQ5U{dQ$X12eG^z;|!-ra~?9quD^XPu_v zK3W3anvLk}fKO;QLhJ_YGYHxEva7^y7M5ZKBRu*QFKHV92atajYe%t%bGJ|_+AWgw zN8Mg-c1zWSkZDf{&~p>8;8cT{4_T`Sj4uRT(*yatXB?K(&KhO*#%#ZGW>p7FIwIon zgw8S!SJ@rZo9SH}kiw&wkaO`R^-tAurtHBp*{4`{F9N~l-5>th@VWMFg4&>DzA{#( z*=ES0_P|^B<*AVq$RUMJ(nK`qrA%3!NG`&y)(7>fTO7k6{!4LpPs7PbW{l@}5E}C7 z_`tp+Ao;o(XQeJPhWeW{^s$)p>M*39jj3h2&#q_zFI&O>@N~=z&J7LxLQTY)Q~~Y_ zs9Xy^t93Q4S3I(~$qhX0MmTdijy5Q|tVyR2^CE+dL2F_Zvea{%<8N^h%S{cRD(3DE zM?^g&a5P?O3CBC4-|vbIQu^6%hW2&ue80mIp>FqV^%&`&fES-wqMC-w2+Qr`8+If?4C+i`(`><86*(OQi-+E}+W|D~lhTq!O zwnYTfZx*zWG@Eu-Rk0?6>9_b!=;T84hqE<)0!geUMES_-0u#!PR*@jguk~y{I4VtH zWnRWfK~~#v3^=cM5i`0WseK(FL|)+oy7FZDE}mOE%)UQ&VMkAN{GAh}tYPE-Y%PEv zL^eyEiL6$q>YudR*dcpT1wRZBI~QXc`n5rZX#Ru59#JPLd~4N@eBtrs=0@&gn)A^z zMBg3pM+0zZA-B;S%Qy$BSTs+Om^|G0+GV(@EJ(=w#CRLnrAD~I_i^)u1Lx~&fZ4oY zds1D};s8osCql>##@ZB5d&~5R_TBk)ZJp9`HnR8X##zYE^L{t(wEnxj`#?3Yc*r?# zz+84?hg^#@WiAJB?|p}LVb)0`c9qh7N9(^A3v`6m>f90PW(rBCH_cFvH#1sQP_=0E zAbkJmfn;tB@DHP)#apDKnJY#jXgA&KVc1g0RffdPmmw@8!MC3j6nHu9Ux#r@-kQFJ z*$4HnEvId6mhQEZLU=rs_5rfRv(O8I0il%!6tMvOE9H7JF+ANX#8zRHe-odZ>dnrqrvnQl0m(%vegmOG_OcN$tVm?k1;=ZY_ zy_&_sX{VN^GL%o3#g!gcnKtGH7BYvgo;1)%B7$!14Hd+xbp!eU^S0kO7YM&=k3_jb zMpCkFbTD6Wl3!}qcq6*=x}77o09ZwP3H#uU407udB*C$F(M~8-whLL__EtP|UOIu< zOCZU9OsAnIaCK;{^m>>d)Ta-bb33S=&Xz}N^)#v9;-(OQ!RSZ`S2#aCz{Kws=?~Eq zUlv&x6F12bSgJSlLRD>iI1wl8ezwT z;+yl4pKBE7n;(LgDRfyMu-nX)xMM%rQPFMW95Dy>gd=1fY;AY=YAJyBk>bxP1#Lb? zESMdp1=M2Q=YtWEfLdc>;iS>fz;&f8Q2+H-4)BJTSxFQff+XORmaZo#F-eZKk=oUV zVwQF;-LaOY18=gor6!&*=Adt+U0G|#o)c?rrfIVbZE-WJ>rfxts*7APTrr66h;lP< zbNBVj&qs#sc3cR?+v+@xxQ)CSF+XZvt&lx8-F+kMUdAY3(|4b8^cJ^oFL_my)^m%> z*40kOokH7S6(lNwnFk)V_xN_sf#UTp)6$ttb|RR(ODG^Q2JLgr6gll z+P3>_Ion)P$c_IQ`(kCzKKn8UB7%X+Y$j9^oPL1;oK?La810B2Hj3sMUlS>KJWA4& zkx|=$F*wDnSSBS4oPTuvVhCQo63F>*toW>e_7s)z_s9{5=V(ySCIl`T(>@%hXTzK} z7tk7|v=_$Tu>-(2t+0XQuOL|^k-h#kmx$Tpd&G8P>H$ynp0GfqANgFf9)?Ii%T|eR z^cEX`uW~}k*tfJE$zP<0u#FrXfAQuQ&DqtKn9^44=TNF5&!Ku|7UQm=;c<`ZIqLyH ztcB0(6gy7wC%4C8ZZw)(*Ehx;?wIJC7NI_!CS2qWy6i7y$A?vZv%0-)8VgXt#8obV z+j!eBGBx@mSEgm(&fKt24?ieGd>T#n4cET+5kS;UHsLc6puEwb&J0(xd^%ElsKp5^ z@)(}CrD5$b*^n7{t>x3nyOPO$KcX+ozb)IMgc+v5$b>UKeKZpezigWJY4_Pbd*L{^k z+~m-e45%s2(IVFydu3wbbh2rl^7|q`d+}6ZCiYnJgIi&?$Wmdy$6M_ zYf@UTNy0zMEI!R{H+Pw_VDpk&v1blP`IxQiEPGe9$*&-VePh z4ZoSU6lJisR^#N~{PvhUU5KAgX?OrXd=shq`$&M`__MH8xCvv>(hSYfMg<;__m zO|#qgWo3Om*#VmmPwQ`=U}XCa2k$JX;78;0Z!$;ccO(CP5=O~VZ1_g5;_qnZKZEW!anuDRUXwfv(~EuCKh7HO6)oFes4JOYgdU?z3E|C+AXcfP zGb*y=X*a5pSG6JInCcL8AfNs-%1$^{t8tKrUFG0 z-~k^vUNCZgCb>gFXJ~s&{uYY-c&6HLvw>-+K0c2PiAI_!qZed4IC9P=ZESmN3E&1t zT8}XNvsrtBf;O3E0@%RHLEWN#h|3@eus%?9_Bi|&^)}~===b;RPpcY9@hD@A7s|~j zW1?JeUB%7LxTt8&^9YeK|-%m_%9hd^j77aKA4u?(=swx73AmwC*5n2rHalK z6=oZHa*F|2EGw)M8(TdnCBj^~3yp*ChRwxhfH?G(@Azlu%}qDoflvb$<}qOcpJb8# zni(?Y(dzy;K532<>*1a|ZRhOaa*FB^CeO?;?jz301vYKl1qVtEnOTCiLi~LX{}#fc zHj-#Y1fKswn2$Z{#y`L#K60C;1Nn3f2p^WB>9{U&X+=Q1})*&6JZi_k*!Yc)eZpC#1DhS`g zA;?bCoBzHzmBxy#YnSbI-)hR?Zos8vnXCGal~nE7RKbGqE3n(Fz^IBZWei{YK2Q3L zOw^XC^tYgVEMDo13j(%CU>rumPhjNhOc8@u?*D`ARGmAZkDkA`8in`uz3YK1(OQ8V>;Ud^0uct7?uC z5vQqMMiUUQ@2g$xMO`omu;D_y>t&I8tyJ*i{+I6yz@LlTMKr| zy>vYjs1J8!n)qK_eRn+DZ}+}c)K(N#6jjvTqp@n1R;tz7V%6R|v8!rU>`|L4szz-! zVz1bH@4Z5dAPGO8@ADnc^ZU!6@jCbYKG!+db*^)VIAmPAk0bx)tn|)uXvD-W?>Li6 z42UI?D)N#T@%51x+M++Sh?p{gOvU$xXT1-r?V@w*(M$UkQ=t0qrkx1#722w6o@*ZS z&2R0wYB)GcsK5KAmZlr<1y{jKO0?Zs)rJ1=1m`|+(I=^#eWEvs*4Yk%-&hC0jO!b| zUmT5Mg5$nzXFI}Qs**>qj}_c5+`*@6QP%pembWyRt20RXwJporEFWiJ-siRL!{{(b z*BaRB=SGZ#l1mpdllZ%COhP_t9zl#2+9d22w->MdLE0{Xvt!aT1N>;Go= zxT!BxIf4Mm2a^;WIB1tYKj?Y})UPdomCYTO#QKf+jt}P}Y7<2%STGygExEHFp_Q_1 zC_c@ih~Yha%m%;^mKCy`wj-kNI)F6Sw~#s`B3dYP{JIibBFs#ZZ4ZO_wl1b4Zg#f& zABG6<$~n27%G*bo74vBJruB72KcUbyD|V2gI8_Alc33?6pIrct=dmv8T}JhqgQ;yT z&Y<;bxB2YK8+%>q!JH=-VH-KAG$zQctsmn{B{V;T-QLt?nq^Cpkpga4o$P&+64YdO z+1hJ4jqSVNS)IPII{3Z0%7OcJb$;R3i;W~1-=f9+VylO0a)2H_`hbYTxV{I=h*?pw zFP!lHI}g3#GCD#l6IOnh)_0)?^lcB}DB;h$wND_lQ8I7*+Iw(m!BQYAzq;MgoDTm> zEkpRpp(|J)^#}V7Vdwj4=-eclL1>mH38sy|?vd5JS0fPT3_iy7$|;&xdl|;2;Y$;y zq$1@T9COqROh5bM-JB;|5mgUZw)VSuJ^%BlyBS4m_P*xcI1h@Gt2rN>d-wrvlI_Pg z&$3WsWtlO(A}mtFrT5KHlQH=_4JCQY;c)+3j@z--QgTTV99vUO8L}69_oGDMR6W!3 zk1R8iHGG5Dt`vV)wX7$Fhp0IjY5j_idjJm4@k#d_(PTJx@|{uqMMWZTT_4={!b8Ql zASo~o#Iiw8?{(g2PPSgM+~!3bjp_(z!!@|Mf9nF84@ZsG2KF(}Jr2Mcg2r5q6(uWY zof==URtlKcA(z*+!q!TgjimY*n_nMDWC*2gqv<&)VwCfEM<^<^u${H+%Vq^uY+0-=OzR%O+UoZXBNImcPrJQSAxR zy_8sMl~S%ZrPat3tvOa~SZP^|JtrdOQ=54}UsyTH$mHzzaMJI>WPsqwE#tXL-a^uGH zbxZeT&QgrMvNE4w@o6t%?n?9lekAI}OcXlZp2SWq(eHpTDzHZy@3Z!4aI{I68s>B!W zaPzm{g&qbvjjf^}UKQJt#LWMhdvVwmizadWNr5rpK zvEawIsI4$loiDZmbZ6R&4oJ;}HE+jewn-70x(w?-$Iuvl9}rpLlDjVdG-HNlO6GLC z<~?GnC7N4w069mu4X~q$UU1UWBkY97F}dWIGlej#LcL`rB1-d|O&s=%pbV`5-Py`d z*W;2i+mPoc?1nNCtGLahX|e~g>H97W+ES(7y_qMWqMQEJ%)M>J0}LOfKU~mcW4qs; zIqvmTq7j%Cqs*eg*SuEnO3UhQTOG;0iIAIX0dlTpQQwnPF4+kRO8rH@@#I3S9$~_c zppHm^TBWs#l}GSi{Pk^j2g+`1mh*}!VhxaAS*@I@t^C(f>)Bi}hHRl~H)rXb@FdOp zD;LC8rIU-G@Ne^0aum<}cA~74uvDemX06*e_~P95pX9YX&axECS zo=DbWg%DtRNs$}qU>*U}Fph8}yJ~FwXO+VT4Y#MV*>y^Me)rF+vMxrpRMDmJfeZ}T zn>Yt|-@o*;E3u$UmF}ZbJe^!hNxqXnKf|Et<;>}hlXp`MqLBeNl;x@yZ7XV~XNCSbe@$#^V^npa zk>0j__-z_hw#Yr%OK@`ii%WbiA&10MfB%Agj((3?wcFUMa&tE7ZyJ#ys4?LFAArmS z$P#>ZkKPZ~)|)Cot*1`>w(c(-^@K*?aP9eYV(wD$O)`Bn40`r=_tzh_ikYU%e$wKy z>63tru$8yj(!V40`=(WTngeF-mw46(i*CNiu7k_%myknH`-)o+Q3IDb!K$?-RGgs1 z@J))O-7C-!-}zgt<>{~>IKe8|)s1)lyO8>p@~7mwNll(K@YlAW=3A-ojgyO|t&q)= zS{XC@`a3>Oi;%DcRJZv9S`#9es_)5^e$_4KeCsp7+YFS7r^2TWlQ|Fxk)=?pOpTX4 zPwJ7dZbD3Yy*plpkDQ*-XxXBum7T4~+_+gZ*O#xlx9y9?!a`OU5H7<)o&IN;w{w0w z%!1>6{e{ig4if9Hdj%3Pmz};hrB^e7&F#@2b>V@v@^|#LnDw0iyX9H#qk5VIg(-3! z1dK&PdZm*rB2Zy+Cv>82@-^TX=8;y1j_L2hNi^9o%%5pVXsxf?ly@MzlHJDnDA2zK zT*3HE%E)};qzRi%-=rAE5wL~jf>#_Dl>3)oLB0LW#rA62t1M4ryI_8QPDWd196=*U`IaDbKoVS4v1e_N40rI?9s z9^Mxl29Gj*3dbxEnT-2kjLRo(N)cBh^n2V@En8`T>ulgCStE4LL1IICH4W-y;*65H zz|EjUISK4{-&SpoFzCQ8`XpQtP$v4^J+nDX)KA0Ca=lNN-$P72N2f{|XD(ApIS(MfgMJ+0{*tJye`yfZVbmaKCXV zHkXp4ukw>-HQVWU_GR6aS!2Wn#BWU$I2!d(9O$#vkq&D?QGbuP$mwa(3lD8V!BB?> zmh~`Q?QHB?-J#`g=$<_t%bf_*J@v=;OLQpTHWtm*(k@ZmwL>tM?)d0QKI*)MH!d2i8r`l7m)iz_m+oQb zP4QTqz!}KO{BU!wjOJ45#>dGVP-IBl@uIVw$wJBUG44FU^?^jHKlSp-SL<0#$F%5} zFM%D&MW;#8<@RBVNSyr*IUQe)fQ|RdHYVsTsKK1VGn;hdsCf-TiQ`=qOb2)Q=4RMY zy0x)pd)?f(Ov1U+gK$_I+8lUV1Z!+u^E(({c38R|8n$tM6KlbUC5`d5j2aZpLTzn* zFPXk{pP`f7om9Hr(i#*7UVIWiNILDV3mj|F!nQxE(j@OuxiFudwHjNRI2y%P%RfzP z-iN_vnhqDU?a%9bGM#5JaCephw-}it@>*vN*tlXR(ZV+I3+CYzewV!~U%4~7{RwRK ztZ$Nkar5Bdxyp+cEu;u+-9KAo_1?uz9ZZ>7T*k=bnd+jF!&f|Cfwdh|Scl0YYya&Y zgQeCjn4dW79S8kP3*3>3{CVpHG)Yi9Km8_pV+<-^Iu9PM;hLcyAR|e(Uzf9kH%JY} z#Pskxf>T;>KeaUijRTbP9>k_9p20O3heEF!RfLiXZZ-5gnSqk zwkwldU#gX(wc6}o{O*6z@S)@$Jm3AooK($(kBXqZeulp8m+8Z|?!N-J=yi6xRd?`; z&{+xZ2H>n#Pfy#Ppx$L(UmSGB+cg#r{7visv*3s__MS3hO<;`O;i>|p(72}+)Rx|r zSc=cILjBL9vZnl2EI?yy^u2?*4D{)_cE7Ns`n7ZO*1m>3((fol+a+fBs$DCEIO2t( z!TB-hS1`|oy|~fK_a_79=8O_yq=OS|q=r;oBEUIO3Pd=*f$C|8x+(}ngRhEDI{dqU z*HJLwy7P39ZGKaiY+dXJ)6AOuJm>Pj-s7-MZi#4kszRHdkG+(KVpguKMShb#dTH>( zqUqz7l12Lq_0B&9Z9U6a=fOY2f&RWy+B;39JC?&)mesY6X^Z(%9`1kLzU|3;_*=XY zesAUt2 z@4bs`br7XT;{gEsOjHDWH=;00yCkoB#h2tnR9}EeuDdHw{GIGA0Vw)fX(t8-PDw#- z0V=Tj=~%*&<3n`MUiExoYA~hJ6ynC^&zmSKs4%Ggn(0Nx`kgo-(N(_r;n~IdtPI7M zz%9~cyPE~AXy0SdvbN|`ggdn3kf2nv+Ir~uJQrml0EEnj+$V*JSW01=vnPwYP%UV) z!H}aswe(+pMCiYMe;5zFY`^`^z<6V#mYoDGMf3FkJ_3F+36N=8zeq$2vo$qBdqIuK z{1vY1{je;g3Hl{Qi1Ezi2Gg^D@9S%i9h)aEpg(C}79G9c8j=Q68&U=twQ@;Y$vSfjmFG;dW z999&F0-sT=FZmjv4VJ0;d=&>3m>;)cAzT6vC@R6`pS@q`lz(}*z`KE-> zj12R_Bk5$->8i}shSVy0`!7fc+mn^BMm^3otfGH)pyTbcJuU#;;pDJFSvOJxmvKjd%1s9@pgEED}WtXR%NrN{)JW zw_y&&#VC1)#9Y{?pLl{GCQg zns}6xorZfva~&CqvEf$vCK81#;DXId9AMK9OWlCz&rKTLFU(IkBk?~h-5d??P(8w^ z>vq}|`-SGyCc|7J!!@RNsgWFN3=A5ytMgV0w#n3lo$d!e4)6LSg~8|zO-9YaI7A`r zy7^Gh&FORq<)3?Ep|2@C)e+Hv;ixw`}g|U@rroS2Q<~i(=Ur%jFf%uS-HTZz^cFl z9f)GL85qqv>&X@_#gT1tvt(qudRq*B1rJcN%kyUD?;8VD7fFmKc z!JuEXtm!P95pO_h0o)^d7zYBp8~%F{dc8j^UTO`#A)1f)bv;3D^a|#>4zY)oWsK{8 zJDBVS)f=%et3NeXCoa0Ng)=4?EEe!AiN2qL`2Y>%HnHmn@shTQL63-5udl5;Zo7xC zn{~LT)d?O1E1L$h2~E1~iiwz?7cYE~W!$A+hm1m^!+Hd-Ch^~%aQX)t!Na|tf~-4y zQ{P>hI3%F>X^8L2a3&TNR^j_(#cjudAPh*o-Tx0#5hBW%j` zvqI?ZQ-?>737~i^fL!f6r_-NcUAo36W~q#M*lnNc5&MDOaK&fF>=pb}BXZv~y(`9Z z9kW#%{@#2`$q@%kjppM;_l0fF?K_lrd+z@<`6=15(QPGNUhPOgF=paOEtsN4^xzde z3Emk!q>7%4uBpt%*qLxyQCCg3`8EFf6Rq6_<0q{qV?;-R9bfs~htP+YvK6(YpWa6( zKl!f!fT68As;Uoh3z-xYm<{*qMMfMlJyUtL9*RTND5n>~RiY?rnJV}O$mA=On%)_z zvJBAQgj;Qf%FoWr-)bPfGW&f6Yl5DV+x2~D7!G9lp1-0DQ@`$jk1 z*_Ui6A#!02FCN=ek2qudnC(EY>K1lv^ z*DA+sYR_rE?b0ZI%B|8Mo|z_~Gm(eMLT+c5*T= zl_@bXn~>H}IG&}@NnSGeymVdLeF8-ijA{QYJYe3*iT0*zynF!!pbCxpIOR4>bBr*Y zv)mw=t^Qfjc$4s8-nDy&8~kl50auy=z>)PR7@7A|rqxa8BW}}sihU{$tM-cQSv^Jf z_1U!Ll1hFUi5R_mzi2+yA1<^uMwD%GzZ;k-|J(I}% zPlLWKWB8As`>$P9nGZI|32Pqq`C+_h>ssXb!lzTru7SV!Uy^-sD zuMYi-$qYOe=VZjJb-^8=-Jhh>M@@lsj#NdIUshWmW+~TLaCA+d8xJ@9iksdqg8l;j zA~w0z82po=0cbQZ_Z2_NX?|oaQ6ik823?4?q<@Szk*nf`ES;vOSq72jRo@`vNl&H|O`dq3zsDi$4qdr)35q-URU%OBpEPVt%w8CM7wp)7#XOdHfFwAh zPYQ>Ld1)?oZ4rdvnZ9|NB*<)b{zcPjiem~VIZIee))MiAS7p%frS+~}dU~tq;|q+M zZG_XRu&Juk8WGU;NL1Sill1#iq!4{VR&GcR1iMUR@k5(@-7KVCzeq-9cJ44mLxw?T`iC(%2M_(WZC=k z0eb@Z2+$x2Tn^APDUuH5&saS0^&{e~~^7y)0Np33_wS*@uB=SPq zN?4$VW_O(PpDX|0r%)lw5i80_bW}#h_RT+{E^x|G0Q-qm-EPI!R>to2B<@EqkD!KB z(+VCX?JGkv8-^gr#8`4LKO@hF+&w+t3OMJT{vyF@aagyt*t5ymw8igc81!IGo8-WT zVT8~YcocDc8N}?_ub_z3X#N-wsVqpsQgC^3&+Uq{Zril&$qzDRW-mct@jcTBRVO+i zc&ET9x2-PG?-;?&*jktPZq-$h#B=yv&PG?^Fj|2WgelF?{v9WrIhOfV^37d5B?>#P8;p z)4DgiJ%gMuETjr@zUd|OI&kZ5%Ll>{Ex6RAY2hnlZe*F}@mJaOhQqXK{E+HT5ydEw z3VQrYP_g;vIhySz;25%jkZ+DD(uFK1UaOfLbHYMBdLMGBRTVz>Wd1JjFKql5LL4#% zi-}My7&9vGtb8@=g#3Nv(;g;I8@PW0!BmV(l{;``1c)=QCkx7cS~u*VxJq(=fcMer@aW}sY5TZHg^>Z)$oVq1k#-!p zx;*MbVF-xI5of&$#S4E^orT#74mkQ|l*FRlvT@$bST3Bec^3&oj-XuE!@ngT_`Y`g zM6ZJp<3;jsql$?Zir4f78q-`|p;#w*MRGEzRJ)h(`Z{aiP1;tZX27U}9;};86n^TG zazDJF=jF>*Yr#sfzrL(0Ses?~+*lLu8@X^vWdyd>mkk+#Qf&gx*;(@xg^-SHw!I-e z{#nrbfA?F6mtd?{3Mbv$&;MDzO#kRAb8htOJ15K)ZOdRhh1*FA2+o@aHKL?lXowH}8(sJmq1X|i5#+SUa0C$U6MdmeDGxY2MFz2j~`6CtGab<8z!1UkJk{rfcQ ziNZC8Voc(rNdije9^h zHLcNiPH>KFq9Pw0mwSe{R63Akm*EzgdRlA7hJ=iVe1WHK4Ve&EmIuiBZe!_m;Z{vZ z>65zyXdYx(unm(vaNWouDYwo8^Z|wewTknksFenjn%idID*7It&uu4!VSpxmk0GM; z^J$}ngO;8fN1eOu0{G4d+4|H?D1809A@%g6PCP8B@N%VWY`A>YUqCULzq-fe4! z)gP}SCIU2x8uFcpNt9wxIhw%lWgfzpKEU)CNk*R@L!ASurA98-s3)qeB zS!VKyJ^cA5**y3F#(nSfzpLwiWsrR#Jlng7U+v+HJAb6C1Li9M7&$d5!@j={Yxvpq zM669gi9X$ju7;(SOitF$wUbhtuJChTD1{6py5M0LL;U+hUY|mhkak`-9);0`{BZle z4G7`$JUahpd%<_M&rZWfD9S6e4)WEC#!)-{{S5US14_1cE8>BD`}mK}ew%TH#CUhb zf~2%G`s&8*Jys@9RFwN1rxiDigZP5>q?NPsh6$c4zPTYTKVvui99F!~0p_XOnJi4M z+`*^ANyMkBzfUWDA~+#{Mxwx4X<8}7M)SlDa|iIkwAtR%N9RVvu881^>l~tmwZl(U z4Ay(8qxBu<&Z7=<^(_r+l^{u7laq9-LS~c=Qs_q-d)i4I9bO9`q?p2URb1iTZu9UU z{OTq3>+@$eU{E5x@tL6AFG%4|!A%lm$5&9*$`TOB9M%|}MI|3t@TTvsXZcrD@BYll z5dVmCeOxwG_<=}of}PIf>od|5ia*}f5xS?A`rfITbs$EQrmEk|LY>uEXXJ@btjL&S zF`16YnO-WHyal%{r{L)Cj-%0N_VP~d39z3|S$o6ha@&+#H06ngm3$VBaC?r`Y@a7G zUkd+zzxUiae=Qo?j{v0QszD=3{Q<8b+<8<&!y}qJW`m(kauvHi8z`5;p#&05uA>}I3TF+bV{NN1*Sb$FsCd%TAh+nQx8Z~(1>Php zbg3V;!(roUn_mMoRzBAtYa#XWj2bb=y0zM|!lB!y1)sokKk?&X(=vDrjOBl?%?)2R zYn|&4|Iy{1^eyM{ad7&0^cO_qD=?&U%vlRSk7))@{WctKiT#-1c(oh3`9l1~_rR&J zw7k1Rc!<|DK9?3Hwmg-EwkLdkM_6{PHE@p+kgtYog^ElgKr_DGH=bCUr5BNwq73M; zr#vTsoBQ}2i8KZOQMb4lD?j-bt>m3a;p7pXo8KhUS&(nERvhAR6E_5&*-5Mko?xk+QGoxa3X+BN#mlS}vpN>Q@CDKBv@u+P@cHszS5;E-Dh(!|^IE%%d#z ztPM8I6xA^=zLFO|-Hb+hugbaXp6&aLHNfEaNCllExsi|P=#f!>ShtNU*!&||R9M62 z*W;9qwL;2^X_K?!%aso{1d*vQLeqGzGuH?;A}bcb4avRH4QkZz`RX*>yQSS(nU%FQ zbm1N>FT0u?5GRU(hbBBwgq*S0o9vL|ND;ks)BJl}m!lQX<#6>0?(G4^ydl`a#pBC1 zvCvG_m;1JU^3yyVLLS#MM%PFM;H~r7r5GIBY)o9xXs&wnXXc{8(2QvGAXSvfI@JEz zcP0WMh=q}n13D3M>VzP#ti5OofPtHjFIWQ`UIK!BL*=n-O9WcQA2*nqwD;1m!;Rdr34tnz@+baK_&!;*60acH>Ny;OcfyxAiC`s%x@kcd%zg-`ivGwMT z$IQ0CC30>}ul|vE@^?)yI=($+Slvy1@5H5d9O-z&aNKD%u9;+TlY zgYAAjrai)wfz}^u8TA#waRLxcv!#fd9Oumsb|>8Lp3}Z%YIgW?Ng@Mw&2-!`708a*Q+J zKk=bguk|Txc=h6d|Pr0m*Zk7haA%c4F|s z%a(PD#%+;3{+H4;!vwgJ0&Y0*-sGC@PJ>?HK!tM_m;Mk^V55MB*>Rp0rmKTy2;G_O zQ8?s{hJu{);ZZHzUQ8G5*b zwN~|aV&z#v>QXj(WNbR$SGDoT2`kPkd8{d+&dDO{zd*&$eDiT+#dl&XGA!AFMBLdE z)AO#shM{-+>vPy1nf|fm{sgHD>%HUmod_FHHpAO+0}1~Y=UyZ(#oh|#`2kmc=My7Z zJW$a_lIi7>Y302NU+`0=zvTXb)0DDLr+-YqnV5?_@g>|Ow()>JNcem-0;;(;>HQxA z69N;}1khn}%%0e%NtjjU@{urtcK4u%q2Kf<`s<00BwI;HOg`6*34&Ubsvv{cL!#wd zIi<||%i;{U12VOE3R`r|#mbF+@QJAPyGJlW)Y zXpghzWzCd8hFjY}H>Ze*fN^c!Y(+pRf4NDs$|tKeWm96@=*WRQ^1`k8)R=Dc!~Q6< zF9t?|!#nL&qakFJaGD|KH(0C^fuE$Xdt4KJJ)CBZ{*wIl3C;gzf72-H9Y~U4#-vvw zuB?gY5BojlqgtBR@=QtjK)xkE)gmUF-%4dM)!qZX`0%mfBc`t!wf#e+BZADn{W@(U zW%-DE2{^bJUSC-@9!rol_;IGGy}u}vyGrM}x!C^74clY-O^gaxOv;M~r9~fyGv2&S z(WO6<%_CZk*WGK7%f!gNy-W8hV31WV#-8J|I;G^{Dhr-;krFbG)X zTO{Re8K6)5jH6uZC>92c2#G?kKW@FGgFPDI`Mkf44{&)7*vw7oqWgecF@_GojyHe+ z?P>fcGD~>3lDew7eZ*9YZX|+jF%>o#~N;V7?6RAy#b5>)qV^0wbhSR+XbH+wcU-guLgW zZ{YQ(8aP*Axfi|4nFR0n#2etNz2UNSa&UHn3tWwoi^=Dtp*$D4_UkP<_)yWqyZO-H z=!wV<=GE%)*E{-OpT()zK>TGuiW(%gMCERmaB_;;Hi*{cDgxNBp#%`ykxVrs+INAEI`rmlPN?bLqL`=>LS$(lW0~2MDbI?iB zaxcaEJI|NQeFgaqYeTFg-|0@JkBXuKM5D*vFyYRbTJ>sqEX9;aJEd=r-AoS`%z0wY zf7A|J_oQT;&m>15+kuy8F6R?qI4EPjInG!Au(Q-NfTZ^Q{q?zzh)3EHhP*e@OW3v@VePsBd)=`;~uH+&SxETP5QUA5EOTS6brE z(_5@xSwbUw=Hcge?q1<{K(`ts@A?|(SP}T@A+2;=_4-L$0}S-aOdzU0FNdjL)25mZ~ko}C{c3X>njxAD%EOrrd(G~gaLr;?-t4dw9)(6{Bbb6?` z8S$|xv_XyyII3yqdsUP5yz~KFb326~G*U?jkkK7PNfFqG?+ErYW-X`;3bGDY8#TyI zrZnO(>e8opU{Pfy(rse;TqdxLj=;*?^!L5!gb((x!^1giaT5!!x1cd2|4r8Kn#1z$ zAD^3?6uR?ePSRlCftntzGVx8S^4c2={6<3>Cp`V(3 zBE0h(VzkaR&%Z!aYjCQQA+p-ooEEB&dztUcv#ax~ap8_$>lD1+qhxR+4RXER$GBOP zT9GCnFN}V`3%N?wCgswBYT%X?UV}NuX4Yd#lVM)k>37!q=5wfKmCd&W5>64{pZ+^j zqil*+{HGE{y<@hQ85xbU3fDcYIHoFWtIM>8E_wc>`$kaE+U|=Si>o8+gHnL)O=*E5 ztTumFd%#H`5uMt8Ig$#uew<(*w;H+UdL-N|ZjGxNpI_ddKB&-c!>4k^f@d+MrT#4qHkAvA_CC1>IGY3C;>KiMYG)PR;?@ z%R4G%E>Hrga!hF!s&&-T%XwHzUzz(N%dZye3LR~X z{JX9Ovja}RnkurD+sg`n3PD<8&x`i7bp-)J$TRyBJOboqt(*@Gc1eWczq1=lY;)3C;ph7Y4P3u;JcP*E3Q0| z>ycltqQ;%+jI%Jgu0o`OinGjzI?1ruzG>UgjT%uwn=xRGw@lPo&!UjHdqS;-_x`FInn zbpJ;f+!o252?u^H4b(Ob*EPGo@83?O(jc%&y9e-@yjgi=gql8OXwpt8`BLZCyML{2 zqLHxh*JYtk59$70AjIOuEAI{i5zV@9)OrnWGp*s;!jB2n9;>P??BohDtk&vERwrT} zbm013%%Cc)5LkrtN6+MsAgjQorIK!+=0CJUu4cO0tjdGsdCe$=3E1DP__zj@kI-bn zrCi%&eYbS!Enms9s^13$%O3M=co&v4RqI^JXr)$*aasN9Wuy=+CV5)5jbn-HhT(aQ z%JIc_uVtfE!$=TVt`T!0W_=$c8|*6Ff0lFC|NJ}P%mh%+*r|5sL&3G@!jh8Cfb)%e zVJ416+P4iyHtA~2N6ZIh94r{0J!YTt26%7fQ2F5qG;#cz>8IRChQMLJg@W*}VIOHm zHlNRZoA&uCXSj2#<9pQCZ*rkf9fP*6S`Osw3jL;5I>oN;t|<)Y#BH#7!kn6~O6RxpdQ@C4I|o@erL-r)j-LCP>!Cn&A+ zj5l*F-Y2RccR-2lgvkz2uRr^L1e!Z-taaeOLXA%Wu-O_LNTI#^41}k3yy!85eap7< zae^lyx?xLe($21v?qLu$6GplY3g&<-V2IXZJrNg9u-dm$9}56F(hEXG@83Np(y9r+(ex%XK;>)5-7F`UXd=mGVua5X6C2j9KtX@IBn4x{;Mp>_BpeXNitl#tvZ zsl89^@;_cfOETG^oycW`{=U-HaX;OoCga|~pm?I|^WvGK zo)A(H99lp0qQx-`q7ThYJ7zvIEmKXL&dNnc=M&B4+--|Bmhy?ekm)ebWPBtnVLoBehkS71w9z+x zTK;I|ycLik+6tJlDc02?cplI0)1;1AVi8;-GA%RE@H0wZI(7BZu9~30nreRjWF@v} zS@lR#pLxFCHsmlN#d9z?9Rc&|IkdWF?N$kV9s7OzGtsjmP%BLiQ3UZ;|EbP6a)Dbu zYSfpt7BFnFp$0wbIrwng{og3?Z#PSK4AMr z;ZG+QLm6nZq12OkQy)%J+uo%H?!NH3E5{z0s>-cj9;e7{ydSG+>b~FIpvLgaPFks= zr70ij-PA+s-!6arB?TfH55pPjMkj zPF{!Q`m4NH7L>n`&16Fm5ci&?4J`dP_|Sb4cd6fE_ss9B-mdw&j8LNq}-w_aqG*GwYEQ06fKGr>k;2I}8`VmJh5vllpOnri-%6ovoM zx7~E8W=z{3U(s7`1-l=rcIlBUE-tNZ7y1kIpPEsAv0WSf00>;$-ySySPR>$8e(NcM z46T8gaz9*5SrxjvE&(KX)c+kZrXT#nu;R!KJUgr256(GdP+gGsu^~IyDMEq2J=T;8 zW(JA?b(=JW)^SzFTU)F4PsoJ$BdrqSGB5ip-un!fUHTGUkd`03D)I~G;%Yw7`220e ztMwhmFd$E^ETu9f;P~NUV1IQqB`%#EB7WpIVDD?>&7F_X4AQW}w10kc3_kV{ejHvs(Iy6C7oI z-v!L?y`IFB_*o?iM&Noo0(}Qyp*Q&n-=B`JyIiM10dLxPe{m?ZjA=r=uB(R&H@pK= z#-ljXqNe*`ofP~wZYqT%iy!5y#L0#v7Hh}se{Px@S>E^Y@0XCNB-*sBk_qcKYvAtg z{>H$>zf5Q4;INN>{>4tCJ=snBIl*~KMQs4p;2so9^TD4(Pg?35i4phHIieaOOSOQ| zWZsfMD+i<68L~S)#V>)0Nz&>LkYZhcXv=53R>i1k%7k+wn;FvHlf_f zWtY?yZ9)bPJi6A$^;v*?SR6ROHTN;N&dCN5=zYm}J@Gg=3KCaRPf61e{qXKi6pB(OrJ`dZs ze*YVZ!(f&vKmPzXI;!O3Vw3L1Yb(Kv2Or5a6Q)b=w6YlcY8~(ulDR4K;|tT8COhjr z!Wry+CnukvSm*^R{DcRq)=!KoD;!{Nm7-AiM*l(?0 zEzjW|p|+LuZR)eh#GS8vk*ag}ovWV$E$w~d@|bw$oBDWH&B2mzRxv`Aki?BK4jT|Ft50ss{yMVV zSNN?__FuW0CoH8n>}|*QgRXBV0^6W^D%otmj5Kf{>SZjR{(HDj8Qbgb3au~VzqgDt z?&qwqtK%3JWobt3PV^@Psw54ZkGdBfeD=on2JFUff^l9eWOt4to)%-iP|M~gr^HFxXxsu_H@t-Ka@FJu# zHZo&D#rM;n-^MczzCQ$v|1K1vE%e$)dQD>FLioSM+^e^J&=~dA9;GIj?^PgMi_S%J z_xrnJUi4#&j|!c#eD z#QXn97i{x$FV*We?YIC}c2i4k51CISOm%oAQU%bCR4N zZ8qkX#Y2NN8BJ@&Hj)C90!?XGnQ?OKZFZPHe_QW>0ZWiy?<`g1Y6VO^^tU*#@hcfL zctF#J&ubtIx{EOFE3{iOQYq$-hcasxtIG#JI^C1ZCoD@R)HILWVrc}jh)|R*KRu7;03{b!4G;lxU)7y<;bFGHW6oxC=7oM=eXw7Jg!iK(fI1%vb371K#Jd#2Sx(-!kuS z-JLe1fwU3J1)=2>^LfJM&9>;=*s;_#?Z{uo_V$4?VeaV|^i$n+R+Rta0_G#xXLN`w zvYI+bmcuJi1i5#d{2%yxQ$}c@pi2&1brI3aX8Z5paF=6*B3tu5OfRS0Z2n#t?Ey5V z9rBFH-(EEgG67}5A2+p`5i9#&(w3jp z65ow4ff`XWju{_e)c&+>8aunwe=I)VQ`(Syo_)%u@P?y{&&HDGm7)Iv2cfwuYnR$W z#NM0dfqkRI-@lOJ+C4JMC;oElBf}mLZam7(#UgpR_7if$zVxFSzMOv#A-0zu7RpvI z`ntPjzbs2^o9s1#RY>bj@#uyyy=J~O2WfX9r>g>4sfrFXc;G8pbhC{%NF`tH#bK9y znhkL8qL4gMyVwySg9zpYE^qzxzZTLk!+g0W>ka-wx&%ivOht~4d^a?*Djd@IQy;kL zzv2LXLZ-QD&v&zWeb{KOH$wG|cHNeC*~*z^;YD=coj(1a*L$BI>wnrKZzA+C+}`mS zhid56Uek+ZMi~uM3p47?N@>_~HtqvV^80U3%?X6nqk@O7Z$sLU*~%15;S*oGAviA% zmIb*~0c9|@@tC*Wq!Sc+QLSy1;{o6-{{mpIGp+_JMyxoi?Y`uMA0v?N)~rDTtbJ6y zOM4x?F;4T8;8AV@T(SzeCa0Bsaa!)0kcyAf<4%V|wEWIjK&RzXg=JsOl=3SiX7+|^ z=Hp$wK0j8?AkR>B4CKqVD#6L-VK^_bbN+4e+NQ8{@z|8^OLRLe`pPN z;Wd3m>~MG7eI$^<{iVE>^(^p&<>(f`q0CAIGTkVj@Q3N4>D|L2*ApIYoE(MWbbh%Z z93)XM9yq>}t7OS3HR};c6>|BckRMI-U}%c>?0#^Up_Rp1#0t05>uM8Z_&&;>TctA< z|Iu}Ht_Y5Sa6CJqTN}NMD9_f%Y+-XU(+m|-PpoF+>Ea7Z=#1WMX}q2^jMB~X-sLz{&L$4_nrsm@ zom{0U*Hq**eR*X3l_ue%93N-lhamPZ+!{Ob^2S3=RqbX{=>wD9Z2~Nu4IB&0VN)jV zZ`Q-1+^(ufMCV(=bM$)_(VJq?>Pr0bcTN>G-@`wiV%hgG*KA4|J>3;Mgv+^7yD9$x zhb%m~uzVbEx+~KDTKnv!QCdB{j z0tli$`3YA8kdR$r@&uNNo{?p--+lz0wJqPgLTJlj3Wj~K{CapkH(rbQy}^;ls2mdk zj%V~uo3bW8Jwe{d*R)rhZ+FW7AA4^V9mle4i&|iTEm>r-#b_}zv&FKQWs8}anVBqR zMvI}v%xrOsnOn@a?Y+*qXRUqqd;f2|G3uwfsynlyA|oSa%!nqcNTzn}Bk>+Qsf%x% z2!0*ikKwb`eWyh(u#$D2(iy#<_oxevc{u(-+f`xQqGZkb>f+HbB&Cchgo9r0 zwspVDeh<{|30$GkZ2+ffP7)1b=um#3LtdJiUOAxa8LchVtFj+qR5YkZjy%U;l?lJ_ z9WL#CU6r~%Jd~MzolZ|Os?X1BPrRW&#GO4dpZg&CxR&>Po>EBfr&jYd6XI)!wVD}1 zhr!g>p<2>Z#HrKgNx7M+_fivnj zxv?rFaqDE&x$Z6-w1p$;m;0Q`#*gsta;%c7hSpObAw9ZJ*9fqil8$rV3reLwALZ)4(Z96{i3jK_~(!RgQd zMyxGjRTpvhK#h=K{}4G-1XUh#q5e@=nS80BkE&xj zm}y(Cy+AEm94^Z5X}Ed)i$JkrU;NYfV-7scm(c=uNGk8b$j;%!*2R)3c6O4Cj7_bT zRMuoxFbhI4KSf8{-t8)J;o!NoFeSEM!T)j&-Q%bq8tZ znzmNLO<^y^=rZk-DLao&zI`cbh^cphr#x3x-$$)R0*q})bV;i8C4I_^A#pomiBRCQ zox;b%Y0dAVSwGsLDRsArbmSBD!5p zn79rF<6|h?HV)!}lNk6D-_hMO$46QE+sN4yNR65tVFs9* zxcAEgGqtA^KpVEQu~6eXraS#oJD9$GwV1o)C*jSu`k5HogkR$Rwr&~3;kKpwAqeN5 z8}VC_SUki?@Ep$yqo?=BgT2qu>jSP{^U|sy-~osX9$M=T3C5&~!Q9s1e@`joL(LID zayAPL4W@F+}I_$)SC6+@84$4ZYbPYFGLsIZ{n<@f%~E*j+N>ERQ`btgq@s5>I} z*%Nqe>k9AanH}f+?r_u9RZ{y3TR|A)(j-2437?6f0Jtv=#Ymk7XoCu^%pv|IpR>Dmn+;$$^ z4kX0#6-G2ebfL=y{#RGa2Oa2WU66viocqpVU4oyo)m_9#5j#WOtFO(&McrlF*|$`7 zH|b2!g!gWbA;3&VgYVo&Q`Faqzg&j{BSE|bF7ReGdTJJt(~>Fw2(CjrSN`ye845II z2LSj!9J*XD?;?G_Ozw}%bu-&k*G-+wzlq2l9m;|TuayN?#Dx>J%Oyg+M6g7d^-h64 z`tbLD=9$`-OX+LH=)9)DM#(T+*Z08MPp5F5N_!gX>nzP1&ITa?OP(dI$eg=+TURQh zVf3Itw|T*z29FLMKYEzG`l(I@BX7)rGVrxxzwK{2NytGstMFXfX<*yGaUts3;n!n zG~p+7Izj5@VAo{At9Kvto^XWUjfj9*N?XW!Ykki*+_}C%J=HER_r{j0F#VIXltCm$ z>^ij%b|)K6-?kpU%H?^vvE~9B(1)p10Ba`VE3UjMG)p;Oy>ptfzi$g#DNS;<1v{Mt zG@8TZUp?=Wwe9)y08i1Ihvqk_ohdP6e-1ag=%h;tIt<4We2nJu3m$3RCb^%Q$^D|+ zdN`d%ak1o~MJJ~V_$+rotzn1NCv{K7FQu8j^rcdYa~$(|Xg*B!h4(Nt5EkUtPn!rZ z$-hb)E*CYT*>wV=-K2j9Ni

E7;6l`zE|w(EETb>W`g6>{$a%5LFP!ebcs8uJ1qh zAS-a)u@W3$!J2fwA;Z1cUcL~)+79=|e>~-oEz4>T(R#~~ z19Q2_IxES~`}mnYdSTGJC~VnuD`I|+q{!qPdT*=4vaQOngCjePq2coWz4vza^?eL` zz70O_3U<|dLmJKp9^Xp#**-8fCV|qJOT=$?b)7P(>h{r7DfP18Rtq8ut0^%dG&r@bZt_Ss-dE8ZQul3(>p4&%b1^b}jH61U^017Wdi;>$B;YW4 z-h3&t(lhko=o(PDR#7eq+}S$_)m?%mPI>@-eQMb(cY&W&(7*QjoS;`PEGW)1s<|lm z+X;}PM~aMx#=;R-uw2{ zU0@G);7V}HLku!xC}qav6$tM*xB6{}AuYMtbcXDQNnHuM|Iv?Gx$Z93x48A%z zzuX(0M!(-0!rkfd4ru|zCo+@HE7{4>uk<$folNYEl zQnbsJo>w3Mr?S8iqgv*BqmCT8tOh&Hpy#VV_E3!q`MUWi?z02(`Km+$&STx+Mx~pq z*e7mRvuE)gi#dXrtb)mQ(iSQ*`v1%I`Ij4E86^<41WRbF*ZD>mDu5}T@eW=I3Z9AR zMdT0)L5LTyAQe#t%MuX1hrM{;G=9Lr_vBuOkU&Y`otXdhuF3|m5nSv}-TapOEx{AT z*UQuUfj4DxUw|75H41|HRjz8u?g%@4IbinGG}Wil;|w>Zp`%0QYH~ns5;VaO*)Td_ zMkgq&4B?onIG4INZs>~+fXq23k7uY^PPB@zekGibj-KZ$X92Q{!m|^o)p`s~;q$=P z-rmR}{G6iXO%m^Yl-V=Y3MAJaq$x;%=z0fz3b5(3G4s3fqkW`Dx=Ia4`C7Z3Q(8zY z%*IAfOwFB!^Y4S}ODp?aEsZ0YE(*vDLeQxdLuZc0nH6UJ&`GQsLr7 z(T}jYGw%kPZG#Rzq>i@4w$zH^O{_hCZlt0gPGPOMW-x`8+OFCplXrh@ z?&@B>K)O$?hQk6i6UTb5fAWxN1wHHpzh0T5RH=U-;kO@hSm`*z=xZ9B-p_Cbwkq>P zhSPqWX@T?4Q_eNYC|K7H0{@Bq+^9pujoy#xD3M3yrErrhx07#m?D+gkk=Yg5ZMWK{ zw~4y^o^@-JF;XXA&y&7U&-w67wF`j@NyQ%Es+I%~%y+Ja!(9|!C?l`>_^;~0R`o%| z9Ty}k+2#VW?a95yq4D~+_@0kAMyx-lRS1?3A(XLG%>wEZ3=9IpcOSy`J9E8nDU8+C z-rp$GI+I;+Y>F*5sWk}(W;b-SaAgA|VDUzhT~JOxcJcBmL1hR6w_G{=9C?PgUj2mO z#j0@#^u_P^ynLe-2i}Wvdm9pZo(yYKpHUJB5M?*#W+C;G4--I%_x%#6R+Ms!S;g|~ zCg7a1fz*APBE5>0jteK4ZZ?Mvt61>b0Og2{;d-H;K{<_xgDbXOqk3DP5{U1^_=u{K z$E!x@1%(OTex(Cph7tF>UsO7eVg8hCqPVpC!rqJNO8c!>*lQb3IN)+ncU#_t#2>Cd z)?pqGI!HD`%>9GoVy0|FJKHIx*uXXJFO4blib~pFYny#i1~zrBJ*Xw-&Uz(997Q^` z6~JNoL+0zGCF#0ptGCJkkUq-cjqcf4T&3*U7!pK5dTCdVmUTucC`=9zeF$gPICtuB zUw@#j7krnvh#JHU)%6Fa_rxgjn( z=6@k|1a^V%F<+Cah9f~m*_pPWsv2kLr)$qUR(P& z7lTko)#o<6^R?m$g^nDwBiq|t$_weM8(wzgwdEqZEV^e2S4X}nFLf_%4`L2}Qq?-$ z7e3k(M|$w*ZflNq^#|f>t#RQP?|H>ne0X{n>P+)O+loikK7EO|_y-1C{RSDFh!~W~ zjbEcFfu&^Y)C=j9$N@7b#O|=n;N35J<1t^JxK3OMVgkGo})Hz8+gFF~`PNfi4v7SwKdMfG0rW*L`c|;10+2=S2xnmciH6A_%c9{rj;5 zN#0t@$%S*e?L~{r_p5qW@74YNAo}gj{g9sZeW~(fhZD_`m#IqmoVGTqgn$CzjO?V_ z`qEA8-Oa>|JG7`OpU9Pyz-Ln=2`x|#mtZ!~Ev!ilAVp&PC+JSN@9TJaa*^3#_?WlD@vTA*ugbw)z>vUp z>n;kTNs^tqPA^%P^bCX>E?(wMriu;Mf)y2-UpV$G9oRf*sK(jd6R>!i1GQT0-`O5i8UNZ})r*vIsc5yl@;_q)B%0ns>Kr;9w5 z?AH`fr(Pe~W29xKoE!)9V&0c&<6xSzRJNHTeCJ3yvsy7Z`(n?yjMCD31f0L)e#X9ULS z=;$8A_ahE6zriT(la*r&@A@N9vF9b%-?(W11N!)5KEOnob>!|ja~1Y^Ezh}p$z5>R z?4qJ;uUz|(S_UgLP5uA)Z3$>GlyjLRG0%9pztM00iL(60hf{xNlu`u@>;8_!|Jxas z7?>>A)0A)hkA?c*MZtgSv18z*(ZB_evS`H-e^qGz^ZH-6kwW(T9vCb6>hBDpf1e^) zQN{XAArq(mZdd>9Ob_dK<>gjf``-hge>-E4fliWT20BtLec(P_IR?y(^JZYuYRqoM z|2H`{2zjB&Rv%1hKLmHAs=|4fx!yQZ*~&((dOW%9ZUo745c@A!gW)Y?8oRaCuX62G zE!RGD#a@e4k2Ps{1+l-L0?WVCVU7K_VyunngVbVxs#;E8^hxT)$h*E{9m81doNY%7a8HseZy|y&fn(n7&SI^0epUavZ^!N@^Ze`9!st#1 zAiJqSI$tI>^Z$!3!~8Z(ZzvD`o~izKy_yjRYv{}Xl|K3ZD3kv8+d@0v{Gor4wf&n4 z{e2bcJ^a?t2Q|Y{uspB?^rmwA8W!)mEhUp^hI%q#tjyj1XFc}+7>HR&Z$ksdDBnm- z7P(#zj$F=v%ki%l zU>Vt|kI5FSl$*zbed6pH*+oGjFc+(^T6)1!L?TFZFDv7Zbcc zn|tuiR(K9KkgR@HYR^2-*M;w8+~w{DJ+2nt-%ogxPi5V07qNL?HXVE@yi#e*lwZQmdT_bSu+CTo zTnwK8t=7W}BeW2!wI@bO8wQ&24Q^2y7 zCt{!`*)o6;1M!`ArZtL=l3Jxvg8e#kY>1>uzSlr{s}J|#!fCf1XRBjm$y(DZ*H+Hf znNJCMWQ)Q4S1(2vo1$aGiPUMhK?y@hj zw4OF-+84F1$eiWxP^;9vxc+6sV&D*nsy*&&i~`%}fe*VgZe1M@JM?L~3)_CL9?P1k zXG`K`_nSKIhiO+p_r-9zbb8`~PobTT7{2P**iaSVgrbsG!xd|lyOg`OE?7_*bX91+ z=1{)wD@Q;?#aCC~?*_e|FSW)juh*GKY)Ifvht9-#*(T`rX_c~%{Wcj7MZsK2!E8?ae zQ;ajH8AjXM?^tVBiGro$N@k1)sp)BBc6W_xEpq9EUw>6-(~bbusdD6tkFd4|MJlDjli`Ui627~gPZa_xRDaf#ppJQ!H zj^|5uKu6vBTTYMh*c#7emCMH)%jNBh0etlIiCQ`SMSnx<=XE<&LI_k!Wylz`CW?L> zY&qT&>7NH}HTCrc;*IgEm$l8tJwBY~zbq0-W=45$5|ee0TZ+DW!&SLE-*emL$}Y9l zI+R3YF$ep!73ff?O7M8c+2MkWS%} zX|Mp2Ruvx~?uV$g?sCJ&yn(-xgT!ezJmC0A5#sJDB~{zx@V%^&?R&4pR)oB1Swdg9 zj&e$Mg}HKck>u{7y_=mI& zwl1DITr zw}-85F?19jAq(|91ey+z=K0zt9(-^wgybRTsKACwNe1c3#FR80T1`(HBL%5gB+K3! zo{{4}b$aBy`k5iWOZaDFgEBfYT<}uMG3dz?q?nbINWFH%#MG^JGxhoqpirryp|PX6 z_Dqm>EHKrg(nh|#yd23+1U<31mrl>V=GJ<=T01}~%I>|(cKywSmPVKf=Y?4lAo-%^AM{hMf2Ed>>Z;oeO&(`hFXX z`Br1Kio>~8Zf`J|-39uUCS`D4nrMUv_Z%v`cte7w1QZb4VWuu4)o9GdJJ) zIq+f_5wW0meVAxBMV36&WV==W%8Nd8=XL%^DH503cdXZNf-`mhjwcEl@}m|L1Mc6e@`(vOTauF$>L zanWhN&9MGqwd!zLK`wq8A1#i~UREU>{2_5-<$=@n+*j8T8=JoU$}WX(i$UKYAoe`? z_IZ>td)Wck1Y9D3LGBcN0q;DJ?-plAZ7M z*m0%|wQE5_Pt;1Nc=mFLS#f%i0Szu~h56_UkA}o}yX}5#$RSy_(IijKR2-ry7iV=!H-^d z#c%2EOV*;p)bS|s*zBl0aOB2%pliN*?jPhZn>DFLjEERIT}4cd$73>FYi}!^;gtUP z#sPOhi3G|*jR+sMfmk{^+1AKJX*NC81>s8B$2nOKG`oOJJ zI>LcLEDic`9hNy8L{`ri4$ zF>9O)@rc>ec5_<~+yHq&<d{!$QTU~I1c1L6EgURhSX+s@>*sOIuO7LzQ_r^PU z^BxkF&7f!U(Z}f#eiJW$XL5vy=$A_ZyD{{$5F2Z1=DDo>e1*L6;Omf^wne(Loxg^@<%Xu*Q5`DjFU@>!SM z`=Q6bANk<&UfOEdyz0Sch{(xrT#VdoXx#F}exmfkx%fh_tKl+=cie@+O07e-vI&Hv zuLs!c=pa+|I{$j#b=yIWzBIqk;5cG*iH;;=K`H=ADnAabqm-9XF-_jImnSp(h2G_s z_qx|xdOyw4>R{!Px!G9%J1k89nb+fyT^}rcECKM5*Ox{#Q=&{z_9<(ZCdk9hbBg%d z$Ya^1MPSGucK8k+&9KXFkNF0b=L7JZ3ab5btTjUD?!EHWdI^)@Eo?N>wsH{UV~Ly= zMOO0#npwovpev@9NlT)nn1|XU5){ctgF!kGj#2JiwHfOpz@024c$&|#Z!(iN0D5hF zo+Fl@<i;?+-H8_qmLB)P8E#!e7B>Dc1>b>f_$T@ zcrfu|Nwu&MiIc1i`}S_u%Ny7)LDAl``$j*c{rw>{xNfan26Qic!*@!Nw9SYck<}fG z4pk;GU+xFj48p{myNZ)dk1DD-22yH`M>H~g9`6P!8TUH$UhH>Q2$LscQs4LYr13kp zO+{zA9uDCLcRXJ@hpm1~KB|1Ku4$9jalb}yen^eRQJ>cr^&;{mM%`brGH5#2XDjtBvL1oLM96QzKjzpQJndPr#NkBk^Pn%GY6JQAt>KtKckNm{D zM6=XnD?Be3E76O^M@#!K@2YTknzAd@E;3!`A;Q{^)+#g`eoW}k#m7ee zwlKpfZ%&=%>&CerdEyB$-wxW)>)s7Z*^O9copIGWoZTM)YmLn~7{kWby&_=x;P7$I z_d_ht)qV;^?(x4yzy}K3LTodMX`VmX|12xIc8zq)6NY)7zh)ndHFY?MvOKFrKQ3 zUH*G-{z;G1DdHa!{I?NPh*8`dA{VevMt=Ki(R|-;Vl7(zxpLmet+t}Pi)_%zOI~M$ zUxn=-wcQ#>d)Z*m*YcwvyF#Uw#vYk59eM~mzkD@GEfiMfPw@gi&Z2yeN%`mxHNZzJ z0snlklZ@dYs#2kKQOQaA0B=2FI%902tD0hC{^S$#HXxOxU>4lvd*%Rtp2!z~mL1D@ z7UJq-N9vQ`KT}9Rg+?KJ+%mMqqZd$GRW{F1zN1}q{bVoq9wgqi-{^iz7hg40`gJ9T zNZsU|D%8?R^C~N|z@+ab>6jTnZGC@5;plXV<6HKk%w=D{+2;KAOVkGFbqLow={{|1pgBOM} z>@`&0Vga9SVI~DBCo7KI0;x6BQJ3!s)kvcVxm{^*_aZ!t%oy5hV&A~W2ymhaMA5j= zdR>g@G6&Vo%;up0ffDz=q%SHX+nLdpsH;NyXNx_oRdc^8(kfPu9#9r*-5ZtWXB}w6 zUwu9`vwJ;Y2)bZJ_;4#-2)D#Y<8BiIt%s?a1;8P1PG*~jcYrEBI%je_#*fledaV?Lptr}(Wdc0`joXiQnpqmkH-&f9~< zB;Ci0_OsPkGW>yf7IPj=%F6hNkzRw_utCB-m}dYfJc1`sn(m91p7cuL5#boB0VLp_ zP#*(;?3pRopq=}{$m=X>28|{MlbQh)kFu-Az*CfNkh|TcNKDI;1(^BMP0rC#Nk?NG z>7rHaMI!$ga?2%Uds2w^&(8H=U~pV9D3u#OVz4T*Y>y59G472~cFZ0UQHx3xUx2-* zoIOsic8S%s%5sfsEn}hjn*Lfv3KMC%IPfz|Ko%aCeIesJawapPMNhdrtwsmoN|b;s zL9DggJoh<5mxdLm0Zf_pxL|^ZTCIGTe$~0^U_g*bu=MmwOa>%=paS7w;SmCsU2ZQs zrL#%L)4g0IanQuMWWa#9NA0-z@q(>3Cnn=eFi&(e@54mpiNgNdJ>1ZME$6B0w%p*B z`TC{-SW-DzCo45<$tz>NM@~*vEStL?#F`7TF**OuNsZc)giDb5}p|OGYtEyuK?#`&@f*>dRN|s-+THbOotlyci3KF zrh*so>yvn$gr)^fj1trLftwRIo%o%o3E+w{M-ltt!lHKjZyoLQA*;& zd`s;N>?BwR%xdtW_48}K8vFU4SnZrk$q&Eq`(Yv#>{YH>KXU7(&j>8|MXBX`Gx zWBdYsCVA-6k%lM&(OWoM?wva32#6^SB;|!_ULO8zfO=+tL^=XdqhcVMokq^#?he6S zObIF?rdt4oz=E)i=iyAF*g(GxY-n)sBoFG7nd(`2#QldWbl$s#COcrqo_mYUOYX zZpW)UR$aJ&`FqwHfsVThNXj%l2voSgBeeu>2p8IM?^A3NBxFd8H2!(6M(NZ0Uu;9b zjX+2!5*|vKO*c=~4gJ%up$6e5a2JYi#7JUYB8Zt6F$I+PL7uvWk~rjNluS0w zyXa!|GTUWB{>KY7hVh-au+8BpEnsKE8LKCcj9+mmWZ(*rE#b8>UX_~g2`=Sj?CizD zPFrJO?@xdbBaqO^EtQ-K*vHgz3H?G5_;`vrtAA13=-pLr)Abh9d?WrW%@`zxh+bJ- z&T#)xIHy<`GPeg@Jv6UVE-g`ym$`wmgop>{CdYTSIyo0p1xk(9GTw%C04yYxS20uz zWpQ6@D@O1+P4y+GfLlnuL36{p!ro_MsKYOFeTmgXMGTT2yeZ1^SivIVcbuWs2)LBU zn|Qv$M8e`URM{p#rG$V~cV&9HYCkJly_WtZ<6fi{3k{Nf6E-y8;Z~%=)2dwAeA6M_ zgvmqa^}24oUFChRxFjy_a=GffS|Zk^2~G#5kSl3C9_hYNdcSO)p`Pyj^yVeb6OU%? zZW1lCp__lgkuRNG|8~DcutGx6eCj6n^%aaT;7)XPyqve$K$z@en>_m76(X=Y+z02y6V#V1O5Ap z09^a?FI-6BqPdvMqcUeNAf>mn$Hquu>L-K;+9hc8N&eV+^7C1=XmgE7sXoy62>xWS z7F{fpKfC~B_X)qff@8!bN-^%at<9p_XNDYv&{cd>Rzl3!LrA;Q#vAvsTKDVvd2Id7 ze#9dg*-}RRfwZ~T946#I-AX0HV|{{-uIv}&iZP|hCt$As;O|yHZwcat@h|7 zNijlkHBVvxi&^nGg>7RGQ0PEi)zR3^lkjh+mvmBw@Z-DT`3|R|70@F0c3x>!cE!B= z4btg-<-JE0hTc;;2K_xqdyQc&_VJv1?J4!*um^IV+}a%Iv`;@+WnQne{CpYParFEe z4~e(G`F=dk;PzA@FOO*TS39$(xAqR)Rq=b}O09fXT$!*!^;P#Tzf|{qgo8dLawk9l zt}yAnWMq|#;x5q0;oe2O98>VKp}-|;-FPuGHV7_ux!_EFBsD44LtI5faV`cRF5Yur zV+EcLi$N9$Wq%*6j#YRsTyj+${cK{jWNb7Z86BtbG}WU0gLRPNLD<3dO8j#1f!Sf- z#?;chzP;aKxjuvd1`7fUMj-MvQVkro` zX}lD@D16J|XAe8Rk@Cs?3PQvsqUG}K5`*j`jTz_VUwzp~d9Q;*DG)DPR#ug~_ImNn zRRX>0H|Um-Mj8)st|J&FD$Ui${-mO;Z5R=7(LolE^7Dv|g(cM(!rYGThTV(Y_dA*d znLVX-7_Si2+1(^-3>$n&_9m{~Dsjf!tH`?`2`UT!T^QtE zHbXf$^m_>N=qql)%gQ2f3l(neH1YjXfot^?5n3uN>y__cgVXe#;9yw8oEyAd(81-$ zv4f2O(BX2Ag@0^T=dsafOtSg4-F@sVrF{A5!#x!I$JjT3{RcBWky|348}qqp2TfwK z&rZugga|c?Sl^%R?Sfv{odnWeG}|BnLw2}g3W8VXW2><}k>!D^y5o#S8M=yPzFX1z ztD;JFpkyinVUW*Qex)?MxPR8QFwS7M4^BWlOlkOYBpuQXJOgWfr5*QL%P(wdQemUC z@{z+Yf@2QwF-;OPy7;D_6Yza`G^KV2aH~xj!t*ekd>Zmxa%7)-Qci$k8mQ_qGT*j* z6uJ98ia+z3S6vrvh{VDtcwTi1ao5CU0!LVYE04%v2ID^D^ z#uQ%^yeuA94b@j>^+t0NFYsgsIU%s7+b=6xBUQ<%TDoe_me-o74JkEiqC6hcoKpbQ zE?AUvL1wufGYq$;Gev10I%O)AF%xSy*l2XHXNe_>MI&ISNHnrD=PU2qoABR{@j&K# zIo>hpGUxs3z7|{f+{d^M)|qEiF1fJZmn9QA73}xm5h9WJ&POVV4YFwRW9{T)%{HpnMyWmCs zNbA%l&Bv_8g{GmE4E-SchRDR^;`GIH&Hmesk31p{*83i}Y&z9QMOm>j z8!0Y%CUy3VXIs4AQ~uu%-)X{_M2f8?*0Q)8zMI>HiBLAlYxi8srilMA$KL}uz!~fe z-OW6yJC&Ab#(!I&O^}z#cH6@p?qgq&ar-*W2gL@v{iIDCe#RzDMc+ftW^;6RTp}v`}5hOKuqFgiv z6_9+rQZ$79*YXOJ_F*a-gzD`1y`($e5DB<43&5lnsegqwF`y~g&@+}Ge1+yQ6DTJz zOzvm=U^=P#ED`K-NL?U|7!)fXtW*p!wX39`D}xwn(gG;!^Ge!3Gjsl^AZ(yI)5k#m zT{lVL=XBxP9M)nDHz{nx+iUbVa!=MXxYCQ*qyajor#~y|IpU3>EI+P%=7&Eq042n5 z8Y&)^lX)lDSlD(Va>}^~pve2{o-ni`@b-T0DdaFb7b$8goy#sp))OiBv6S!V>#ad!`;8@B z@qC^J$zPkza5Q)p_mSA{(!X_VN5ThG_(?p{6Q2+)iBE)3V>6#Pppk(H`kRB;bl7}j z1v%pi^uk*i#X4aOlp4Do5eT820wMZ6cl)IZN8gR@&0b4`7Ywd8tXO%%T++I0^aIxb zH`X5{2MNr(>KZox3Nbz-XODgkRL~>%W7l5MvH=IL`lHOp1mHoB3AP4nvDTqi>Jyn9 zY83nN4`REv@TOvnuO%aH$?JG9&^G*hk$w$Cg#>YyG3Tgb-n5PH+~H+LPhD46*AlVd z9DQpYzqWKU7F=+g=eybiMn&$NmpZ73-kLhAN+{>akmG9_3Y9xoUJdQCd(;?v`oM^X zbFO{)Z2&`{Dec4HvVzHfJJS#%J|Lqvh-`B8Ysg^py@o(0XON8|klB+Huf^n5Ie>-r zO}>tsH7gef)17(WH`Y+Pmm5Tilb4J0PNBNMP<0R>U;Z{wGlrgVvhc082MWCDw`7}Y z;l_jUdbqqinP~HwttD+UN~J21q9Fa&`Vi?c`PNy}VyEkM6Gm(-q_K;+yO8#ta3%$Q z6tUI%N-HL(DDnPJr?K+c!VT?P@rYFoBkeMRwe&AUe{3ry0>p57x6Q7?Z<*?4gJp`n zuli=9V+DSDc96sT7YdWvm0AjmVQIuK=ei0__K~HzveCyHXCRfc&M`my#|(jMz19fs zY0HRkhW$luUJP3QjB6{$SthFP-1#X5B0=k5mNG`$39gRgxlbXK-J5fO5X#x_tnu^; zh#phUV;RNVB}(DBV6xj_o(W!F&#~g|5hna0wa;@gu0gL0tJ4|MV<5yw81av3*twj< zuyQt%^=>pOX0NS}3vJdG{#%_SsQuE(mF%|o2vJt1%V=@+RdpjbJ6;%35R`0xHfuD9 z;ZMWqJlYy7w0{zugaWR@t}|PH>&Z1_@{9%xgPBP_G_r4D`jB+5r|5dVTetdjUF7id znjl2ARm{xqjLAGklqFrHFeQZ-=a9Cn$?A(4i?u8`mT!H)Vt)~KlJZ<@XiB>1ff zFp>6y+wo=o2RYcmHnWa?ze%f5@J<4 z98pm><=es&>uYDj!XZIniY&Gc3p`-n}#gO^qN0&%# zM9P%)RL4FJ;Ir)q4)%brRo)e=E_(fy0~4h37LfI<^)=@6QTeM_Y!(4^bq%E2!TfOo zjBxV1A|;BuAGZ#-7;A}QBzNV32EvKUAN>UQc4X?M6eZ_MD;11qR0|O1KPvi{QRfSi zl$*ume#yYn!b#kbU+wu?ku6vYC0{(gffQN?Lp(hTBzl}x*Uu7jJ+XX0LKg|S zTp6qDuF3j9ErC~rJpV3Q0q3`K#D|ML!FeXcxwrCuY|(1DMHGY9O_Uc?b@(LfwN%~d z?A1e&7q@5#;5ty2yoFVJJTyR%NRj2jLLXpaF#2BQv@Qh9LUtOORV;&sTu?875lHlD z!(Qt)b5X?2sWWZ5Y$)(rteK^NZGa^!&*@KW$s3m5%e#JZwD*U-bw8d&>29i&co}0fD#1SlL zc^eTtr8*l*oGbbE>YXytD0f7d$wf=hj=it5MRdha8G*>CZ`#;y35t>N^7>B2UAC*h z>hjgRs#U>7fUcsvYsnT?_0!DR@3;k=w$^|V%bKV5zMrw)$@pQjpJw%v?t2e*yVl;K zZ_KJ{Ic7BR;=67WAdP@&0uIkfWk@VcyJ4iaiWZQ<6r6^K2XoU58j+S4T%Jcpc z#3?r#WCCXbXNnfRR^t`;VK@`m3)qdI>cyMm*!^dVIn*yZ2>6!hYQ;(#bKO3d9?tB< z!pVs^iYSp0b>!2MaZk5GVYGe4@qt@>Bv6;@Oi-LIuFuqEVSf07lsu8gpjQa5M zyYjoeI!I4i?clZWX*dmpxBN1FsWq53h4_I}D+4(yMK4)+R&mO=JK2VD7RH}A{extV zAjMQC;|zteG0S#~aFQj`P;Mjx7mR_mR0x;sXM~TBG3dTZAaZk(tvx>PWO(nFld7|` zjjkWX$qW+XO7#72>3Pf}V$V&$JOkWFUzDJJEjAo%`!Dg2RHVM8Fpg*Q>EV`UnSEvMr-BSCFTiKk!tu()C}x0O0Hx`hz3} zNV42VFPNNxwoI;|x_vn}W&u7i3xCUR9=+{xCnR23PqN^wYUf=ZuiZXp{pMHpSCgsu z%$z9(I$|2Pwf^jKSA{aFj-%x2j-CLac_niqtZN;bKKcFjsKk`FBKTiCo3%CeMagPA z$SBWvmWa#t8i&+aS@7*F5|vC}64mrc8p~{lRV# zY`{w*l>W_ddaqVf!tda!hHMhk)&5E(I-PIsb8uu`I4*v8>Z?4#MPy?xy#IKEqUb^; z^D}@kYEvs}64@G{@nq#HbKPpJYSvPe0ddG7iiL~MbPHX>#1w_Y{Obx@RA&>nJ4cRh z2f^3Z7EB)D_0oCLxP4f-iId`|T)>Qs;AOZNc|+_|?b|b65&NLXjR~Uwuqy44)P_5SUOYmKk{>0yla_v@s{QK zDQOnGQ1G>^*U`a^EmtC{wp6IpaWNEgR_alt|?09M=@=wN{VG_I%<@0YQa30id zrv8rJkmU$9U76Lc)AS2lwvP{F!8`pyhFOgNd~WEeQ2y5^-{Es^9tKwVkvg+6LGPf# z04^^-VYXxE5$`0}?dwRdLk>fZ%40ir-|~ovBxB-IiGjv=Io`aorK=ZDcf+i9a+ypj z^Z9b7tcvRj%b!&gWc-PR75ZR4h-7SMf?}y5=*!&Kxnip@o2-!7RImcK!xspVui*R+}eWm!_xW`s%00#5_$hE z!s`bfHYK9iP`Z>Ay<}Kj%f!H={W+|Oq~E^c13lQ=I_^(mqTse#0pl5Z>!^cbzzB;; zoBhvLoQk}dM=J_FxeC!&>Od^4$Ir4Kiv;}{9aAxWrsRG=b6;8kE!cI?sGa0Rq4o82 z7>ad*Q8jnxLeKWA8l+I|NW6h8n=t8ACS`DG`$Bzqw6=HrJ>p#6>v^m0Q1hNP<+&9Y zU=?Q-;nLWCn^;8Obk0;8DNZfJe>;k%y?lG^zqZE;gS&+k#2wGZLnx*h_;Y6;^^(;o zV;nudr9}*~%jcTaXt`1p9EW%k%U8`!>}oIS33;xvo|InS)1#TaRUfWA2Z)*b z#YSpO8ury%PPg-0M1(oAj(aJOlFe_0aU%n8$}G(S<`~R$%>{rj#^Dxf+wq)x^Mmkt z8BAKjqn>5~bsGLEWqjsAn)U#W9pAu;8VlS=9t_;yc+wRC*nBh-NDZg2Fz?`l6>B(4 zpb%83aGh4W*Rqp-Kv$wXA-ba3TK*2o<%OUnhto5VvAFarAJYWM9>HPUtLF#>eZ|e! zfzPkrR8X4;;Kxko(=Qxq3>luB=yxH~ah-Ggs;O#RDwbsr6z!iu`KX|bvoWorS$>a| zY3M&zd=S2zXew=MF?zCYJc4wvD(;0yZEX+PR; za}*ulDi7|S5FK)O_6%1%O8j;uh6g!J&h-=--R3JZYHWMBW<-_3_{4?treF|pz6<4h z>QwPO9-|%3-IWIj;gn&`?0#aEE1cjM#lq4@jA1M@xQ-R;FR!-E<3TOPt=yPWWgUjg zD6v<`d*^W5MaV&X*wzGERB?TbH8NeqMoBItF1BlpbjDA>Y8Zv{!REpJW^oLsI{51Z z!qqTxB0!uV*HuYHe9< z@8ptXN}i~&IQx>}h*#_!ZpjwHV0aF+EEiZDR9bG!NhVf(U}h%sw<(T^l-lThE^RDC z1>TlMWYcmEYv6^Er@5{+?j;ob6$xYyxIbVlL2*0|t5w(SDr!E1gXpaLX=g(=Bi-pL z@+{#0(Dc<&Rdvtbh)7AJ#HB&HyBjWD(jeX4-O>`$-67rGAky8P7mx<&=6Co$@4H;< z{we32J$v@dCuT=*lvKDfv++nk^hyf%`D}|ocs8|d{KSIZjhYc1%{vbeD_IS&P*iwk zBluaDy68Y7%C1dW^gEFL^b*2O)#UdRxM_53C?I%|+JwLKPl)}zq zn_>hFsh|G0g%JAW|dG{l72|ix*B|bEF~N@z@&qXq=7Z763W7=Z2cc9on9XSd zPrD8mTC7ePbnP7@-0UO{@=w<`e9-WSW(U&wp0O&GFA6;p=9I?4b=&hrwAyuuKH)c= zB@^>M0i`akXe96?>;jbry9XK7MCQCwALi#zmTlafm0G1dnwCBK?!0iz< zqH{|O9N?3Ki|?_!j3tS6Jb)bCd_}x4v?8>aiZ<3>% zaJsea{OEXYY1>!|peg#L00v*Z3jyO`P|BtlJFqX#Qa`!m(>J52jLnnKFr^uK3`S+T$85gr+4nzGaj4gB=dR;zRP2~8Yu#@lEW^Yi*gh?)ICv=^BSfq~IKxvXL3JT_;8F%Gb&0g8jOz}(k~@?(w`q2((fH9_PS<9^DdIL zXnMhKKrq`3oEoptdcVYJBJbPmSheaelpqiQyxH7<%Fu_v8gi*?{9u#rr0ea`a<%4N}+V zys1GA_+dUU-Mb)Ed`Is@F1Ej6bCL0RAl&4aI?eeKY$KCF+Y3e(pa)X{ouypYmBda} zwt&(*NHiPSbHYo+O`{zVgX*uncc#&T!VjnRQC$YLLgbVCHxq>!fs-=>IfUSrT?FcXS8}OMNWmf4L@}dHP+KFwaH*+7{D2wnExYg5?`~c z)}$jaKH4Q?8&#(3P?*LeUYX2@Iwn81<`dXp^U9!qiJj%21`f_#U`?GSVWi#5#yg;4 zQnyA2;m~swKIm#{mUw_pfa|e`N;8EKN`wEwSMU*7nLFoyUmplvKw$33?=M$>k1Nh%xpRj7Rgs8<@fWz zU|v`kibHvTC@oFSNE%!*V}(ee<5i30 zc{;WDT=+!`Y8a3r)7Q^`bo?e!)e=r4j0}fQnrDebM~bp}i78jM>+|oIogh46BRNY! z|C5=stXd+Kcv4$NPP&3JIjNyVrs3HE?DQ!k8lOT=+rnkC;f${YsmBlEsqqAywsXAy z!Dnu+Plc2L&O2k(mPO1=<5N$5u2{9l2-QKIBnl9XF>b+f2Ftf75eZc8*O4N(GdGT8 zC7mAB=vVi8*Cucy`BPS~L#q_;gx`@V@1xy|9CD;g`*yMYkAdCU)kroKY3ADv9I$lzb`YNMfq@kf2h^7LBgdU%E4edIy*zlR)HnAcS5f-Joo;RbTSlDl+o-Y*Ei&- zs`8JD1JrA|H0fD|ahz-{{kZ-BJCttKW==rBGeqvhP!(@^ZO(dXvyAD4TjKBYs5e&Y zP^12hBe|I^$RD;p4_SF0jzcxPG;TK&7NLX=+NOkj@YNKX|N>@eM(0z2|mxA5!PN44nwYp*~Su`+oD+`Slm zvmj>;0-RVcQ`vkuUEL$bU1fufA3${t1zsq=`t0C8yg8Y`ZNenUy$|d>6kRPFDaG}xA0dKNKvc*D>Kbuo?8Isw_Jm2fc`_v}6uuXQxQ{XFl{LU%*(m-514SIW zKl$v6%0&nm48oP!ccg!=9DTMAoJE>jCDVfWV@aSzVBDb=qs!hkrV{JQDz+@5Jb!l1 zAiR5kWv8Kb3O_u%g@UVUH^tAZ+vJX~ zdsoS^vOa_f+$FdUQ9J)7yqzc5hpLjDD4ma*zS}TA@%iU16sNj1eASUMNg_X$hwwT^7Xi>`n#6veoBb>ADuX;bji$kL%I}pr1}fStD@=sN zAlQCq$)pLMbJOxl$C33Ll$P66)1@g4HPn9dS7yO??;#e-YmOJjZuc3Vyrcmm0~S#G z4;!X9E=vt(WNhz@zy1GTVxrqyOe-b!BGpjAYm~^57T@W6=9pZId3+vJlD|2NvAbko z;ODn!)kH1dcSHXgRHFg+iUMx@`G^mD!suo-dp!9M1 z>vZ7q+ZG*LL=FDTvSDt)B}fy(MfSs+n{$Sy)Uj-HJ^^7dtPfuvT z{)OH#Q+FXw3+x(*9=?>BRmu|?&)iB-{^d~&N%+f@!f=4)pv9b zL{R|?9tlKGmecs?+kO-Je!7vDRMoZ#p@Kg6r53e?+<%*&!w2JFvS(ukBVo!AvJn3>#LGr2)wi%__=3-dU9d)}KuyL}$ zg55GvEV~!!#p!r;dmTNUOjD?F!=c+sTJQAE37Vf|1JqiqHb0b{Sp4b0ansDXMs!x@ zzF(${)3_DMNW&wK@!U9Y;K(wRzw5N6@yLH&eT$?x^b`-_3YB7X>gm)7g|i_HC4}WJEf;6QVJk@hfA1$mrdw?mQ=)LUg<%UnWk`cR2Bm@SSGVFjQ9KNZfPv zAt^HOGk34HZ^7SIWvHsS9ofm{;PwJ18W`e&B&<67M_hj0+SxVUhAQuI1G<(^;ZPMsre|M@Pf+OY*Xyewa%G-!b5kB-@qW9-l3gtd!Cg+_+!a2+ct-q{I4 zL}6|Y`1NXOk&&3N+ZYg54WDMjONM)3wN<=g`hu8 zjb6K3Kg1s*I(vwD z)beixT)h)lFP%TSWROOQ`|;BC7D6ILDH4cr_CbFg*$G`Tp#+WPpth#q<0~x{rKT)I z#RU3qepS=GT)snSQkPCF;_JX6qfvSa$hq@=7f_8ZOX% z8Q8rG!!FKF8+OAPovekU2fU)Ex!%B60cf9H-o}6EREy$Ey^X7pGu_K!%#oD_$67tD_MY}bF5x+cwB>sE{TqM2reVg*g&0XrM>yPQW_#(mgUlqi0KCjF*!}l8gk(D#;FRZeHq@WGDZ?VE?aeHv4 zg~N5&;hUqT;nPb*I;6BSY(i(qBV!N99(rAw9v>Bcy;&*3=;jip@i7q`<>m!aUPkV5 z4N&k9a@`dY{fEIk{M$5hw=CHi<4(ia-;t6p3Eraa^})7u`D7%#mE?1R?qO-7Na#Mt zsL*i~@6z@JLL{I|i=H_QBomR$(j$oLOYa5ssgm@veZdtszRI8ajMzuD2GNgHx-yOA znYXq)jB#muKkEQY5EWXGd8?CvX$t-?Gm^f`#q}HpSrXsa*K{KXdz)|iT$k$q6oq^# zQX>ks}-bfP-?$_T5)-c;NyS$B{FmH+1!I8iAVVgbv^POa{5L)XR*Ny z3a+LdC%1;sM^tp>P@bJ@xp&+-2!%_q3~zLoaq$)M>Jiz^D7BNJ#m-;W|GI)g(f<&+ z%o-X~1%L<+4_vz#!sKIV28pA}R4vWXqV@N!*`VLAtoVB9=c?;!|4sC%ct_1nV5Vm! z+1n6U3ox<2zNQ#~*bwFOvnHj->y+A5D}3pkXXSYj@#PwtFvu6dE7Y?GC*Jiw=ZxvEix58X2!zS|; z1nM&jz4l&jnhzlWjj9fmO;y%d=K}#~)B&2L#Cp!8OjI2Us8Cr%4IG3IY0#rQf4yo| zIDJx&c(RcyJ6=4a^&l{tA*|wSt`_fnI>YktECh+NUm?s@$_%TE4}iq2VvJsDxd{)s z3NI%b>AXY~`kVdMOp|_cG zBap1G80C6msgGoi^5-iX-3^CYje*TM7TxaQ?3Bmg5A#aw&%>;9`BN9#VvB4dvW;xP z#_4L+MtCVOU&k&25cy?b_ZrZ><`cMU*bpC6ffsD|sDA=baX_nkG17&9lO?^L;bxwQ z&)Q>==a@IqQs|&YbqM`_(Wxx(qDv<0_-q!iPUf;nLIMN4mrB^Lg0Xu~ymzFj-<812J^o{hj*tcWZ7nRuNjJ zrYC(WcP56UW+?v5)1(Z9sl$BFYqj>-v2XS8>oL!x7*IBm0%eo55%Jp({^CbqHJ{J{ zrp4!%|$DC-Y%g&u)5!l@A*o)M0CYxmOXA$Kv4{~Hi2uRRviaapCGIed*vFPiPQgyy^ zHv$;L0leCe{Gi@~_geI=4Qq&;jpI4ai>Aw%J8@$B&eV9aN)8hz&XQ$aqQ0+M=|fe} zcx?MddsQ{V6h#V7W}b)NvH>2+|4kZ|8So4EsnJ&e>H)_$O1#Cnairiy2~R_ctq6pz zB>8XXv+(`YovXd4gFr=lF0$^fBtHjDAXq79p5BEGXZXl9bJTO#)2y$224GlfK) zeWt;o`%X;|ha3T=QP64*Ed*Z)IP_?V}ABUK{WX(YE4j+>Xv(b0Xs+;!KL_|`CV zwW*u7%dbJT@%Z{$o51Wue#go>S+Hx1v!8#*lFl^{ds*??wB0#LCWMo#1oFvCX!!i@ z%9yTK*eLl@RR1BBeR~q^9W5A2H&XbseHnIrIK3e@PW)z}nl!x@Qy;DGwIQAO`)`#R z2K}hHGfV|}q%PF#$}s&WpY#AY7*~6&oYqu#O8-*4;lK&?S`7Of5dT6UI0J|e^_olo zOOf+H2tQCK3}y(?csLEw6(PjZyACo$|2!O_bqn5ooM;$wqFpYSTX}WKSR3=bA4osB zfZU(dc6ErlgpLkyEogVAqjUdeNIS`mj<;%lukQ!UT=Ey*qy9zVkK4JWtfQpRH!cYQ z{*R`fAV$rK2E6WtqoJxDO5?A z#00%nqE*iss#o0XGbxLCEr%b>#`ZGlwUv9vF65G7q74jr zK*j{d|C%F8W6ez#Kgb#-hR6|Z{fbteejS#naw5Ni*Y>nu%nuOmp3$HA7HM14*80jF z^n|WiqT2Pl=SSS7p_r`*&Jx-4EsJ(y-4T&)5v5oN)itisdDJ@ZuOMyAs7Fv z$3JZh=ry&(FSI6?Gjg1M^0w{wH`W}x9A6X_p&@@gVLs@Vhv0cg(puQ4GJ>^3_Y8s( zi(%3n3e_Qb3j8=^v8TX|_X|I!Kgb-28l-$RZ$j?qY198MFpN(96+-7BD4QuxY-0pW>_Rc>`H%t@Zid7YPxH~Sc?9Ni=@uP!*v0E zLI5CCx!B9FkS_t?vfSMWaTJni26iTa3wa?zk2W3G<50{GF8G7#$Zb9sw@uy`7a=hv z4>ruScWnY*vn@0`+e`9?TpvR9I^jmsV;!bSQL!g4}+d#U3xzkK+d6qGvWie;A2qPm_&wD)x z1i>~?EvgK&J40`Bh4<+~EUB!nmB0l(8lP-03GCGtZqY-i~eJTXsF8v}K=tMq#QQXKbfEL{hMWhWJ%?o`N@RHvBt}{6erXF6i}N zqe7B3LbyaW@{j2&ZkSH4P^89@S#$I)jJH0Cz*kbHgCI+X0e5ECVqsKRusiGTh#K=aPFRe{i1XP% zGX!lz=q>w2979oZee+8Jh*8Qc2FioMY zf{_|u#cE$1;LssJDOhk2%yFC>z>I4)nC{kqGfIT@Xq>HnJwtj&ld_N4A&)|2lZ<|i za>z9V8`*^m&CSg6TLzsl!d>rXT-)*0=XN-`%e`#Xb%b*CZ-bRu>PETCU>1yYfDjQ$(sjqF0QD?emXxDl^G8|W^5Oa zMAZY-((7T)|M;aZz;e>PZN&tDPztAZ*Bo5$k!;++i-ps>93CbZWz9zM8kxL1PZy~3 zWQIP`k8rho8Lj(eWeebL2S_Xax|EdQey8!a>XGid?y9q7b}O|X3uPf7o4Y4Kn8=uv z3z#-1a3;GwE(%58aHSzHlWTbCl^1$pK&d;gnMZn`ubnw{Tb*=yVTICfh&N`~s&YZp zg9u(S2mqqv-3h|8s^tXsrm?TE;-2w%q&9Fg?_>+Hc(6A1P%F<(L4VGy zOU7Bse2>_npLZNv_zsYjzP*>z6)b73yQt7h15#G@fnD+lJNmZo;g>msV#p4LRoAMz zd}O2=&K01tyg@twbgJxKH8`?WVRxbd2!IfJCVx{Vhn@5Y+p@TR9?ijWIs&1Hx6so4 zn{7Gt4Ra2F@wFJrWJ8GzzklcMht+}>DIhG~fy=woaQ$)`W8qUR5_e)m$zsg&thAf< zWl|9SOFVbJ=@CDPjLifNo~kB3E9K!5*TL#>Byen`>X`vQtPm_9Pu)`jSqGnW3Z0%I z>D3nB83tz{>l->-{JD+5As5^`=~}1@Qw1kQ-Ra+Pw633HG6m8XdFjFSN$y_SfSxeU zVOv4zEnxHF*g)-AURK&owj6?*M>max$?-xY@JOJ)VSAm2d^pa$>7Fsx+Iur`1c{Ev zQFD%i2n^hNn5rzdAvCz$6AXzT>OZE&u(K!C3~TMFzi)T&e%T(6-u4ucpHP$t=KEKv zZm2A-#!I_0?A@BF|DgJzZ3}v3-?B_D##AwnNq}g0~4ZaIkXHc&YzFobB_6wo9`B3@pC~ zWL?iS1Cz{%hpGJhz00l1^k-i{#&R@CU1{ED@wpSNn_ZOFWI5HA zd)JAb<d>FMI6NTzKKSx0?OkP(+yYX$ z7`(UaRL(5#z)KUkRV*=mzKY+v(6Nb*Qzeo7VOH{2G!&p;GD$oPjX4ara)aANxQ0jG z)l!{h{=S7VwFv*q%U4eE)MK1d?_NP@uL?mXqN~kq)}dANe5MBm(bSmlZt|N5bRQYh zp8e0}qt+t7?`i(-BiaJ&ENX-H>_R-NfPeiUciqB3rF?QORK9iuo#<-Np{cki-!r@! z?yo=wD3L$6y4pk`=aa}{O!Aa1Vz=|)_c;NC0S&YmYp+VRn>Wuf4h~G*P=-?7x9zK| zu?S{#ad(d8Id^W~Eam8Dl|-p`aa3l&a+7+d(&vv3MPe@i&Wb^z0ON~2$;?ggzi1K8 z9SWdg`!dq_P`IYot+*kQZT>DA&ZDl0oT|$1YJ@@V`UC1zCkNNu=7(#iig}8=6Vk5L zC)BDZTL;Pc)8L^Rv;63{QiR~mJ{Op3FC|E+$UDn0et0TFlsEsY&XZUDzVBDkpRJh_ zkaVWTR$wOlk93*%BT)xl-43zn`Iy5kr{lx$X*YYt8?;8)cfaR3p$pM|hqOnc%hlhc zVfiBrsK86y^-Mt=?R&0}(VKu5pn`gf@cmD61F`SPbDNX{MjhR0jDG`44DgI!q+rEL zT`Wrxr)4T*(dbYHZWBz{h=n zzvy9Vo`Of|>K#Nl{WqC&u-d+E#{fxu=%SeNeUUBCIgVE(f}>%c|EN=0uhuBJVN&6` z@B};X4R?C%)?ixKT3V9}pAi7*2NJ7|X&Vm2_}7Y)561q-fUOyw?aGtRtKI;VrPkT9 zkO4$o7R?X#ST|JeKg=KaaXpGfqgz|0qvr}9A@Z(abpp?ShK1QfrUn<2WBJ{+;U|Td zsCpKMY2m7py2vfV8&|Bs_Ka&FJ}R-@YIMzS*7ryBw}6QX`0DpD+&%{skx?j|2}l5R zYA;()59|S&Z-C%Qk?L*NXVjpSIDVS%hGzu(6^mk3-j1A_0+MbI0-<&5W$c7kx?8Kx zkxvi5w6J0^S&In^;o1o<_S@dIJR)R!zuxDx*O2qRCu_F>jxk5E$A!*^ouN17R!INz z?OJ+$tutNiP<+u)6z2wmlgkPvQ4yyR9iA@(Qa}&pT(waP$sq}?3e>4Co?>XfG%g1_ zNSff%37jbc1J&rVpgO#xti!U)mVCT|lSFR^W3n+^9rWBP!iXHg1dr6XiV;@4LX6aG zf5hnAYn>~XUH!y!8o_b5Bj!Hr+6YD-%I5DUd39gW`t1hP&o7e1C8JX!hS8;e4!AFd z3?h1)Seg zD|Xep@or#Du1{lRf83g?ki&Swi_D>u-vXoy^?I#$D2g-+$Rz_`=y;%QKR&j`VNyTP zbSy2=f~nZEFesUv-yv5wzdf>N3Sr%W}0c9 zf`pyzM1wHl#4fZz$L_r58Qub+N?9p z=9N@v9UvQFAv>E%47~) zZf(xcUioWzZ9LJpf@X~*3X|uRd-E^8r4JL^@09Q#bC77);YG5{=~hm{jv%qdD2FT?lV7szd5^Y; zVo-g6mNFT4AIv~>VjRpJl=57T5r1q7>09_MRZ)=ha0i?KMDHA(fQX1h_!7@K6S72J zfGG>69CDvnve{H5gWze4)D|UPQ1E^~u-Ogd%*UEtTG&hQjEcLkaDPZ2_UTy;+p`*t zS}?55QXG&1n{B?#Q#NG*mA8ppCF6>zkD@KtCIV8{CR^@k5<2>N@FRz%I7-7El7N^K zm0AgGl7tQFZ-U1vrR19uvu5M*20{l^Wp!8NzlEIIFANGJbp=!*-{uZ&crqh2`#$pq zrggz!3)e5rMmSt3;&i?lB_GJ%T93(~;?aPuDn(=#c-_dcHbA-S5hR})FVVcp4y?P# zTOik?yRr)v4z48IS1mFAnK`9Bn#UX&aSoFJN4L&vH85dc~KE zqKzAkY(2@GNf=l>1@PQH&k0|DndsUbEiGGtN92nWRZeZF)4)HVnR;*JTLnWkza=TA zDS?=kj-H&*Yn#l`rKh`r6QfLF)fYVev3gjOgcZ!QQ)9CJ1iiTq)Z{-zfSMe)VEq!F zlGgaL$wl%qI!9_lX%K=^Z=|$`RFD1_Kx_W}x0V)%S@LT|X#C=!tBw=&rRh(f^s4>g z82$_;E;7@31e%v5BbLhpI*OWz+@RJON;0D-54x1s$k8;Hpq%Cr_0F5M%4|S}yU7Wd zZ7AM_w#Kwswq2@f-27?uF>q*Y*wzxYy=4ByqmF~)Rx$k)`G^aS`Ju|-%V^5tyQ3o( zoZFC=qM47=3L-@MgPoIb&O@jjae0%U-@;7kgPk- zf50`h(`;M5sMGcDJM}Qw)H;`vY)tK7|B3+skVG>l41tjpiW^G*Cwgqia#?~zrPBLs z7yc`MdBi*NgRs1ZGTJDgBrJ@hrSTsJ16l9Qg&4Pp5dhGR@!BgKp-cKnY*?K__8OvYCNY_}&&x^ris?@5l18KQQ6Wiw5^kcUUg6VhlzD0M&c4d^vs@L~^$r?_=#Mggfn2BHFg8 zQCnKTZqn>P3k1g~&`EOUv%T7pMESVS>r_0b)+Jw1)F~aWEGKaKKn5zDWPn98*}k%bI_w(7aq`le#Buo^@CYuPAqhARcw9Ix<)c6cP;Xz&iVb9 zA1&5Db?eA4L*_ZMe)hX3D;A|O2zyDsW6zMRQOVlen82>D(08rc?@J6dkbVbBq=_hS z5a+(1Xx$A@Og4!8i{=L~Vmf5sx26IvV0|Y_`SNnsGN1-}30saQ$J9@(9q`n9M>>`I zd|fXf{j>2=+&|4GSMrieoE$1x-iBKTnJ93*c<|bMDk_YJ4NDgKD0le=e07IJwhxMd z_GRLh`C($LQue#EF|35aCX)rR8!3v_U%TsV{%j848xg+cUkV*O{qTu|qVc-`0J?vZ zOW^Ly88?dS?j`}sTcpYwivVGjHbx}Wg7?cSzr_2Y(fLgSP_$B%X(RF#*Ax1fki+Ds z2f2ttQYjBAr}FT$`kKm05}7Aa-cfDO=iv>`U|(7-Sl-`3oh8n%q5qp1OhIigxh)CQ zEpLxxvh`y3hWXI<4;OhszazA1n+o}bJm5tb$lVSWDDxuYPB^LgnA%Eb_aaiQFU-;0 z+#dlxTYpC$NPrlaK%j%lR9>m|&rz~W-Pj}wqT;o};b=ExsO>J~QXUoJq1ad0gdG|# zC^l8djJ(aYgv^%pHJwS+rQUsDYNzOUB*QSMjLZ9`qF590nL#HPniYcsEvSPhA8z%E<89Xa@wv4|+k2bcJhT&)`iEf?Vp53M zG$sdP00^pN(Ttl;D!XZL-{(tN|2fzTq?9&BWN7*8Pk|0aWhLFn^;Y{S4E8D(Q_0Y2 zD^sXM7Z(Bd|IORj5+n)XR1`!s?@n=6WmoMlQi1e$in7AlUEsu*dY=VK|X_pV7Z@x1wHs{%l(?{WP6(LJ3X(+bUW)80+4N%Z5=ml zforiGFh-%F)m2Q(&Ef-(s=pUb0Os-N);uJ-F+#$l{uE&-z$Q0H7Q@T@6cq zW*|0_GN0z@#Oh>v(>cXAmoer1`tjpJa-hHcJ76=*zlAF|zXpi6_qmfS07=Sdrd+LL z>e1^OEnVo|#t!j-UpsL;=~xstZm4Gw#jpc55z{r16;4HG%dD&Bw=0kvSD9%`Y-9KqBSWy?n~0RT zli;_}q5Qc%kO(tG!D;B<>s$)+3IMMI-X%F)8#uBJ^yG!1#oo1$1(eE^j6iTs*LvBjmJ$Iw##c>o>AWa z&Ff;5nn@b%c#R3b6lvyVHC(X0e0T>2^JQ2A4qxJQ0ZC^qwSP=%Q7IO{^nw82H$M|~ zO1DxPcyB*QUc&L2f^s!f&UL6f!m7|f#TkR#wa9D!5pdi!40p-}EcSKy%B!Oo!f_4s zj#nj?6sg_DFs>v$8V~8Ari8cZqN?~40cR~#YA7IDkOr!me_S-=POMrRLY@uPn%;zx zIPWL2w&G9;Rq5Hsv-m~KuQ%2$lLwMKW;i(H@vW1Ue>LwE4B2|9nv7KG+Kx5PFvuxi zjnKlGwXbE(S9>4k`gGX-RaD(w73F8~DAwsOnX)ecp}sFI{r33CkI+=2oOu=!e`tIP zW43T+Fo*hb9j*RS+e}}G30?qa5>eT0ho5^f1NmPA>5$K~2cek1D3l)o5usG3cT}aM zHAapf`eWf$@LV9eZumb6(JPBZm7+-AR%!5rV+1{5)!?zww)iPph&T$FO+g4W^A;7P zB-AdHF4WQW$QcUyK2QZIuZ&@}!z0ZK`O}nP>7&7QlOI*Por93H`ZPm1* z<=bKbIW%$fp#Afw9bIsV9kMA%srzv=whlv9e%5jHcAl77UX6~x z1phgflPgf&#Lcr()lk0!3a(3v_Kqm&N20|IhyD@DyEVxm#RQ8MJm@Oz3dEYRTs^YqlmXBf#gnxB0$+F*4~F1P@?#M7#LVhsT_E!BG5KJM zGBxQT(HAL-o3hpQWpJCV>dVS@z?>a`lUr+8Z!8Swhiy{}yNBYqtUTplB4zVj`|WD6 z42tWYLP>Sc7;ukfi*_1DPo5hp>pChKHBbk{(q{(xL4P5Ys=kOTOktay*Y} zE!B_`do8$mwRW?9c)v3f^MkUhX$1%MNP=f)bOM<GHMaEM-fwE<>QcbGoL??9 zl4={92aD;PVGStju}+6$T?An|3FoYQWb|ZY7r3^5oIYd_bL5r&5z8up#V_!}qANL7 zYgW&WqYYCrHsx^dHv>-ANJbS22lhn+=Quh~6BpP=mn_pa&WG;ZkWWC_2$y{Pk&)M# zs6_CEjqR8p>a!`r;@AI|cg3&Tc^n9I~a*=A7MLXh( zJ%QoV?U4%OC%>|iz+dH73Qv=U6}@i|)WzF$luuVT`M02g(6E->9jtGrdTk0S8JvhqYE5s% z8-D3s1HvGlXQV2L!58}g+qML5Q}?%Fzr?6OtAn>gI8YX&&>qX>;nZJmOJFGBq|teE zW^31HruMLtC4*=3l(S#=bfApN!IH(kMlZ2%oH&=$MUsJYPw+U+#^3S86UAiZu9&s% zfx^`^kW6Hql2PmtCg|EeoH)*4qt?4^hut{LtKD{;E9N7P0%psIH*xR#i>-Da8H+yG zgD$_eiklhiJF3_L-#;?1OWH_fhY`D1D}qUtpi?;cw+|BAEex~W`=Q*P+FX}HFuM~w zPZ&y5gzCnf>U*sezo72JoPfvfLdV~Sur-Rc31x+&8^dppU%jew;lpp>>`=>2bRlOf zOj;w2?I-d4N3HA)i$(^St+AO77MXa~zWLfUe@Io9*IP=xyl|+E(&d6_)0$e${J*P; zL4jq<#<*mhI*M}ytLdq%bdNpotuhU}AlCSYYIt5PJy*rl)^Gaf2lRk-W0cc(O!neu z)*raG_=t*il}$D~tr|>zHaX+r@M528og_b}9saibck5y0!QnWW%bi@Y7ZHmYrWWSR z^K((@30Y1(^D>}V*g4a)wJ4p4rPaaXCM~mgS2W&Q!T+q}5@$e#4g5r~at(EEt=$tehtUrS#Rig^t><9V8#;#?ueb zC5nWd{`LDGf9)Xe)M2e!>29{x7COE2QkH&Cc4Lr9>sY59B1UKTgPIOmXH|rn1np`+fWhZST_G2OYwCMNtb$|o~FbLfry(Uk)KNZq*G-mGM`4c=Rr;|@C zP4v5QtUUh)db_6xAqZQbTA?@SS?4}C#)(PYW{~7?d*k58&(&Z&EE7}j2zHDcEVV|> zORFs|^I|@N6>A3tPPj$_x(w8P*^RJ+sc-ZYO|qjXF?t_$83HMt@rbr|xy`>_ah+t6 zz$dvOa`-^}(&g4iQr7UVm}7Hqa}pifiM6c3M0Z!y5k73)q8dyBGOp1-$JPMh$EUYu zH84-_-vRH%66@-b{m-6WzhfUt^?~w(E1{a31#M=AAPF)B(lpx2JTtu=Vv3y24*1>^ z;zUd@RRpoXe>3wI{?;4V4IJ_*>g0pS;Y0KVvsA|Uqtst)2qR!%QQq?B&m_rvn>@1% z5~yva-Yi^NyBz30>yI4fX+?L9x@6^sc-EFR|I{WbuRsvecH)m~F|X(N*9G;SYQLQv^}Mdy(SJncam#Q# z%GIQcJ=P`lu{0&^J_0JnPK4xz7Y9atvH)KNsPHogt(8`=YRnzKs~Y_V)26V6NG>lq z6yHT7{TT<--osr@R`8MD+^|hY^TMs`x2AC#t+B_~C0^7!s?y4+>?;wGvyOb{7}A`u z&&P&m9k=UB$7|SvdfrMk`HPB*=qfN`1%dEX(_SCZroA?KC)P5@OzYT}f{bsu1qa91 zTb#`H1f6b2GrUf@4+=XFDlV+qVYI%M8A$mgoUEi&DNjphS*KYXGpJjHYyx9CWWi=N zNa=Fy@f_Qnq>XAnS=ndm`8kF=k+t+TvSiwo9ZM_R5D72N^ERj$mT^E8myuImxh5j# zNF!=(Pk@|&ix0;80AE(GEKZ4@--or@BT%mZPorUqOi*?=RI`KC-0*`d5y8+22fcq<>x%{{}67 z*gc5x$AezKl8Y5+#NPbdxWl|E_pyiiH-rA97=^`1twv7QM44M64tfO)<+ztKLts;0 zodnS#{fZh@Xm59zPc|^%U963A3zompZ_Qni)HaWt)#ZV+9WCF0ZMGmOWf@7dka8(b z>-b!<-BF1CV3uq7O8|F6x((J+Ylk>Rsyu2`z|R8C51zss>FN#djkBWH8ZsXG6D8gK z7*8BOt<$;RkjUm}YzW58;R-&W;e3t_z}fimaW10f>M^=RS<_Enzr6I0>ikr+UxCbX z8qfDO1HNzOe(zu~mz{j+hu5xF6LHy}JDiGP97d-PON}fz4zW9hnr+mf1WKpNH zxlUAex?-C#lx5qYzy5HxUeO4G8z-C8pXm8NdgHa*ZAfzxp#`sn4dh^cDz~cfWCGA$ zzH~58k+g%8*%vf@>3>>ga9&| z+6{j9O+Uxm$u;R%mXW#HFx?t?_@$G=yXAV(_@FY}CQGpF&lc2z?b9lq+!r#(UbGdc zrR0Zo2=!8g3lhiOxO#WZudmp5(aI(6R^K4xb~o&&lOEk)HU$Inprgii3?d~YZsh%FOTItn%;cVo`=TgvgT}J_no4wN> z84SB9)GHX-ERf6`#-ep`(dr440Hyz-ci$4dz#>E3n~=gS+~&>02XE>P9LJL>$j4FW z7+#CBYsIv~D%W$Go1R>F7U7SVz$mpkbs*z^mk1D9#rXu(Br(LBI)Cw5w(w;KqiMKS zN@uxG<>9&-d@^9e(0UiR1@hZ$py@{zmA`bgx2v~COD1{R#J8e0UMZe%~qa=$1V0ux~agb>_kI9nc&DjG{^Fmck*%+Lb0`);1) zA1T$-=ECF9buhokLq2pAgzL_ig%ZZ;|8`=;I{isg#|}`aUEg`3RAVtib0>$XGSez@ zD>Akxv`_j=A(A?@dsSHLOkbqXc&9YaS2k*tBHP{NbvzD|o$s~zk1|afDLj_)Q3%e% ztSh#1V`5Bu*G2BVrJ|3gCJC``WfDwzB%3sQeV;aaCJ$B#lS=Hq0Ue?$aQjD1X}FVL zXt0n$CCL7pH5W6&Ls``;;^l1HsELjVA>d!A3FpZR>-H{$tN-4*62ucb-D)?)w&POw z{?_o%I|ESKE^_z;?1`a_iC@2ObZfDEi4o&ux!HJJ)kdt%mDn|#lvI7%rRA>|H`}?!)uUtMbhjV<_2rId3ALe+8ki;=!s4q^8DK0H7eeP} zE)Nc#ifvK=LqYzsDf9Q!fgNc3gIZsN{}guvjox4PR$2b>avRu`YC`4oYXhgDE=p${|AT2uHwW1Ne0r*{r1=_n`uOlFE9ACO2H zok*faKGR6q#w$~UGyVz2NF+O9hO3x)(24Jgd>;FmDmf3E_!R#4qRuPHompP5V(Ztc zzx7w`OmGI_fr0+0(m;}66ZZeH_tr6ebZgsaks`&R#a#=#Oj%gO>~|f zr$lbFZHD(*y{)Cp$|74U#`s=>`Mmi2&n@qqKG`QBaUriiL!-Ntn%;<-M0-#FDBtUDhAW7P$t^mMB3dxY z7f}=E{A)V2bZDgn1B0%%!p}Us7*~~-1pn)Tz*A&mxyy!}1D3Yls4_&3$=U@VJD zJJgJ{@_F>Fy%NSO=EVM#m|_-D_uqjm;Y4nIp(m`>!tmXI~UaUbDl|!5M_m0K0HEbrp^E1 z++U;>%s;PK^mkJ{ZxU}jhQHh3q1=mu$Mb!Vch;c}gx{Pa zr(-3RWNpS4G)YUn$EarUB}Qa}dj^XtYF#G$U72JfM~BJ7gF_5h=qtu5cx+8<(!c&i z-V`$F4v1c7F*w3vas5OIRACtF)yAzo{>Y?ke?}9+uf@YWb_QJ@S{IN`P+C)4#nMQ#xtD=r*FUC>PZ5Ut@E#B!vd*~?8%|HwCpYtONEDq zvvA2#8<{We=H!|UJ$hOU$!_ej>B`oN?)lBOu^3E!Nx8^N2#WUOFE4I~lTguUPgb6L z^Sg9SkY`L>pZiiYIq_tU}=91{4S}4GYgIQ&@wBBTwLmp+SId0^1I7i)2N3wmX zxh1)k1OdXa$dO9#XTAw#IT_fvOIeXH4j_uXm7CQ@LpS1x*_ByWQTERaPURCFXI~NS zevRcLLmixkAIsm;E+(cIVwm-H#R7fa(Q;N8MiDfJ=_d8u3=NND)Uu4PLTmj&1O`XS zRxW~8{=mBA%84i;kny_brBCQk0bTjW+t^@uNtFxTxy&rXXBZjrfGK5|Hj$Fl2X}4_*2;=sFLui@n|P zaYv@}KnWWhUM<|&;fg`hGb(j8z0p}eL+^9#HO;Z6D=INfQa@gFy-*L$zXHkc@i^Mt za~SBi8fErfZjn9DPTa`n$m;Xkt6;9KZP2nPwl~|sSG?nqefURIFZ_|Dg}$z~)^1US zh6n2V=!sb2lG*;O$KY9JhAM-N(D|e?kWD63hhT5NDusjSU|qcYX}1vL4x8>za|&2F zVS~z4Jw`I$)9dWWB&rJ)DD=xXis2w*`nC|5bxP*(1?$iGjR{8a*uw#y6_t4Zf^zkRlu(Pd;5I;cBO`~0nMZ>*-z zxVLEg%y0NI>#{d;7ubXG;+=_OKPz%v!q~+R(gNH-zYWmg9{bz9hd3tvl2lZDRJGYtX)r;)?B;!s2B*>0-QD7~1`wA_ecp8~LmZ~_+_+5s1mOW6kKRQR`NoPYlvxP|Y zsISq)-YfZ)*oz200>NyvO(akIn4M+LmGvavlyLB4h_A`e72d~cfps+QAuINhg^!Cx zo6$eRCM#k}vYV)ZfcvlgRQ9i}M<%!R%Er-#%byJ13OqPOxrw5=p!^;ZI?Bgma~;I) z@p@*S<--#O{kTnCBN!O3@CM?^I|vZL`Pmrn4kpzrn%?H*_OH4g8Vq)ack_oI0wGIM z_`K%$MIG?*rr9bR^S7z_;gvVo4F=F;|%Zq}9ll2Bi%)H{4NsErW#UnX{;-KE2>F&i<}Q#7Kzt+#0H(T1)b? zErN>^NPKQ>YJS)?z0~>BoT?B|r76l}2<*1D7BWcOCGH14Ii1k5Ep80@<>VeW`nv51 z9sqAjtHr|V>)l?&0nKC@IHWk5pi7kYeaO0nAvO2eHA!Fk@!jPin8ZKyVPS7yL|zvA zbybw0yO8yp{3%&|--GM+)ji$> z*&xRvd!S%pvSFOONEQ|Bf)?qG;Xnl!axO!0GIVZO9De zG;5FY@4H0}?oY8eiM{b^_buMCZz!21xkew#r@PxwCT<^eG%VJ*rKG%oeAORgk0=#LYNdOXo_ouh5i3 zHs;;Ra~U#U=wZ%iR@}_9xO9f&u0Biqnf@6Q>MrJK z#VmJf*HB{gKPGjrMmNXf5jJr;WW5z%t3)pj?x5h1M%!VQ*FQm*%z5l7L8Tj(@C^24 zp2AEVn-bxsAWF)S^xT#R8Ugf_Aw2B}5?|k{cOU+k#MEz>u&{cr)U;a6+IIGqc!(oK z`sD(e=B``D1PS_;D*=$h!XK)@;i{2}69YB74usp3CaYbmie$z0;m~^zZtAY;@D7yd z*=GmfwC!pQPU+xNY->V|OzREid0ox8Xk^cnnvRXr+8r{kWCXV3LmZg~PQL9Tn9N4X z^>H1fxM8=5>6bIhSaY#3tI1_mDWH32&?Z%EQl(<-iUsRiBy&|+P1M~QK3{3nL}I4% zOnl!CAw5j&=T2-vdVzGrZAP^&0hKvGUVP7L=$}Db_Ld z(1NOgRz)r|<)6){9OCfTV(AaUW&l&xrQfp#zCJ(XibD$|kn!ET<1facF(NwsDAiJQ1v+-7#~{?m(lrr z^RNVhP!^~KusZp(+DfXPR#>F8owYABTbC92iX;i#pVm=|{%17}kXgm~ufR<|6pT?X zI%hY_EcxW=pE)TNPMja%w*K1kO?uDr4-;0j?MevV0zV#?k_oO5sn}sbO|#pfgSI%b zzs+by43?;ps~}J1#6xSLW6kIl_6)6()(d5irG24uq_Pm}_e0k{M&WJzCldR*wPbEo z=1s|3quGc!*}}Q#N1W?fk{T7z5%YeoT0FaQ)~NT)$a*?qfxdTo34-VA-HHU|oG+cY zjsus{)=mgH19mEd+T5}Gw}QlbOH*^4<6>)SwU;tPNU^mO2rleity=gn{dJF7%r6X< zAR;1Ja_{TFTo!XIp#hE>;)@~9?ZZNfB5ou_3@<-$na z9SV7ES~0KTZ;yN@qxxo8day!P(-J*Wzw%n$ttV)O5E99LxxHGGk(jS7m6fiAjzI}P zo;qjPSy+Zz6p7?)QPDrpC_?03-!Sci=-+5wNF{^TG_(-{SRu5Ukpm&J4 zUYxg<&vBR0s&ovSiAAk++i#v@gt}+GO}S+;$@G>I!#Id(!x8Hk#9L7Nis>Q1$awGz z5k&Z<)Zc;uyNKXw{3ZszunUCQdLz3J8A`qkc&1$Z0H}k-0)Lv|Kk8D7Nti5SjS;DA za*?(!tL4%^qipSKnDrfMYvb%-YdX!R~8nr_`L~gPz!Xt(@%!vHSQ6R24W+r zUFjYT9os)YalA#|4=5WO48Bs#vI5EWsDhoU5u7;AjV;BpJ!(7c(_V-@F+2{InK|SH z#LLAgxqD!-nxs$Bt>HuIOjr-gLA%XlH%&)L8n;XDQjYky;Y^ma1Xkd?tc+(1Rin6^ zT$s9i5|XRh!$2h^%sI)I8;Il5eyf>A_GW}$v!1FLI8vFPkQ@2Pr!V+bw72?_+G}Lw<`PFY_9|}Mj^S<%%lNPz zL%vuvtm1bJYih<3Whg$K=?zUZ7e7ta>*t>*_ST*TGQK{3=GfXHHRYtAyp%IOg_z$v zH^r*9k3ZKRlhLo@RISvajCP}m#LXbB0=Z#_@{50Lb8?EPw{&+6VB7S)p}wBNz$qn( zU~qda-O4%6{)~Ykj)oABo+Z>zyz+s{r7qBUdp)@wD+S@NK`^Ty8OAYPKAo;NqwcIQ zm*$OH(=FXoX6Z&cPVLAMoL?@fqoC;Rak=3Q_9m^^9-OTI=`V05`g>AH(j>UBcq9*K zE^iyVI&IqH;0+{VdLjn%19<|fEY>qAKHfQ}LC?Ab!4K`Kv-LO5lv&2ZM z$LIQAjG6n@a5)-AF!QpiqR|Nr?sTkh>gc2}RdWdFoIDR@X!Na<@G&M1v;#?F;U!{n zm-|hxu+`NUcodD@iBw18zPP49cRqjYY*#+}%FP$Viu`<;YMCgxIIi^JB^)_0n0LPp0cv4N~tRG0FrB#cl>zdeF!BkO}e|v4RK*OYIC} zczgN;U9n2e#g=wH^3{fsRjNqCYZiZFSIFs}z1F&Q7pyJAk=W0s7jKl2XSCab2gU8? z9H8PNEl0yU>dX)6PI7vF#KC6%~Bx{;fAaA_jpKnyCX6X zcAVh&LiVMo{mR&TchbLoDKJ7kC*$6`m{x3#(pV6C;L|+O!gOAGq(5jN87dJ#zEu7` zbe^#>iWXbo_}x8)&&rW@c<2Q>J@!bFR@0O%HS>EzFOn%X;<0?_puo(|8Ewq73ts+o zP*k7lX>CnjYLXB4Q3d6G!vrsg^iDK_Pm-)XeZ@9*$s`Z5wMu^?$IM$4qKAna8H5qg z>j3l57nW9!!H|d!%6dsTwx)5^z~gj^j&OE}Zdmge1q?;aNoIHinS|o#quX(Za=j1v zjIcV`HpG7CAWGHN9m68wO<$TmY;zf=%)Vo>GNhQi(!`y5UVF!m<2r00>~|snlJr2wc(T@hxl9RjrB-|@X}~60}DoRQu+0+?ERRPBJ)qXkBEAK zfr5T2(-f>SbmE>RR1?s2afPNasg4{#@vz`;4Me^ve4VLdqRUEU{uLN_q58guEv$)&rJL9L?tb1pxxQ`4jar24 z>xly=q0x2Vl8VFWcgA*vNwJK4ER7H)84(g~!orv^-yg!Rj7cew&`>UZ?eJt>u|tS1 zwtJBLscNG?AGY&AIZr+%)Gm~ajcy$iSKr}G*dmPFSjKw5E_5~Orz!U6b`BX563A(? zOPk+M^%H<1O;9iL?XjJe=*+^V6XXwN_Gea}gFuCQTAcVCunNL|IT_SIcr%<_tV{^+ zfiA+Ny^*O4xg7ZjLDnMQi~U(Mm6;v#=NW;i!>W3a-X;Sj*b&Yel%iyo29RKokih-H zN*LWV&hcPjvCMCBGUXG3K1o>EsCq5)aT#WK(e+BGz692L6rUo>LWf}Cc!?s#(yxKi zj^=RAKG6U*_d9FasKKOOpY>b%U94XiBq8bv2MPy@t}&Ilu1W3U#mSI1r_@LTt*zjr zh$Z+Hlar{qJq^3CTaoo!voecZJVMo>mgvR{pSNa+Uypgle_EN5bK?Vn89su4X%N3a z20jQ9#|S|-2cBa4@B3<35+WNmC;)ZwwyIgg(24e<#Mb}Y1SvfP%odXpMcKv|8y%^L zf_>cJsYAlN8fn0`&B=>wz+zgV(O0JqFQG`$h6463lAZJ=Ll3=MZ4@R^I z&lI(4rvNYRVMnA=4D%PpC9H0egksN5LLUdVK7;lrxvuQ-y;+~Bnrc_;n z9|>ldc$bIb8>Rtj0>{hUVp-e^pD$7yLE>od7owvW-zzA5vBf*-(sQ2%QUSs$7tQUs z$o~6z%2gPEwf<7q?v83qTa4rb!pmBUE3K7;Lc|5%dzethi;wToha->JtN04P8}G(P zyefa$@9|XN0Xs?^HpZ=Rw_$96jQEfd5{fYvJGAa)%7x8VrfuGeHIDBZ{lc}%s`(U$ zVw@6GE-@7{s?YbFwP)b+o1HoPbJ!SD}>k2=iO&-9BJp7Q{|u zkkezr-Mt_JO91{G8oflB_-$XzH?~Ul9E%0i{Hxq6 zIs!k`VJ44GNr_{Hh2v;)Ju`bb2F}%IoUP1>p(t{FdKG|P0X=FitX*1Ky__Tvw+7bPFO!})v67;^ozZj|D z@GlD?`9|cJuWU4kBG1}CD-G9CN`}4~1ru;8>;-4mghXkp7Dl8*TGI*UP)I;?C;-J_6pxLTOM=D%88w*M^2uPS z1Xs1aP3BYRV+8P5x^k``F9W?E7JgWQ3Y5rk%Q3|fBKO&k znp5fNc6-tg+wy^PQW;f9M)_Z)yy9&msPu+Qd&MD?(-%VDCQN^Kw6{xNF(o(VS3d*` zw9LhsrJ0wlsi&Kn+7US_{+fRe1oD*bK0;Sxbu-~wL1pMKpkoQa z{0a?>>K-3!8~TWET&fEppXW9hd?;Ct?zYkHTb*qNErNay*_eEGIcN?v(s`gUpoS4P z9#*SxD^;^!Jtqy*8f1~PYc#24rEaQi{A@B)^wYr5m}6M1-tn_7(GQpzQ*;_E_g_0v zQi%nBr8-~KDeci>BTpe;8}`WSwYp;P$g6@6pPgKFUf#*w()aCtNiwF;>Akk^pQ7Vu zIEd_s%oj|7L+Cf0l5fv#zI~B3)rW>4OEFLR9$J+UT-sa75DgJtsh-4kev{vJaC%hT zDkfN%Rq*_2LUEhC2}E3t$&(Ookxpsw!xj^r8?-N_AEQ5<{3@-vGSz`6mS+_N zXYu{uC?(k_mhBui!;$SQ=_*9J5&GdaobJ1ZHWnn%roY*!Ma{}|e))7@w(UTKWwlvf zrqPkTAGtgK+~K|!uD&9JYMv|-116`#QFquBBBKTn(fyw<-xTSr?-^lpha}0NU({_c zyIqy4wx_8C@XQzgqMUyyqzc?;N#P6R#?lk#b2`vhcW#)t|07>J64b1XOfKd%6sZ5|q3hDJtjoA|Z7Dti0+CnpYK zKYs(D5^yz=_+aoHpd6rCfA`!DN1O*NM!?+%;*HAopC${9$@jW++U_Mr$4palg6ng= z4}lA90v~$F)vVNY+d=cTJmI}+qA_{z>G^pG`*MHTxxcUFGX?MK>x)TE{Km1Uny>8g zkf700-#b7yF>&CF6bisBU=eYl`2-Wgha_WRWqezlmsx-K(fjG&oyLcGC@_wjC4fTyr@dw)4D2;$1(kmlJ^9a# zZLs;8beKcQQ~@d$qepMDQ7C{TC_*ttk#x+J{yj7Q@$E&TkW_IG`NENFQ>}vEhDJxD z0|I^&1IMGo!AzeANI*n#l@4dF9K}P;(fMqF{F^eZa|L?bu8u*X(N`7=^H3TC<0)Lw0DBx5XgmlRp-U#r>mu_-1wdUM{CY@T-6`ei99 zUW70J26D;T=IDfz$N}O)VOWxIqP@pU-fCurJ^<$TdcZ{APO$=(FW)l)Vi>4!m=?)d zAsqH$+1XFepsXJkoQL_v=ZA2gh?7+P2jcKhFp?c8qVFH>y)-P+WJ}uN!z*6Ne;{8l zixBF7``+L%kF}%G>scY^K!P7~4uLRFUdqsOL|oKJH)20LhfDt`;{!K@ft<4b&EP17 z6+jIm5B_$SK1jd2eObG$w@ubTxDGhTC~bX0g@FL4ug<0GES*oxLVOOV6Vo6-1m4NE z(bbNI==^bfk^pEf{lVo3*E^|N>Htlr1NPPY4--6(FW(cwom4v7i+LxyIXRg3Gh%oc z?L5YuYG*F6e?r#RT2I(o)kU%bJ~+TU1@LyaZzGY-!D0a4fp?c`(?sHu@rJC^aT$yX z)KfME?&4Sorpu?`bp*13c|QT~+VqUPIQjQJ`w#Lus~eEzW%S=!|7l(Dfp1C@eiiC} zy2W{rWQc0^VjKQ%rN)E9`2xejaONsmpx3hHF*>9>OUx~g?}N$!SD=4tLWTwwSb9k* z&Fg6jq3Go=JWUaJmQbSR>K$wbg8yZ$nTck77wYeW+fR-?;?;?I&^P&!e#Y&VY*}Vm zO7;a`p^lV(Cn?)*@r$x~Q01r9`q`@$7n#2fNhu8`rcV;jcX(8}uJxkeM3O#$`c6kD zU4aVdy9(e6tXSxPy3xJGcundr0X!Sz^Iy<#5L{C0@Cw&ivJZ|(-v#)V_<1caAv=5f z71rdaD3hZNv}GN2u~D*#GFN*n&NI))%V0{zxAb=oshu09@q}ZmM!^hsw>WCe>IGT+ zut0u+h-oVIr8ZK}3*1-sWBTBBAB{6^8hLnlwA5-X$e!=c z;%{!4BX7&T(3}YMueLZ3^@rn>>3PNQg_H25%Wuchya&m@WW zL6iqU7TK3<3Ua^)D-e;8L^y915)8f~@eqj|*d62D52;(XD*=@{dx+<F#aOZo3;l&UWS?T;lIr5RyKh_4T^<0Jc-US9zz$X2+ND{S5LP+j^l zs2@TN14>AGEn+qd0f|Bc5}VoLt1uEaF%}k9wZkRx(9n=mEiM`w3Afu_f>e6T;GLzq z;TnPc?nE{!ouI{hy{5bB^|{#qs|KNOiiFM;n|5lC^-NI}1EbYit85u#Sx87o)L43C z)ET$CsFPCyb<%xsUOpcE>&5}U|7g8ti&Ly7r}N;JAl#pOR?8)^@iou9-@j$h|I9x@ zBPIdaIDBnL`O?uMl+*W5e){BV7uj>6=yAZtWq!Dod|b30nfUuOWu9fCrUd9P=Sr1+ zYHNvnzOG4afz)_1cMtB!gf2z0v_y1)?_?HCDeuM1cicXjR5sC7w_8$5N>MGBJIZ8U z>k2pi{y}@X_5xdwdkGjw@o2V^E)<V+P|3bJO>-4wnX=bq-GMrD+>$M0dBq8I1EmN&gd%EEk)3;lrvETob&~o0`$AH&d=%#OI zY?!Q)-UHNvulW(KbHv)0+CAPKbWRw5vO6j{4qMDghWQv|-P7;6r_ItYVVe>g2YZ$QiCL;zXV`169@A>qJe zna1%Vi>6}hdOR#4l(tDC0uLlH#(s^v*x{XNG>%uk7G4UuxJ+;Oly*&P!(3%JV#Gw# zT)vvrXuj_>0HTfJD?&3_$t%X4YOj&srcsNDsUD#2J~)%IYQ9C}kS|p3!EBO6xCA~@ z5ctS!7e!a8;M5O}WB>BlawO&Rl*g<56iNB{uY~AUygA3E>Ki;*uTU)|M_Wj(p2vi6 zzd6!8V%|uH;ZM-O6nwflrRW%YP~~~M;0~W(6xH%D4Ab!59<^HstPN+HEwyF2TsGr) zG4b)H^`T*5pE19dQ_iNh;8KpfYZ$2;H-S>DUj)Fjg?08L@KCcoH$q5ShKIj+C!?J# z)wNviNiNn1V>6p59OXsJ98` z%&YR5Qe|zXXl){C-p3^Bd6lriDEG0!YssKhfnda;4gDZDc5L)mJ`>~z*Cz#z`xm&K zJ@xZAI&!I~idDCRnSCiBV=Jk>UyIY}gbhS+UM2SVyXI>{nRbKHT~Q%PHw{k|EI%S<9#?9B03~LlbBzBsHa{7IMvH%^b)y3px{qB4!xs{|DaHfqz zez0GZ6Rk+628yUw!*jmAyD@fp1=r88Ep$_t~726cq2FKL;YNd__ zlSw&pucs=8oH$(AM5Wx3M$^DcB-;-&9!+KV2)>jEg<8t$;F zgupS;>IyfV7?qCw3b(kzX1T(5qbSmu>E+*}yMFneBeVZ7UP3;9Q+WP+9nvchFeMr* z#nuC=;Mr_WJ1p(^(NYTUE7Sm>4L*Fy8-q<#m0appUjGZe7PC_vzPCrPkkHftI*(9z ziina^f<92{2qfd8;WMDn2AmGu+@liNPRb~}%p!Yo8X6~7bu;DW%lKMq6>^1An$z{> z939FCzB_paqN0nZj>h3QZ1ED$an6-rnx?G5>5+|$j5tuqIIKh76taX?ySu*&+uAW6 z8MC+BZ(g8Y6s~W;EINaCNX>BgGL?#|KTJC>So?Vk7Tf!c*HWn)bQI$*&9KGy)HT;0 zNq2Nr$?ZeF{{k%GnWl>M2c_pW%?^rM;mE5P;G~5GXZLPSi;Ig|^M(0%7mfJ+;-6px zaD2ny$DstAUw=aN+q4LD-+L6>ci%5v|M?aP?6X}!@~|WVN9bsq6W7%dps*FXX=nbz z$Mbhmj3aFLM+(N5o&s={Pg?)L<@t|_WYJfEhxjHIwfuh&>%Vd9|NhCB1n?#df2==b z@cawY{_ki1^SeSEz?*y_8$A6-Rh#e+fITty*gi-D+2j8sg#*|e#egv1U#L5G|EMe@ z?*R%s{56hGq4Ym$)L+PeP7A`?0d*4o0jR;)17uOqBSPo&KM&n6R3PLd2eOI#ANw4@ z0gPPF3)IHpKM$QC&}kJ}zm<%C>~nV-Fmk$H5EnQ9ICNP#e^JU;eye}(v#t~{a`YWw zE`Lq)|M`-U1v;(tf0xVudwBlua`}%d=KpicSqG# zgwa&iVLD#P*w$7qI`t;)*%C){%hJl1i&caBFDLl`V47+d5H_8zZ#!9P5&-I$Z`AQ9 z$M884$^fSZmfH&~qj~>0pi(LBMd{__<_F*9S7^3~U!&8I8II$t(tB6Dv^-@pI&y!( zo%Qx{IA1%&x9%^eb&=utqc$OHt|4wC0Ad`-yzXxB#YWw>7cS3~&!2am>naBaMX=~EOb)YNO9e-iViKJA zSgltGYi?ZN;NZmTY+LVorlokrc~UQ;Umo}6YOF4z^c|O_@{bISjYrnvxU2R0v|}nx zWkotMd~3!yq>pBbNpNo7(%GCNmXF?Upq+8F0K|fdfw6BD|H5Nj?}}clG*_%H9aMZ~ zKHu)Yv%im%4#};eqF|tS`RLk(Jk)eL{?* zJf1IS8MhJiI`ZYa5mDsn(RA;TELjE(r&e}QQM%tJUE>4bF(xi=GueBY2 zk)9v#UIGJSe}Df_(d78B?CVn^$RCcbU7`I+F9!gH%lX5ro=v-VEjxc|gc8&ohYXd6 z)vY6<0bR@{j)IJ0C^k299-}@Zf{|LoWs>abCN^@UpZPEnfsR08X@Ho@AZkjBLR&D8{I9Qzv5b0*o;8F&80XQvQO+J99>6+6oRC9o!2E<;)pmM7s>Vh zsAC-9EaTAhI_5sg8I>!8F*d(n0)5sdz{tdu7CJ%=og-Xwg@xFB@uy~th4p8}s=LTA zb!s#Ugon+Y4F&W}vi_gr$_XdkV6=FZZ?3hRGAwn}0B9g3{!VNI{$%?6+tbXqZBXk> zVL)Mqx6X`A)Ypwo1y$F&=LsJ%6EoW7GX5P#sLL2o`PcBD3tq18sXSp%ND;7E8S#PL z-8Gl0;d)!w|C>=JoF2HztjN%Oxw<22#ny7(CH#?BD|*;{?++HE<&ks$^fwajRZCBF zB|KktmKa0h#M?1@9`I@FZj+lmfbZFzonL2$x=AQkzh(xo7}(ixppnj*C;xEA_E-!xvFV_#i7^9KFd(Ztponew^N4 zPZV^8NQVp$AfsK3zZ!oLoaWn9skI0oF~h)6k^DwxTYkshAz+f@uvih>&x()4>O5m; zyY}2HhTXuszPH&j9*&F~4&0qi$=vGI?2YDYzxy(7W4H(|Wf09(yv~PN_2e>APz*40 zn_MvTt9xJXNdjFwFUoipU_GSvRpFi|mrN}ItEmLYktG*;1cL*K?cmK=NBKkIAcc-4Wf;;O{nO zo)XUn%Vno(gURo%hmXbvW7bUJ^KcG0P^$?vmsUwlQV3xr<86G1B?DK=ONl(sI|A2b zSbzr{&8#@4zq2>3I`Q+};tk1j>~x@A&7hY&wiw~KX~Vi}WU^(Q_IcfV_$%+@i!eKi z8G*ARg|a^Y*5eKc9qY2bUw98s?0=HDiA0=hf4)=i_pdUoF?tG{l86A6WO}ges;8UE z8MJz3%6SIx7oU@RlUR4$7T6jcOk~H7EtwJB-nfn|5+0t3J(dcWJYk(}boo~+8P6sq zvn*+sC$sDqjrmb*Yn%?Od%Olx&!`$Er7IO$X`1FiSV2G|#$scd~nGj;9zwOb&sS&9_6dixQX_v?XAMxNv{V*j@tXU~Ix zJ`57<3`qHEX@wpUz#hbP)2UhQb*d(&G`;FiQ6Q`9r}}=Lhe3Zlp$T+OOs= zoZoeHUTzZ)ja*k#yz@J-Nn>V~8(Q2z{5@Y5>etJH`guH` zMH5LPnB{pp9z6UGV++&0>P@#+ZT0aoeS>)iaNW}!j#d^if8e*COD#4#))d38vOAwyxVpa# zm=#%23q){8d8M$iX?3N|?0O?5AHyL&}r0COhptg{cpN~2ZJIjPO- zZ9_?RYdh9Mk9cM2!!m(JLrpuIi2=^%wNeP}*pAmFD%$JCiZ;ZULuOE`3;%$MP_*q+ z%;QZB9V~o0L4^16cI{z*c*@}6Q58H^DgI-GS833DruUOR&yG?y0fhJX=sfG8=Dw3bx*=~TtiRn_;I<4)ssmhYI2xUHvh#ST5j%U24zEsSFY9xdpE-08Uu({ztZ{GKah1h{(9p5otcd;UpF3SEX6Q` z7ZU%ydUv|K0~79S=E|*lticNu(J=p|@w{CU?~O&Ge_U_*=cySRr_?EZ$q0xl;SU=e z#ZIh}Po$k{mQ=^aqM?7`I)RLkA>jz~Zz{0|e7ucxdil#=%$qK;`8C*A-syMTQ6-GU zr(F0i;B7IfRupLMQnEL2?~$j~2?Kfb7&9EMY~-!m-S7d1TRzKsWAtGX`aDIyZusIc z30sU|@ZvO&E*xdnHT{^eVDNMyy92haMf67;%X4=fdPgvmZ-yBR$L`FuK{=wFdQaSjdc_i;{F}?$=!SNgoA_Pf$qxP1Sd^FMB8J2GGeG1Xclz`av> z2_QVAl$Xct(@UlySB7L?p^~2{QD%Rk;)v^7gB_vw-Jz)NVp)vPsTWv|xsF4Ftm zChWs-eJ4z+hV6pGE|BL8&8=v^krl~mM*dykvE>V&(Um|LG+vRu?AR>%&9p#%t`!UG zdFd8aXq>>qAP)PiC1uAT$>?$Nc^eN_a{>b;40rnXIQKiTZv)*OlC@|^CG=pysD*9q zT)Cz`o>8%MuQE+#=eBEBzgceq1=$#WCEGkiK*8oKo3n(!&tq7quj1c|P5-KncC< zk)TjR5UzD(wQy z(d;hm`w;Onf!`&G)0ne-JEgY(tvYK>N8@2-99PLtqYKqCDB-XIg2lR)em0XWWj**r zqsMs25*FW`clEom0JVBj^tu_H^9uaoGKtKe zuyqo6fJN$_Bz;!K%6*>KmW-1$OS&fY1u&l_bM3%HP#4ZS z&3Jq}aC&8Wz3yBF6VTJe*Uh+N0<`O#{73nbi9!^_u2|;DD3YjGtt}Myr8!NG=U7fE z>g&YLV1h8VjE1C$m(799)O9^f#H?JQQjA!-;=#LpZJR1nuU|nFHY^M5=ZS8EKqNwG z%m+QNb%*10qr}(_TY^l7nS*@^3o|Zv{-`*+ZsGG}LuqgDS(4d9tTSA^gC2WQJJH$+ z%x)N_2I0a4-qN2r8v57npm!O%!f1w>N*m-cq)TsnuM^Sh?{`DO=bU<~AG1xb{R5mf zhOVX~D_+?AA%In;dclVW$1qVk0+=LF!04-JLs1Dm`D#V!>M1@ZhN#L*|$VLl5wDbSjUAP8pZQ8U?6qr_Pv94Mj#U5J#!>oO})9rc)|f9`i}3n#OV@w zJfC30=sU)fPpzhXhPO^$>qTOrRs6yV-U}Hz(muYPPKAy+(%QBBdD}sUgL@^*I)`?> zbB1b-+*tkK$6u<~2JI=v(IBkXfr!Ux>OB&rZTxcL$TlOOb!lTrhSKTq2B6Com*uy| zeN@S*+vH_#$AgJU(#ak%u4#Zgh!wChPw4m!;_m6AAQjVmE+&LUbddS(kpq|+`$-w8 z-&KRg5`YamR#z6sz$}fr)uH`zy}|KG zAPAd9eGvM*L!Zk?i2F9pVYb*2ht+~!lmq?v^G~akfb9s*bEatzCsXQdHZAWyNN0pS zj+*idGMlX-lAR-SEBbp5aHHB|7uAm60D^@Vw#{gTncd-aed z%=LhwEylG= z`D-%z8QPAPj&~o>q*!h7GCf{&8=n25aThm%N`fad2|MQKhYp?`0feE%;9lzTo#mhm z9_1niyO~_1q}hX-3GRFDi=rW9f-herk-Vfgy326=3!K-lv#=H(&)?gu!tgVYA*Tqq z>U?*^mB7hox(H7O2qF@@1R@wNYa)(#J2A2F{6#Yqq`sW`eOt@ z^8H8BKYzlKZw9dtTFhSF4886Agdce&`XKy^-#-$C)adcx)%jzUo3NHmbeiK`QwdxD zkmJ0@*&I=qSxf73rgOBV80!{nPu8JiQE=l9-ks_KNS2vmgR!YBeuyR!eFCogo3Bl0B_m-C!+>Q(<{HQwMekZQ4qtR@Ty^_tFg3>Gy7BvnydN*wrs7uy;t7sKcGOM4s9_Nrm zo;JT=5GWsg6b1i6>_ctgyl$RqcDFP_*BI`))eP}f=UYXTVN}D>jF=c>Xox&`7sLlh z{B{|av6wi6)cSLV%;j>equ@Znv9+SZNMLtM*H?ruVgF z$rx;FQM^WAgq+3)XLw_d7?Dta}&X3sU}qhpLo+X0K$O#56Ipd)_u zO7Q1)%Q>oNO z|HG?%syGgVss)R~%`Ki+m3@>uqF-a__oq|DkcEt$1>eBBxAeA4PPQfz4zx^EPA?NZ z;jk>-`|v?CXtnU3H7bI+yEv9m_V6?xTJyKT&tN9;$?VH72Ivi5M3d#a1ZM(IE&IfL zT%7pP5)7JZkNDmc9ko2#UH+3Pq1sIiZI5yqR;#r*`npQWR$(o0S0qQBS8|dq?FdlC zE}zugNy)*N$68;|A?^1cj~}X&<7wq3xa8ivZkA*4FfOj|?I8Dxc>h^X2~3!58_>Gy zV7=YbA<088AFROTWrrk*YlAb_EA+$EnLL058lRX^hwN3^d08h-+egrVFpK>D8%l-kK#GBz@HS z*_5X5)b81KswaxGsl;ltlX`+$af>WCfk=|7bSI5^8*#}4GbJP-kbhFPp*L1I!n4DI z-uOkc%`K6zA@t;j!`VB<{)s%<0l9$c<%b^h)1t#`VaQ@=1hxCVf)bXK?KkHvx8tyQ z(fL3?rn+8sq{ix$J*ee&FoKMY+i-a9RVoyskv*5+tQb37g!zQ{1Fh{SUbibeLV|lz z8)Y_M8-lZUVcCt*Qv0GaO666f1bf=uM*!CRmJTCc?yF$>Q zlJ`-gw(VzXo@`DqHp_v%tT#`NF{d2Nl)<;_x02<0XCycK!+QD`jaNMBchnf@{BAol zwE;QeF3}Y{HvpVn0{VDCr;#*}b@CD`aPs(5hZqgak)o*Dop|be22KOxI~?|bPizij z(_7;yJQMtYKxC3X67RR1{ZG#ClG~FV*Q6Qu+tm~7(b)8^4Xq9@s=xJMBq(w$p?Qat zUSt#&ip?4i=eb)cI`QES%tw?D|7lI$NHX)7xsxrcMVaZ}7;;kgwB#`L&o%31n2IeHwU>BjFm_WEd7wmD}0s7A=`SVEq* zgXg043OXsgZsFuutJ1?oN9EhH>%%5M<->w{+fc?ZHm18!kJopO=SCMNNWb|DDDF<_ z-xGOQA=+=%#)vntpbz+9TPNOt=SJ3T`5*gBnzVHYUC$rwZ`RIWv*$vV-Ev?xsh&=ykyCX5gytw42UXvC!ic8FKSDv&@ENcFytKw&59N zVly9nQT}Do)Ej9Fw2*rAFa@=az!jT6ktL&v;n2QmVrX&dA&8`wVNxaOZI$r!gEEq% z#S>WKSp{=a9D)ZXnSD|m>k_$6ogI#wICOi{y-rUIG!3h+yUNFp8V?p;#k421Sazq7 zO)uLANK}}Ah}<1AP$8e&7cuJop7niy+iC9mR??INqp!sf=B{5oFc0aI5XNNb*y)OVrsxYTBu#@VC=Ni)`IoZ4$TB7-{CP^il3x=#Zdj6 zyg7waEu@g#c4wF5xu|KlK1Ekup5)5~`phB<3egxaya#eH43W2l2a?Z1r*_a5!!8+D z44iN!HG3*dsELKRfp?kpE~#&V5#Y9-w3)w8n?uen%{|rLiuph@7JPcO2ei)$by89$ z__-0wKEH&;w}k!7vC7iSn_^g8zZ%UzeKcDk+D^ztF58rp`Tlc`5mJ2}!|Iv2u2+*& zwb}So*o!UC6EN#i>*6dN-n{nc(LxHvYQ^5Z9D^u&=olyM(OJn6 znz@K)^TL`@hDgZ)DXyn!abuoT)d3SQkWgo30>9;0j2DRl7lDmD` z9DkB9{lJfYb33-3GOLprImg>9cC%&daPF70DeJ=PZn@24w7^&TK)x&%UJM*>aAyS5 zD^;Rte`h9@;a?DDIU7!lIc<~OMD^IsDRy6LQ-<;ZwFlfhs6gA-dfICcLBvC==^Dpf z6v;Pn!FtW*3_GDyVL-y4M#}k(ETijeY!Y815NTR4=os^iFao+Rookwxp`Gw-?pd#|1ow?fx51z}l zE8BXYb*2z_i9{K0kI=arDDCz-t#`+52rtc*P65z>IFq33;Pu5O(*%r9ExZu#PEd(m zUx~CVKd$8Q5bXAY976~>I2vj&b64?jkLbz+$F~W#rJ&Hibu~JTW+{H<33><1XCLzP zU>69S+1Ik2wjOur*Nyurxt~r~$1T<a>D&$>+W~@>#6vRNw z*YWL?Guj3@12ueS8Ok&4PwO$er=zde2N{?zCd}^_aZT~7E{7M3>b!avGb&etgjz_xy*1^ zwrJ?m+U0{N_EMhlg3(PAs*s*&og5zMOriL;!gSC_Q!toKiWTB_Na&^r^@xN7LqB{b zlrFq&sO^eD)F2UCS67cF-??lr_C91}O5#^pldj^oVhZpHC{FjplHH3nma>D{QM-mr z{ZRPsPIIz?;(%Gsq7~5GPy;JZt3!{)lv3+BZf@w-GlR0dJ_3Ia}6IcMx_M7)+b=yb1Uk_qgcKB$vA&^X#Tu&yq*zB&ljMb!6u5X)w#}XAf>shc`v* zci))&0=-3jgZv7lQqB!{(o}pNNLUq7wT-oYEhU7nU9$BnHlI|wSOk}6e%MPxLfupb zPHjw8-@^vmoV*|Tnnc7fHXbBYS3lQu@bYmFk-NP%L-j(h>6u(ZBlraqqu`Nb6Ssf` zLX+nst0Tqop36H28+plR)Mtjya^9_RJC}kv(7pxeI)7bqf5_g8vkqZOaR+|4fpC)S zSqalHehswq1rCWTERA{9KU2@N0diVbY5fML_CI6$XaH26XMaS|AO7Am3GY8%yfcUZ zhU0*SO)~Z$QF%X}kEUBW)iwU_SULbPg<$)PM64GbLIzHC`|m(Qj}-tzNMFM_i~0W= z!{0;tiSvvhJPJSi`H$#7U}k_D(MbO9wEP=v^na)2zk+E0zcwv`XvseBal(ClVPa%l zi9L>q+?(9FS4C&coe|e=Ek3T8H$xy_CRx-m+7~y$05nG6Lf8gyp~V$hLNQ?*lj@n% zcM!r(sx&bxL56Ug0|pqZR#|6or$jW&!QO&sH20XU(8o|ennGhz_Rlt?eIB|*ubG{EXw*OxkBn(Xl$5L&A%Z>KjoS^R^bJiQwHq zYRScUiw_WZU6V5FUDv0*3%@`Te8C@a^^`SOhD`&|$}(n<9?y(LtBfsgf-mk5BtL0L zB(wT{Q$4jN*yL>;YBG$(T9%vm2{YPXC|fZly$d7GQv3K%rUe2C;OUNMElO)+{G)9N zbzcT7$2ryqO5hB^|1^Sszf(g9Fx7$1%pdaff3;)B3D2DP44wahj0lJW0yJeIFTH;> zm%Na!&+L11x&Mg@2~e1W0*`V_1OL%3e{C^`9Ce+3o8d1kTuBTBSU`UR+u*R_fNTTu zuisdM0OaVQ8=KoA`hwp5m{*z+#sx!ulttDH)4Jq;eI}9w!FMRFiF`14`HxY#Ck1HU zXEkN`;=KhB>NXtgK^IshFh!?MNQ-xNNc0{Fo*t^k)i~m5- z0kJ&IBz~85Km7hbcf2R~YeXc474AZRNfvmVBDv#waGwxQurJTaS?d)X{;9=U>zKZ$9)`JatRum2(P~aVYNy zOh;$u>!KnlBQkb&L0ngxNbK24;~>r=$BVswINB$n@bGZsjgzy~fAgTJ`LGj3ijv2; zFLuYPQ`BrbCuIs0it@SN9)$pkcbG`N#opZ={2x7x_?`hZ0E>!x>?-$htVS65nfv8@ zHi^b?GhgyDZ$9K;PCeP_M83NW6;RRZOI~ESx?0v9Q%n)%4T}gxUApYL`w;K zdG=^A;c^@%ZFQbXVAcC_`>U&Kaz;ZoH7C2#uV3G0MW#wL4cQ&c)hpbwk|*BUt76qGe4gdR&*S=o zM6|SuO$qlw>ycw)?^&Y@*4yUSmm)2}uDWmAc*GM_aNxtbf2$w3BKn3%N-d(0=LE7g z0;h?2YK$m{_K->Fp1_e&J_migu}Ho_L18sDtPWSE^DB{F+T&e8;Ry+Z>&p(JQ-#Ic zp7Nk2Y|;SKp%{Y{Og$V59$@9XM+O2hcx3ydDo14W%cp~+*UnL$V_hjWW4mc~p&#GK zWO}0TNkJg;p_Ha7)qX^EME=nKQabZ1;tiGB2kA2Rp!6S~cBxSa@VR~>eRgb$<7)7U z5TWSpb%@qHty*-kdvaopNJ@$`T^@~nbYlfWW#~>!JpwJ~>*it9jP1rNzNkP2fRy^W z>2XigI`2*IZpGGW)nyW$^=-XEG!>w1w+AUdV7gE`6j?wrMOtYz-5SrMu-@hcx0S4t znQPqE3UyZsx?}F>?w((kuC@BGFp)~IwzhUWJqO@y*Yd-M`}^Tc=PHH#kci7}z(HN& zO6ph>w=xk430OuGg~XIG?<}R4F1GOs#?-?Ou2y(uyB}TBF70Bdl##T3;I&6{o(!4| zk`@+LP$NUPRUemrq882hLQX*$Kixwa3?&K%L>Eby%NdS$N9eqZ*AOW%XHPqtxOrdp zk;`x{Lr*lC%BxG zG?D}L91mB1bC$?*q2(kdBEcsV@&&6SJg>zWFY3X}VaB&qWMpK@<4{nZ9XicrN(V9Y zr@GZWpTs{}TD_kr9Tejf2-`(4xrq$~K9Ymv^%m z^!nn#^6C?FrH`~X^>?vc1tleT@jc7C9v?%VK{Z>DOX(vf%W23G$*kH>PEBezZ-Bkh zT~);Dcn&j0k;5Rq{ec}129a&*CfKYr@RiMy>{IruT;=^&*jz~7ObpiBPoUiup^#)U#Gk(~AV=|l@=z&NIU>hncd@qNJkDvbgK0yd0Y0zkT$Vp8W!{)s+e}z`3xy#SO3@v8$df;U>?#6!WFxDaXNq%IO_{QY zpnNpfdCxk`V*P70T0xz$eRE6?hvOF4w+IEjxw&K@@!TImFBd9?-|=6^G3qGqdKvg| zhQO{1_Vq1k3br!e6xjtzHQ1m0kj~F5u>GlIs3Owk^ZFh0(fj<^w=^m!S3ImOHSDU8 z6MF>`Z?Ha@{2WGe(OG2Z4ks2}Uuk{V8OdYxN2B!s=;Yd(I~r$VUatGhhk-3}c4s=B z0qaY5N8PLZPw1;9sH}U*kA2spf^6}HI<-By=IV7zhA25uw-?Nva=W>xS(5Kuq4oNr z+fghLCuZp9LYl6wgtWBqo1Pw3fqe~mcX`;k$aTb*B@&hO@LCM#Uf|g|4t-q#i(^?7 zC{5ZS^>;q24AboV%=gx7svTX6yu>oEk< z`ywg~+QnUiv=d@ueU}xB=#bf?{6c&OuJ`(%`~>>NB7~xR+ljHi28wZiZ_6S0lr5R? zW3#_02E4L{e!2h$9OZk}TqTR(R+8I76pUAgaGh>Mi86he*7#Av>^@~%UnSu&D3(n31H)$5t4Yd;BBMMl89q4?s*{PaH3h%Q+$jgr;2iU? zn8GnCHMxAbUM0Fc=;K<0losEZlJedTzj(9Tp`R7VRQnytg`e%o?f>HWf}TK ztpwTkwHc+K*3GY9`Rkn1H=G@bWhnjXbF#PBI>?R5dUQJOeWIrG@7dY;hMZv40@Wxk z))8Hf8K=;fYfkBQH>pIcP$E5!GC9eo9wrwMd3Sfg@}{erMDla zmt%)o{w6%~^Mhw)f{2SPLKRps)j>>Ou8p6Nzx_I+eIKENs5c`@xVpRP=kxl!)AO{k z;i!bkzVwN|9Km{WPMXvW-d_y;WK2pn#T9M;;-RrV0amGC>TrPL#}ChwwSK}N0q?$4 zp;rsECyx9l9pl6Cu;IN#%{F1iJ+dL7(*k7Tw``I+-MO7{57%lo7;)k(6y9rwiPHmG4JcDI_* zh1qYP6p-8CTSpY2R8E$)8%znO?umz^73pI{?^J7e~xt z>We~5a%;*YTIaJ1o%Ii?B8`RF=X3ckg&G;rVV>)PAuWuOoc_DuMo%oWTu&_GFEJ$V z2D1WOhq>8$20~nKdi8hBD+w5_=KJ~yVK>kqR2a6<9Ga?mk);%u2C|o2Zu#5_Gml=F zH`0^G&DLK~<#ey>6xpxdJNQ*kPKtFrB6w{B`Vl523ZAt4UrO}$nRUdKp)5}@@-|SCN^$`d&Ag;8K z?#y{3^9p@Z|W zED1@r*+_<4;{CGFnfT~jx{|#9txrHU*V>*zxL8M#t~eQ`KQZB-#l;ALr+lq)dx*5o zkc}FMImW;K((Qaz&96i+pf~qHwjcG*VrMdUK zyzfQ?*eVyK^s=iIxnK%M@UwYITsOZkPa$FCSQ%gBFCVN5d_n>AMp!-yKk5lE>!;@p z{MMb45J*+2+`GJFzuz@!jycVoddGsUY`r%Dz~!b}ITg$)lO$_uYZF2-id3pQMcaiy zUiYTl4~yhT!;4k0*=9r;)}C9`s(u2_fwT5!^;wz;?4RU>95-dE_)5%?SawCj!n#t^ zDmutf=V2m#;b0>1N6<9nsg2i$P%u);7n{ICq!YwUP{?c(M<b*?^XE(tZdB_(&W2Bzdu3EEL3agLgksQL}%P zjKpGG(P1oR=C!*GHizD&m)^*VnqZfX=;AM%Ft1w`SE=t%ekf-~EZwsX9L|MQF4CEZ z7gS`D&HnW$B@K~}8g7^sc$@9AOj6cr(<$4{yRX!E$|4(7NBk|N^2nH2zKP*E;&*36 z9^rkc7eKWCq8p|{XH+QgAOR3DHg~MLlP-%5u_+c43r%KEcL<`L6~;OVX<@HZ;xa{8 z#cwN%z@xg#-utyQ`i5_gB{`gZU1>{HPOv6)n!Lm)CIuWOqrhgebP>%~AF&=DpaxX2 z=MS&vfMBoNit~5gZa^AJ^a`5ahchb6ELUvQW?cN8K-o7qo~-GoM<=;0sHXDNUp-WE zd3^21VW7@qf>&qUu`lIGa3eS|^@Y)rC*mdbe$u=!?8{B;4P8^5wb~5qw-LF~9~_m@ zjp;`@gEn3Yz5GS=-O`5xqq4H0!`a!mufFT_6dZ)LLgTMUsU9UHRHWJ)TuV?LA>RXs z)I$g<$FPN{q_DpLZSzuO{Y#!|ETB3;&#@GWjv0UJr`#A7jLW7IX*gB6KB_`K9wawW z#~)EwGTC?{h`dcfouwc*k%b~sTQDXL3d*IdezShHbW=hGZQgxG`<~@Qgj@5R{0Q~s zx@P*!c#U^_zI@C~s3LSjSJRlEzG<17bUEgTb<+zQu5pL5Wn4D}GO@TS)N+o3NOHOw#c6jxCw1{V z-}~hZ+Wj(viB{-ioF$uLjyDRZd?JZE&JqLs3VHu&{PRuKf?E8LnJHVNC|z5B+*lth zR_lsZpi+xp2Wt;=ftY_{GwFZCMGLsnbk)$O!jvcBeC%M{vE5#rAr!>9wQI;Wj;d(h z>Ff1d?+&V53E)quR9#jzl@icYA?M=viFA<1H9S2#tKhLh2?BODXu>#_`g_zATXtXX zC5}1E#ZFryg#uH9yvnYM6-N<6gAn8mpSwuced>@Msy*bM%6!&*68iB7en#wgQZ!R) zqZuyHt!oggb_F?+)4FyMS-;n2f$as(nF(P-1tH*^{KS!6=zlW zQ5&<>0JL=OgAU}GYV=P`R%K6=6qMCWj^tgMI7}&}s04Pu3E`YKcS|lu-4Vl_J_0FJ zUtUTh>5kN!tY!(r zVxx-XC7!%X6pHHNpmu+ZUg==mtR0WqJ8YmMhiI_S%1V~{tqW!u+h{fJs|dZj$UIBM zy*g*Mruq(60HILoO(+;IO$w^@2E>s0H6d|mL=5dtpnu*>Rk6xXmsc-fs>&phch?X# z+jsW!gMI_)QE*xNGL6Xu3Kj(c@|KuOd*G`{*o@S}Yfhb?kw+5QZ@QjbE`_sI^Jvu8 zyMsSjzHquYqVx#uPUG`b%?u7X+3m*5QXalapO~)&ad^LXniaeM)RY!A(PlLlSv@c` zG;T21?sCPWMfJK_<-S&$WGMLrckK(Wxbww3!Vx3T_%*oBp$$6mz=X)(gKEpF5`|&f-_wg`(kcX({CD^#ZUtB)h5(MpBT>tzW6eQ zko0e=4g*e9XRRpHhJM;W?73FC5(xeAaSFFuQ#Loj_d`lY&6iy$ z$oyAu%DR0+Uw|^RhV3CX!I9aM2zHl2(1)zP63Yyq{wpgTm6Gb^aaOhXLOQg|*Y8Ok zh_SwpUCvPg(m1r0*(Od#(#KMNYXPV_VTa@JGa1%be8j?u@0We9*I5Wdo}5_5(wSxY zUEPhed(!PzRu6m}3omJ+<9wvVqC1+a#mVTB=!i6AL_o#?HF;Jhk|ZUVeAtYCJbb## zkJ?IptW&5pZ+h(O$eLyg?V3`oO=pk*!H2kQet+wDFFY$}5;fpsvJAfTudqaN-FiEr zl&L?6MW;Qci-O$$MP02zM$lCKWS_Q6Y2yg@N^7BGI`FeXzj9fqfkcY_XFz~&TZ2%D zI!kx$16zE8)w~gH2vO)f^nyq|xJbgJ!d^UfeGmXkuQKo`Aenl?SBzHJhB36;Mqf zd1l)w(O9OMF(Q`ZjTR2%ZgyjBm?XZ(%*N%iPen{QIJ$^ZmVB4ID=H&KMp_eJ5PWFY zUrLPA&wyCmSOK7}?QJ1j+BYG~ssi>z9@xk*kx%WI*PI!0bv77kC@WYG*bq== zB~Cc_#aKvld8(x?Mj~~1+59eivE+#hLp-FnrxR#V50#BoMoV@ccc`!{d?mvKz~ALswA{Avte(9RqU(l_x&ijj%NpUfN#1zJu{|2 zuXHx+7X%tMKNa<)sT5Ebr!q7eZ*yfTF`JZ6_3~j26*fbr27kMOVi9~o5LD&IX}oTm z^&pm2fM)Tz2+Ig`?u&+lH#hCR0E@^qp=L4p-NodYWIr~V*$7k@^nz40w$kYV{={Lj0#2H6>C|Gvi zeUw!gP_rd{jIRW|W<4J6h|F}L7RGYRU>2-nIh?$u+4W-ryWUB&SS^m;oaf2T7LiEy z8{YTykB*LQ3zC#Rc|hIKZ4OS07m8I{8~~M%GaoSx3c<5qo`nr9NXI9a^iw?;Od~zm zHyN>h&}w1sW>pNlsE$+jCmdU@bnP|Wo3DKi=d02M2jjmv8e4;uE6x*2h%$TIoQ)-2 z=~g(BQd%l?-){z;g;;8XTX7bT7;uF&@4>ROFkMV&Pm>&CEJG$^zv5sm0TeK11II;? zO%XBNoxzU>%Gf{4#HBN94wJi1RFw$W69b5)whWC514RRqwhz{M{a#&2ppPC4Bo@?) zkS=(O(^d)W`@egK(?k~3ar_SJ@hNbZzvCsVgqF&UcZ*rp39P^;&hL zp8ree?+_XW5AJ_xdP(*63P{Qqz=AfhN0JE?;bTE@p2mBoogqQ4|mRi|mU3tHGo;#o)KPgAKmiw!nhjc6N$))>Fd1d|9V9$2h!2n&4Aq8XzcBg~b3^l$YOOX$&!@JIPcJ1d z2I|6=)V_jQ4Cgo}7kVkW34cE=cWdO|#sj>d{&nd#cBemd7H!~szmMo(Pge}^jj^AD z9ST+C($KKbjMcN_duH)^dao5VggjrplWzC|`_^?&x$t2fUd_MmXZ~b9sE>m&EHd)v ze7#MlI15V$xImE|m1!G*%eIQrhVa?gpuFNfjdd{JNnSj@ylnloTOpk$qbFCQ0p)Vb z0s>8 zOt~;W;JaH9{WP-f<9MN-DD=x$>$?Q}WdN=`F~FB@xKML<&`YEz(eS#*lJ)y7k>hy- zn%iR;riTZg6x;X5d$t1BkUziUWh`KH#I4TiAs51aOnpkqb#QV3Z5(T78^Uv)va;JA z1xoU0_yRJ?tMyr;$0u#@o&KXxnp8LMfxb~!7@<$Z_Y44$VsAReYBFDk0RTNoMEa*o z&jGy_fH1Fyz{lZu4M+0SA#9$ie)oRncv_Ry?Fidd2_N8g> z-qy?Ci-C8QU}X1_=K2mCbgi{zGoGioY>x#rz*^&(+6r^d#4I~DB)>oRj0QmPmfX=nG^EO zE9nBGfcWr4t~}i8s=-JZ$bd@u-b)|!2jN1N39WE{$;kbN`!gpQ=v=4791$HI_Voj0%aIYlBp6-Hs1zQ|+wBmY#aaO8_Pzj0q%##x zF(Aw2KW3km9;lL8v)V)9IzoeolS9%w13=4$E=n%0$KL-A+v^hUo%@M{j^J06Sl8*6Dp=Onhlh zU8qr+ZsDPA{s*^WmDDoLkTY6y1{~YQ=ti*QX7`4szfEDI^J`p2A`^Ig#^27D@}e9p zt4ff~g7yZjzuQoDIT}IQGM0H${CuAWfS?ceUR+ju{xha~LSDOF>~hVMd0H3_Y;UK# zbAbre1Pn!{popEL)zs!F-cVRS;ohZ8hvF~6zn1NMIKsbZlZC7RA?@Jepwbs3!4F65 zmcJApot>TO#1>YV&6IrP*QP=h@?H3gewl6WHj3yBVxXc%=YX{~Yen5b(e<1qLZ;Xi ziPB3I)B3{66)MH%hVL3r212*#9XsH39uQLwHYK?jp?%ul69+&vI894L7~FSEm-3=! z-NHLVyShFq-EV$OWOHFxcG&;OqwC$2kYZpAo%qyKX7fltfop+nZHJvCy!FX=No0%A zPl*l;C5L2Qn0$3fe}bHmk?{^?(bsCAMtJQrS9gcMq%cKB?TDoxbqUV{F1A+T{`U;A z#ngk>Wxphc)9HCOka(WRg(e+}*=&ax706Zl%0z{UoThK6&2x1JmTCyd$j}9d1bY#s zGj~H`s&i^+mdzpq5zE_h%pjvvsWj8lp&1_uW)o;c4yfQ~E2%TZltEtUd?B7cJP`=! z(Fi}bNeh#ND^O@^^!2+??wXm`owD3a!lELn?=#;n9{Ucsm}UlmOD)c8fvT@>|RU+s+Q(oXfN2>V4`h+v+ea`>9e z)mn3yMT_@L?9o#l(A_RQ;b%8T%_n2a2w-dEZN&3^Ml855zri3kD_muF}32FJRx8-ll6_N+5w=8bE>wR*$y$kUM}~56Of*YXsQsGzdg8hPU}96men zf(I(KYQjFCQX9X>3j%=v7=-Oao*khLi}WJw5y@<;%KophMi&#y$~8dor~Dur2Lr=T zmQ*rTE)Rhc?k~UL<;&~-b0C(^kYQ^uF37YzbtATJ!IBh{*@OzqPyFi#ZvORq+k=Uh znl3lB(EGIHSfO64JEL@w@5%R-UJm~ivbIQQEiWzRN}s*5E>Z~4>yM5?Ke<~WSyCQ; z=Y-({kJEt`z+JgLjU2S71OP{@X)|g=_3fRH$FH@f?({9i&<1HV8pyiPH1ylWWFg%C z;FnpcfgX^)^-fy{v8h)_UHs(|RW6}TtO@klZZ{lo>?G|CWJY(>j~h51&ytdq!l6Mr zz8g;gdbXzwNlP~{u9TgpGUIZ4>`4R>og1z4hx3*Ky7}|$pndVTk@nJpW=hox z3W(Ej2Dke_i__w~2hkeG_8P%E1e@~nERNGAJS53q21_W_F6FfpU*Q~{%f0Yf1{bIG zEec5>4*AhIf9D%+NJj2hbMW;&TSe*C@N!UL9ED}cCtEOWe++13B?p0)?=r@KO=acPm+sm`i zCAA(3I=dk;kTRa@)~C8fhw8X~KnZyX7q_qP@4)K}(SlOBu5hpCjd-1f#1F)NiiCvA zufbKGhh!|p3w2h@1R=d-%@de(r!tw}4HXU!&QgsGsWuC(U5T>#I*7m zq>9jSB2;p7nRNOxIi%`qYx#??7)6$rxTgmqq;DGRv&&?^?Ioh=o)t?3D=(D|7R0mZ zI|wk_?Y)Z(YLG}`57XAm5{;oxaMgTLcyKNsdscBn{LsMPt-3n6bkA~v&6^&f6WQ}YiU}YpE061>*s(N&H(@K zOhoD$HutTF==%?k$rV1&&OVe8l4Y9K`!$%{=g_HB#e6g^QGSaktAe51LXJjdQPh}5 zm&=+{f0HYC)BextDN@HUbR?iwEaWQRe+Ox%zCherEP87cW!){i=)AhwNiGM0iOKxu z1SH^M>Q5?O&(`e!$X8G}AuD5kRu0<>$tbpZ@F?&$|to#~I4-PZh81P%bwq6lv zLH%)f|N8q41BCf(COtDZENr^&`PCI!kGS6apQ~ztyq%}6*H-#23-h&KnywP*G0t3I zW?uYW#{WXpdi)S;5!DyBgca85-FeRgXv@4gRVp)mo|Y96=sG*fkZwnm?xPIY*!rDs zO?F9049h<5@BRZJOV$J3(71pA?13>qcb=%gmkzlz%+L2BJBKEDUjn*S;v9iu>W9R- z>;@f?3L)S`go0gi!s-9vt2h?}>usFVv7GaCse1T3tA4}T(ugfUjp^6J{2!!>W3l}0 z{l7O-IlI(Syx}R~l-IfyBL;b3ykY+NACChc={T%WLuXz0GpXRm$ELT&nh4##rqAJ) zN1IrxK!uF`=_3Qo@hk5p2Xt2fP6V7JCHz7(oLbr5ov)t1>omYb{Oc9^!#&2QUc8q~ zfv}08?60T|-(z23r78IXeX6na0Z+0o{n`73>8>tcUJ7@=ev6kDQZq#VIpzE2UsWyF8(BOor~Zgc4*|Ook3;W$-)|8STHP;{TCw zZ*V|JUJ-S4koct|!kk~Z=cs;MIBk?S`STH8ZBh%necr-lEFW`M&Lb4{tng8CZ@-{F znB5vwk7#NUP;cSwbYIusKQ&YjGMT~HKPYN3t24apOXzE)FP-QzT`c_3|L^nM`J2k~Pw; zn!?{7Ec*Zupd!(`GLcE6TnZj-ZJ#uU!j1j?fCQ{hKNAuFCidbF(HN6>NkR#x7Xd=gPoakrGGEt*Uq(Y-6MwHrwmP}zB@3WeiYzSLdxwdR4$TvWNGh51 ztGd!LC?3conQsnR9R8fQ6iN)~QXefS4Yn`SjaZ*};~~fe2Rr!l9S7R20Zka% zMK9iP8lxag4n#a!l|WTYmddLJ`2^dV0w>8|MvGI}7r!%Bgl`d~mw~^5B*2t~y2sr2 z7M-AhbdZkw zx-L2A-2^Dxo6%q>bzXgu-enF2x>xsjtrN~(?|$d4F?inmg+{_B391h)>)V_CbdOR0 zH`8Qwd!OOctkox(c>Zdx672rY?cuq$yqcrO1E3Hvw{m2nD998F(QVC^qgU&%L!USQ z8xD`u7w}~uv7gN;uW8i2QpqhI+Bl)zKU@hq(^=Q;P8XOr1Oc#3t;xP+sRCPdD$Pq5 zivF%H@pzq+?WguyYlD+EQNpr=yDaqk2?Vitx@@U3ZG-2vieCbYg6Jtw85x3Tx2x_% zt94cdBZi^zuA1pxSBxfJ@BVa!>z|#DMzWG8(nSUoNN+=0%GQPG^(Xo-T}eo~2r2f$ zYiXp@e@eevvXO<_kyPmwRm)U|tXN_nuDBu@PY$;S--zl=eVU2@dJO~5>g4@N5$2}lPt*zI1pQHSPdwK8? zEG^4yJ2Shi8_*pP9eJeGW`_j6%v7YjgO9mmzN!*NHbo_iAPMYr_Xt_bcxk-}72~X9 zNc*RNWkCSBM_lw-i5de=^$i-E7PT%D5}ZJ#*7C>bAPnM4t9zh-TI#Z|V4~EFI%z!7 zwkJ=?K+$IK$Iz0)ylrTHvxdBQyy-YAsp67dk_jRONmmrMzuSlSDNEH3yD@9*@8<0Z_bcWLJb5Ai$nD-8&7m`On!S0Dv=AkYnc1{`?BkP0aoi< zn|Pcd__(xptJ`dYs}_9;*rGYuRdPXFtaG7}RJ%TB^ky@q;_I~0p)*y)1D?KL;jbNt zeFp%Uh1nr8YZ(_Zd(YqAcBKwUiWrngWy2<$9!~!{W0RckN+>Ydo##o-6va(JevbwR z3(H`QVXtw7tG?q$ralAlI&fguD#0dyUu0)5a(AaA{Z}0};Dk0EfJ*r@BV3HANUq6Q zVBOVJ-MIA0_2IP+fP|wn8h{qV=6S=fiSB`uz945D6G`6unA=-&m3_cd!YB!3(GChP ziAlQ;_P!F4OvFTS_gt+AAIv6HK^_{JZF9&L+*l%$YVWB=oPb9&;*NNIf~!H>Lx(jt zTi$|8KfQ1Sm+$a8&h2utm4*J~fQD@=gC@u;O8Qvp9uz&6&?+niByQ7p>mzCHy`!KYByxAKn4_?cdXfk1msN(p3Hu;LP=CV4^bGKwSSfJ0o79fy9 zVk{LDUrBe+xwito`KX#Funz9SP-X=5{ZPqw#zXwPXb80N+qhlQgfk8p7!H4tG zIZHt!i(kGg?j~S<>KMXNWU;NS4xuhqXizFs3vLPoG|m&*9U!wryoiin{~k$86pX#& zj1I%?htGDqFJR;7foA7G0wb0Yb;@j}r7HlW|54I(uf|MC=|?EkW^w)vUBoAH(B#8_ z&~vy$Bi_QV8{mkMB~~~7>z4TCOJaDxNCv!;zfFBTv{@5#%Kj)Ng2gBd?pAh^hT?e_FQA9_FOQ&=Z)uhSw zeyp(|pus5K5*PJzQvJwmCU&SDNk#bABmatz0|`Y$ViCgZq0~gco`n7Kj5#WB7CS~9 zYbrx^dwz_%$n4vmL{e<5Zb**(qZ+j1cd${&q&Ig%#X?S0z^TYc6$4LGCnKji&p_-4he-5stA{7r;RlC48eMZP z**69>PAd~Go26&GpRxy+4BUqP7=H*PAU^B`?WLOuNIF-ZLMl8uY^lt`O;`i4ISbZ_ zBsRTrW>3q86q(jS?`bXiDa6vMv@|20Sui?pIe;(d|lmRV*7c_kE{W8wVD`9FV$ zNG)D4z7=8gm|qL}%TCM$dv~r2%?`D`1e~6Xp%6(3zwvfJK+J1~FcPGRG$zgP-s#TwC$q?7v=5ky z0yR((?3LszaD$X+rB2+&_}gWA1j6j7kpw+-F;K{)CQGk<$X(R}{U7qavaOD0i8ffU z;O-4e6kWKDtf{chj!x;q<6p@%etb%x8vWhW#0)!BK_5k?jBGl$^!+;= zPOF+CNHJ04G5~xzh}{1nqjI4ga-3sORO!|4yCfG`mi{`)IQwnd56sEAj$k^hI&P)+F4^Ly98JI0HuKe>78h{psVeMAjUJ3_G|rhD$(JHFLLh`*)q5 z5ezXl7Uhn8Kr`v^J9#&b;ZX;bM*7|0uRMkPkZb)Rp>>k#wNuj6))VP}w#d zU)^2RLiH+Na>v+yHW-l76**70~dV%6Sl4B_=SD=IiXJ!}_P2t{&u(Otm1QD4&aA=1G={Ujki7k0jQuM~g#d&x`BBW_=_RW+zqNuw#qEZV9yyfJ?z1(LBV_ygQixnA9 z^}czs|CJBmHq;q!(~_9bQixgf@j$8)Usk6guq^1*7c&>h=ByydC|(|Yn1k0EwJTh6 zCC>x9H`pUTI<|_2`=w8*l8gJ5i)Em?-}Q2`HmZ00p(ZbHm=e3-Ou5jv)Q=v`JZ-~C ztrfZEfo=5g<5>;)rr;NW!Y|nS-RqTCcQ^OdU#;WVZTD9p*#M-y^a`%Bh@(YBJGgfv37pk# zh|O%yC?whRpfBb!LOB=*(1ayzwg&kNxA~*o8skY2>%{m5L;Q(D-htTr_hP2LDrG14 zE7VDRc{eHCLx_YDE4dVqP1o+LEuP+{OO^mdVq4n^((KFz4zLd@^&}bESNcfE#nNh7 zRGC`0Fld$!cL-P8n|-lDm)Mmh{|jkXZd-EBma|Npp4BC9PdgW@Lc*Q~0(Z+%gUhkl zLyzb$9BsKXvPy}dYZD~){fy1>L(DK(%k&Gwv;hxNsVk?00?HMe zwH7AS)!9Bna1ck#-qqDry2?cPV7Zy5{mA&B>nU#H?hr$`AkVT)W8LuVy+5Yb>%Txz9SP}ARmNN`4-g(aA5PzZ^)U{-Fx5= zjdz4AdtATyp1rR}AfQ>X?Di+4Ss&YaYo_eOlq;$XsOLo%dN*9fBx7>^q0(pHr@42L zs=p`ExiX@z$!xkcq62)3Cl-N=-=jpLCvjkNOZ<2?gULyY@9Wj3CWJW7CwTkg$B%K% zCkzc7_h6-RNuID6L-YN^$qXo@lDOSl%`5>yd4a3%yS2}=F5B21sVokHH=v)~@CFJ9 zf+P#Ha=0YTu+Q|E8apInwFa6YY7 zQVS?rSs%;%929B)aJ4`D#3QIibRSI&TC= zlFKR0;9FRD>HwA{H%LhM1C)M58qUYIeuuMC-$9Ag-QEZV)43m(ky$mUSmfyBl_fyE z5b}IxUN}`a2JG-_2t&|y@uwx&Lkx-?N!Qw05tJ>F+Ci}{6wfAXVj`A6^!u`wboPFh zq4|`hWeU?eXfOS_WUi_+aMB}%=qAW%+Uxs4SOmppRQ194C z>Zv?=9O8}+_lpyZ(+6kS)5YrLw8RdY(TPSO8kcGt=&S}VETFk0R4_J+KxaU%x82nt z%d28>Y~S5uiOz4M??;L?++~}9g9vLZ9+D>RL4hi<5O)E@YU5>)Oi`beyISiTK*c?S zfgNB});9A)Rv&1THyyQ3^E4_8dC;$&lI+FQrubM&p&S&c64myt%i5=>QyYo`W0DXcXpt@x_~|DILy!`qFe(l+ zG$%)NO9l+j_o%WHPrCfkTYFJS+U~2hn7X<;6g0W_{cjV`AcP0&S0J7rq29a!l+mBR ze^(DyEpvCzk(SxZ)3z8*H<&NtGMdQqIXPk20giyO)Uqf@d+hN3e|Fxg6l7$H{}=Hv9)Ioo?fO zqyJq^J#1~8jV5PHG8wo3ZZ&1ze3Ny~&&k=*FIzgSqvEocc`YuED2cU{Vt!Nk8OZzG zVhfd1U*V+BX8Z&zyx%52EfoA0tbnAwnnOMAY&ZW92gHx>hEg9}olHV7^n95R$O&Y! z3TD;BA041!;6Huq_!8s?B}D9t8M4_g>R4+|9GpK16yA%u*@6lN$9woA$2so6zAw?4 zN7p&j-YgHfWeOiEzE-*4qT2^&{i>`VvrNqTwF-$$eLzUz&S*tuLht6b<_E2n^nXAK zS?gH6$ou89Kh_Utp4jE4+8^O806sl>{QxP>sYwyKPRBF5xm}Nkb;7v~&Kkp}uY_o1 zv1!@R$fwM?luxvVyk>c2f(nnv9)I}OKg4o0Eo7FY%j-EBsso=`5`!B~Vq%M%XEVk) z%U(3oPQFRq*7!8D>V2aHTe;+p=W zWR8(^J!9)dpzAS8sx%nE@k|q*?cO5PqWHuz&np%t1E|7rk?X6{&dD*nS!y8-!Jh}X zPJ0{BQ4zsf&-oM(&ejB8ruS(FCuS}W`%poA?g@g9B+*$)nw=qm6;bH>9AkhVd_G?) zi{Wy)xlK~h9sXX6)rs*42e-cM_HEsh+k^JIr(o` z%Ok>Lf@beb7RPF!=j?aBt#^n1P=-xRm&$i?oI!MH+<*@J^HpYD0NG2Y|M2NHg9Hg@ zsxaC?W&eQc-t`g&HySUS$p?@78?b|lyrH*0SgfB<@g;qpc@c0q%=`p8>9wzhcLi-R zPS=jF&^q$&N4rxQdFGlKvL&@{0{O%g-_mnaP06I{7M#!`F!rqf?s zWNeqf{3QfJ6$AZhzw0$yAyye6(j}%Pl59Bs{c>mOwrT>QXkpYpwK$bPJ6-4C6m>W? zkhl0qZBymJDBR|M;RD5}NV77Rys6-jUK!fGMn~(ft@HDw^7!3%&sAEUZ4xcupCvvt z)Qh?UQmG5l!l-ac|G+?om?ITx$^*o%P%L-^1cX@!O6tNq2cSO)kio3LfT&fBo$S_` zpb#U(rfBIz#e)*Wg0;*Kpm}l>S#<@*uO$|Ky9KR z_&Lms;Poo_;_o(U^6-f`L(~m?#_%~x!2sQ(cD0R(q!I5K6*W8#|63s&Mgaa!Ct_t= zYo1?pxtMy)>`d}{a!g#aU}HD_%K+EyXWNNfJQJ?1@aHM=03RbtI~wDDr+?Rg+!=A2 z*C5QmVE(7a5id2;NbNv$qnCAV*S@Ow+3fVCE6eg<9pz@}CfBzx+^pl4^Cnx73BBEv>eEN{N zC3FlneX(lKua|5yDVo=de^JqJb)fY+Iht$!rM5_{rM-7C6Dx8wny2vvRR9EOqP;f@ zkxYX{V|6RpbQPchHE%~K@TEubk%v3rxYhA*b_&^{F2X6Q!BI5&{p$y_UKZIGNKkBF zX)3JbS-nGc%{7WA;|6xxcn@iM61HM#@aUl0J5NpEF!CqEag=Ohuu0}MyC@zqhDt+Vf8z*7r`?LV1L5Gb;rjdL_47=DY?FkM(P5d!1PyVF zS|1^4?mxo-Owcv`FtH3Y7Ncr&Ogz;GOizXgRFq3vdMZ!|m`f8T7^cP1B{z{rE- z4s-Iy=Liv)+hAQ?gGi$DOtppa>CngKb2**iV8 zmjMuk(ShiwrNi(OAl#Zpwh3!D#*s}0?JZ^5PxMK%cmu65Gq$D)#MP0vzddI}z*Nw` z3qvfHln-G&6{E?3KYQt?#p_9=sXfS1dhmlw$n#FARQl!Xv5=&U`J)@T)sIdPMNt@# zqL$0BasXBwVREwNYwwO$0Zt`%H1;cNGo z#~Q|q4L+eZr$!tkJ{>0r|7R;9^jsj-9MrOE-rARa&*Ih#F|#S?+;Z+mEk`5sG4 zRpOcpMF!YhoJr1IN{xbpx@Vud8>}|-fHIB`cE?LTfC6iV=XJvL{5%fO8@*zA{ly2h zR6@@z01W);oO1jN$pRQ_u*VVg;ef&g;A6IgK9c6E9o3+ii@PFNZ@CAp5sS3AfUttz;$wH?c~#t?Hm$D61xz1p%1kie{jG}@_ zNHUU~ce`k;DvmfZ>TP&6Umdw?zS^R`>2P`EfIs5`)P>jBOJkVh`a^W|0;$zNC8E9U zvA;s$d_u-jzD(wa3hFJUv$3aRnRr9G^$$&Iav)EAQtmb>B&A~E8 zLf&^|?a7?JmP9inO*a|6FdX$Y5j

F7=0h=;R!!Quu>&kx)RZ z7}NPmp0O!?ht!4oRmPH}Q7*sv_)a_1B`tpqkdL$MEBZ%dB4XeeqXs#dpD*K#=19w)JDg_) z*Qio%IA84rQ>ij%*e|=?oc=aHTxBU>cX&Y-KZ_GeZ}>~o%k;-#!yiB4k^pjn1!BKW zeb}&?oMe#~t*;Yrj0WjvY`r^{Ia+JX!g)4>5_j9`E10`;1NxGwy?f%;3nM!M!!dqb zgLOt9e&PSdRo~@&flyLgEuLUd&Ku9DMfv)T3n~FsTp)O|Jj0U%^?*f^5=b|@Q?AlQ zvaTRUw6!-x>(SmcKn-=06BSHEmZ8F8QWp6YTWjrgwPibdfy!xqZ{(TcA&yaIL-h7E zP=wHTZhr#tkJPw`^DB1QJ80+~mp}{&L8rGlpVMo^!H5H55s9^vI4!+n{Z$h^&Ne@7 z%ri}G2~vTr@9w_7S6?V+sU-e&iCMki;@kH<{#deoqdF@9;!YivT!w!kfs`Q01sSo)e^-+gqK}*uXTHz6u$)o;Rkx6z(bG*pT{7-K92LqxExkiUi&7nyMf^ zNcu;sXNqj*YnEA}qeOl~A+^)XAPRgjgc@uR+gQ7;ODceQT0zM_8Y?ZeB%#hwAgI%i zRSKIB%hGLdSZz>Bb$ACTiPyK#$%@84wtn6(HO1KP@PtnDFTi! zjl0_e55i^uLFo={8^I9N^d)0y@7$x)>nrxRacgAJdvr{81jQ{MDE~mlre-@3fxMrH z#;xXd>wHXHQFsid7RctfSFiw$94J`IBP>Fz5Q4PbCeVvXXe3nnIa~l&d59bpMsT0u zreCtZWGi%8TCUA-VXlGL%y6N@NjC(KeJLcFqk4TS5eM551>FwQ_1GP8oVZCxg`9^+ z_V)IuLg_^P3fh9Qe7J}(+Gf-8;(XFjMx0-$dkx^7*|1}FFcV98Lq2F}y+jz z((X&^vY}K{U$1k#w0On&(paZWjCaZ+2*)$FgVH}JsJix3Kfi_0j=;iv**C|mfX~4y ztLp$e98~wdatIApR!k62$KD>nrRIbIm&XnFxcM4h?z@ukbFPSey{i#J(+vQpZ`DyF zM4Oeh^;TbEdqOx+W}w>Oa6dss@G{BBLR1Hr!wwYyvyDi93Zh=>S@#3=HU6y~66JK6 z_dnYGyC91ci@B-QYdi|y#TL-YI5n$OCX`9fz77{Ug(r4+>ByM|F1J_ksM=Vb!~n3G zuaqYi<4-?zxy*rXpmm9CMe#IhM#&KM%47RuQGznlCE&&J z+0cCu2>S=c3l5N z2NyteP^!!LyZL8op%gbXIUZ;*d9(T(ya|y9zn)P0>?YG+>^3v~IcnMXc87Bz*{QDZ zIzn*W_|R~had{%~0IL0AbNUI?PE)ujZls6DmN5cYJEhV!jMHD(p1?_D0?Z9>K3V!_ zyWE`cgvg&HJ*RIm9@w%S-T8T=Y$!mQ%W7s=IHa8K5K=6jt67nvXNMdo18o?+{rtdy zNCB;>ZU7^7gW3|K6I!K69#u%dUp^yA`8%l-WqM4Im0V^<-+tTI-neKw1+1tT+&&S! zf#;VYaMS7m4z2!`g+>ojRcBd*oBU!sC?1wDYKpbj|}n zuBGm7`-%S3VyEc-pX#mP%6kmaCO!dw7L9y6(}FLz6mB<1s?eLGvr&#VBPdE$2lcv} zjvt>=n<6pZ_3my`*5VT_F+s(Li?ZXV)wS{yTrPKq99b;d7y8||&9N-qAaqedw(_U| zr;Do?ytx9mzDjQW7o3LB(-=u=SDQ*jjlx{ZsR&2uH3l5B+S%o~cWgC__PVxokv1_d zw@nWj=H;rV>u;$aGMjR0#Q+ER>H3K7npgqX^{-w4lXDL%tzbDywe(dcOW&pdjNjE) z;%j-|uS*;OR{eQa%ossrCIqW_eVwvK7oB&T{wDU z=bCiz!BwD_tc;bpD@#JIv>>488$Zj9!|cLODq|tVDqTv-^+?Meb2R`bIi ztX$ET$&T1*%+up$4v5%{bVRbZDMQKi*rb#IDG5?0tk;K%i1^JK3F&GcX;q&n^_eeZ zw5$(7qv$b2rl|pT6D3;r5H5n}*sWy}x<(^Dht-->vre@BS9aX}GeJ&Dly+vnz4ZAY zJXn2i3cjpcccN%UE`*slBU=dBtYD8SCb+78&(VT=3hZ$1o956e(4^c zsw%KMleS9b7bZ?g5zt=|-6x+DH=sRQM}TCBzDI9L4%aW*biVCgf}io__UtLFnku?Q z;X2+8W-DLr&M8HqyX*XM#Ti2CeD$4OUA_AJ&gs~8U-PXSQumM}Xc6X$UReGK*Iczdi_t_wtIfdlGzL)Z()n=z+rr|} zZ5EClk;!P19zD34**HXvqk8^K_=UGTPv)rlAv_M$&R#IWbOHqATbocS!HmC)V91oq zP=V%is2DWr-+Z$b=_!O|k)G>dJOYt`&y)-sCROfN05Xqoo%-iA)Cc+ru)<)b+ELntmGEpW=R@gwGM0X9z%?Kqe9b012%K2X)tadId7|=(sx>@fiDW27F zt)|0(GuX_2DfkZ`IU=t80v|_1_c#Sw#@c;-El1COzEgVm?0V9{BWgth%cKj@Cq+hM zOoRqAiY5})^p>=XHqSQVm7?IvYNh7S&R?`Fub_Vl@an*;h$v zsg6+AExxnf3)heFZiO6xZOlGO+8bj0YAMTqx;ZJOCnzwJw?dgQ0Oquhb0h(ty-sc) zej?%G`V?i96?yeFk48~B7THU0OQJ9mkoRnqKO(+{w7D_>Sm>Uqwzf9?QxVFb`b9V0 zZpcJ@sf5@uSBUND%O2zD5u2SLz-kXXm)h>o!e@UGOO)0|@pg&C%eGrYr`|!&YTSK5 z>sxZ^VmWHK|C(&!JJoVr9!o5m=28ObSYpkW7IJ`N)8%cMC3VKK2@ZW(bugG9l9Kj- z2DyYz%lhT5FCHF=HA4AT(vh<_0wEzq5P4!1${Y!lSNh~ZlqLwbFB%H~S$xY|8xD^N zw8?n#vOTt->PtrGT0S0qmwUycJ{M^9)N!}SFIoD+yOBasM@-Q!ig{7hKEZDPG`&_# z_fGM-E3<9%ncB|K%an|-y0m{jRMYXR-pVO|FwAaxXgbwZu%*%I* zA?K)!V&H4{0$*e!y-t-Cq@Ersm$}2rCRZ;cWZW&*6f*l~K=B@f220V591B}%F}qoo=uSAM zXN--$t(Q&Cio%$?0lK-or}6Ugio6s!pUPFGndMUdGyD*bzBhZA4BY{>FL!Pw0f_SG z+3V|Ve$5ppos&;6)$|@z_T$;F73Lmm4c&!4)xbNu=l`$j=wKLElHK;mtJl2A+lghW zo1(bcr`~Bn2jAKGx8`1bxrP3<^GN1?vV(mWq@BQejeqf5T2@RH67lc8zP`O00IU-- zdG>66Fif5dtEFQ+{=E(Yo(9ZrNd1D{QDh8!mAVxRS(ot)lIUQdU>1*HV6^tFq+7q2 zON*>I^`=z%I?rJjlnhGWfEGwk-3R51;y&8W0a(=H!Y*=Z)0;h588-);jd+zWw^A ztG*}j$j{PVC}JJgfKG2*zhD_zd}4njtw1yrCK zT_Q$^=GPUD$23WBJD|M<_i`^$lz;;GaEv545zm}cBJ_lK=}(OS{F+`LwD+_%=)WTAYJkiAy@$3(a}l!M3yg2 zA?2@L3C|!h;6ES&J$x|$-Ip%5DPXOjqEZ1EK70XZ)%iKsZ<6Qp2Qcd zwNn+2ih|@EYY3X|zN)arG6*VX>!!|aJX(2`EtaBhTag(Or z@3h|Pf*LUA+2dRE({S?{%%~_@6nX8yL>G2x8~bZoM{Vs0i?t4FXGeYR-PwI^ler3b z9-2p_YTKP}>erX86V=PKYIBXo*=!-P4o$GS(s_?9LMz+bp`9AkZGfC;{J`!Bfbn|* zU~r*Gn|e!a)>^F%*t)^h=M(M3y-`a-%`Wgw|x3m>P{?7xQPtc2%->Onm zLsaZ!tj$k5c^X={6sC3B?f+Vb@YWhZ5KShGtlB?087vY@ zB{Y^rV&05{rbv;r{^_+ZxU7^E;$ow9Vp&-yJUBS-D{yro&^^!8)!b!^u zt>RdGToGS^054c@^-A0JHsW-sr?2O25rp#Nqgco^)ulHv#LQQu${y7r9ZT;NB{Q9~ zF_ETE1f8*>1B2YsxEMFTSmG!oCnEZ`H5C6*r^|iF^LAb)Pfmi-uuaJpt2-3$N4qcl z$elnSc~W#ZX3 zipPeeeCM28C+9x9&ZsI(ICGoG-a5++oM^Omwz9UCo$~7v+#0wGK`*fyYi$khkm)2# z@RIIBA4(Nnqt;jNRw9^xy5>n93P7-}I~7n34eMsQQHO_L5v*?{6w}xmEi2R$UAhG^ z2oZ4n3h%5Wq@)y6t`il|&>+C(`3la)#%8%zN*l>s0``3Kn(?nFv8b#+l0$jCg7V-U zLpr&#NG~@`B4a$jil6yRq=wNug&Y+`gJgRWNjj=BjT+PiwsvG9yyk=g1(8AQLGJd z`F(+0%gWIy1MB+{uw39pXbIld))_JC|0zXKib$1VuAH~mV7T13)Ek(?S5Rc2i{0wM zg4(-#IHP@1|7j$^!>i&a6r;qFEho-+uS!2x9TMKyOZaa)`mdjRC4fg5@nuG>PF`G5 zJJhfqoeb;H=@+fTpJ6^tz<<1)i4n2!g_#1fvreEO6BxUj_&7iI8Wg8~3c~p_=}%+$ z_p7A{`db-sM!60+mC~h03O5sYbai{aSHvhhDIDMH|M>EMu2td=s%6rb^?$d20+ll$3_p6B7oqW*q)xFSQr1riD=(7*oFYmkcKC;c*6|NO__|H> z{Ju1T4k{*yoC{-z;6Ly8U-y0x(NgaBndwN1Bea_g1H|62{tile>w>)T4bIDDiXlOi!77;E>SPVbV7NUj zC_7#Bq?V}j^Lc~5STiORD;t|Mkl>_G*0}yAQ9HjRW>c?Fvg`|^L&4+uMF0T-A&^f2 zF?D45lM`^@HXF^}sQ6}&(D0P%oG?#@O_&0nG}C>vTdvqXiYe0NAmR2Uf7 z57n(LU7^}N<5KBu~5g4G(9Xa#*beF9F^l8A6vO#U@97Vx@`w?AYXh@BKX3> zVvayR^F-Qc;>OzAr{uY6d9cAay7%%cOs!ZWPsTUg8$cl|BTy397e)U5_V#w%xAE7QM-zdJre>OOJuvz*-QG{{1w%3q=O43L z`Gm$M$WeM1xw!O(l6;EP8@0z?+dZv~729{T#-n;FwbX|cmc3H+O+O6>B09Yl9!tG| zrak(Vz5rJ}1{?&t6WhrXmXU!%rBN9I059FLx2)_#Q^BgtrawIQky{FSO}h~;e8#`L>NJW|HVxji|K;F zy<6`Lb=8ZDGf8d9*9tZCPGTsJkfsOs-_-hbfkhcYt9Z0PL~Z&G32AueY*RFfLK0sj znVks$x00#VS&Ku|nyma6Zpc%C>N`9(7eAFMGd}Z5SKknPu207m$GkWXDtw^??E%uQ zZ3It7>i_}$h0{GH=J5e%vEH4fE8n?((YeBClU^QjUmz&Q0`bM$!hjI9O;ta-Ug55-t&7M{~-8(CuuDIs;w1;!GYUW^nEmBet|MmUNLxJDd z$Fi?V)EiP#!M-p(nJ5vO=R~edt`y!{GO^X+p8N;(GE_E>`kecuS}R#Q<{(-O<7-xg zqvdR%BXq*2_O_jRLk$_FFoqauv zrg`3VNz&MBDdc~W>+cQ573e3o%@&tQV^1U$;BqB4If2|1lu8@#c4rAK| zLh(-G`gn0%Wqdgh-9H7Dm*)nVMJ8`K)GCn z^5j+WRfW@}NF=!SsT$2jfXo>~bcE|X(7X20fHwAu$JYuXuKQ=akh7ZgUTNp*Y#m!SeMITptt~zzg+< zDUH#C$uHT&a@__UwRs-EY3)z-zf$OH9wD=!RFy38_Qut)RX9|2C=T=dv;M8xw#=kb9h#z1;Dmt2<@|tU%aYm-+y_rPRLi~up|OHwp41PZ)N8rI zfNZT?y{A`+A^j~s$kW4Zumi`Px%n|Te`xrtB9~DA#Pupk_Lx7>LGx$!tW1>fBB=WCyZ*!F@$KD(WkENIMu9TTS{J0@2D zV%E6GGF0j>a>2kE1}YcJtKK55aWRWI#0)t-xslzuGMh$3MNnlkPL7VFx8?fLXnpar zq{2fexeATn1BS^w;{=G9b=n1kcSF(oC*IL0=N4;R6AzoPO<3N6Ji8o+MyQG{*2Y9; zv$U`<#7Nj~CoL~9j+Z^hl1K_rK83Vn8jRM_QZfb|OB%_PYIn|po=Q$?e>t+OC<0^~ zLg!mU?+`)@KIl~HX4{EGs}Q$M?5*HEFWVMw=oVnb4bI;=mgnd%KWy}w4P4LoIG#$v z%1NpL2YhQ&Q9oF|t*`u#(EkqAoEf47Eu&|Fjlp2xW|*y4RJF>(CS4e%E6?ioJxlnq z6>g;d0r&lNmiWcT;--R@HyM@gMPvJ#V9!@wxg=cK+7g7rX%cpIwhgswRia6M`|6G{H>m23t z7)I?0B?&V}UgEZ(skbmMQPV+yhqteONKT8V9h1qvH{6N)=Z>v=cp0DNjHUFY+7-vq zb1ObP`S3^G!GvJ1H}MIb@`Q8|B*6@Z=ze1%Qz_`h(tR7f%j03$=okvMj&EQB*sLpb zOYN+z)^ve#Y~1GrjJM@ARE;%qalL)Unvyb3NVdLR^i2QU=}+ozr|=2>QT!+4n|bXy zGnEwExYTit-~D;;&aKzs&2xSLM41A>(bBJDf@mC@f?x!9`*OZa)WN%*@y`cc;U{`Y zON7Odoq7EUzIesJOVm5~A-iA3hb%(abj{l3HgFsp)LjDivNvmhBSwxkZNX+h{6FHs zS0IV+UlC^vibKB!fBwk-1ipY_T?w?1C+Gim_>FBfkl~7roRkw6R8(Y!ijAIUpWcZv z3ah>jcbvpVp0v&lfRg*DL=1L50rGMM{XodnxKQ)nkN_K)+Q~ZU#Z9lyy#+b~ z0#NP-^R#{I#4eWZNE9h{2{u40B`_3*b2^?$Z&51uEDuXkj4jjYvj^xdmoV!i+cQa~ zG~C^9_4KCRI1h=@>VM@m(VULgIpb#TxT$0$s@(e4q-0GwS-M>Y3IQ9w%oh@Eg4pYz z7T$af<}m2+Yl0D{N`cCBuHs8J{bpaXP%^<+rP%YWe#y-~MX6H1!TG77Zs#$S62@2+ z8e);?txFCslz9P!N3Yrmve~ZsN=F+zyC0u?U?ZEGQ#%nkvR~vA;ht0F6f2{&+DHN}|9}xS)`W?tZys0=^Gfuw`yR*jV~H zBYL;>{&y1QWv6T26v~#w`*8YWxH&B+}Rc zn%`#zVKIzy55#{b?p)GIWVmg<8oY=Xp|d{NaYx6{zT*)s-7TN9G=VKiy7{nl0h|dS zJ#RlZ-tFxxoxy@VPCyZ}8w50Z`OL+AAdVCse!<=B>+^k7U`WacRruA(;=nOEDFr4h zD%s~_yB&VjYLm5%uRkVs2D=zdZZH)pczzTeyXWA;r0_U*Ij~nnh5H;~4jl{64lNzR#v*l%`OyL}yRJ8evPCRcmc&xw`D%?zr@Q zr2ItR=4QmxK&O2{fKQtN0(f>7u~qT8WrLnSWu|0r4UP&PPrZzdg2(C(IWF40YWHUR zet73tMduO4_`gd@%2Xvv)Mw69tLDDkzvmWz+!9r(x?ph%97ZvmtfMMatq;g@y@w!p z^q_h-Yvhwk{Rvr!FpF(m}INl#PYBwL4cq+_^CDm7(M z9F;zKhb8A7kMcLAAjegBS z022lUg@8fLg54e-JJV~9uTZG5kZ!W?6-k9B_*DMYMRb4aPIyqILdJGsaXgaj6aUka zDpcI#zY}HzF}BWTqD)bqG@4*O#cf?Mw2`^u%Bn@lY*tFMbE$@N<+1wN2tpfhc78)|N5_>Rk+$N4oL>q#*-KYs^9K#vH6B&}P;p8{jZnef8o3JJ});iDkK%&UF%Jlk+iiKj8OEB4R~ZSejqe|5dZ2j66jbFzuV3m z;n4#BFj%iQ-evF>&upnqB0~sn+!=_2rl*NZ>o9zD#Ee5LFGb7|ar{X%O^<$R2?+^R zeZvv6{_5I2Wr5_R5yyci5MZX1ST9%b1(inV)P`K~$2))DWRf_J;BT(Ye7y$C=dtM- z01NlJyU{N|b*$9dey)?68QJ|{=umayAvtC*u09c```S?pRdIAWxi@Uvqoji|_h;E@#H*Q=3m3ew}e{7shNG)Tl);UM5)mGMbxTOu&>`lXt z9m_kMAH~=VTccaq@L*z~pdURy)@8>y=rFA=tKdAUWUHibABsM>sba6s>6kW(c>Va{ z&x&X;x<^&@vso-#0+%H>xR#++%bEjUnJb!3Cfn>-b~L?nr(XFy=j&meQBoX7Vqy_E z9GSe=P@6EJCZSZeIv84-`$+fwn@s7%@PeL*L}77UJUmu(#feA~+kxJ+?XR7^3{~I1 zHE@D1vVNZh%AvGs6daI7x*6jBqsFF0nWqy z#L%3GPUV(bN;;4k{@v6}6trfzD>%I$S5lTT4CCR3;=ab9>B#e4Mi=MY)`FItun=!V zbr9Ay+kHo>D_uIR$dhe7;&h#t-djOAlNZW3&FcIZ5x& z_fgm{M3yvE_FTc#p!zKf*cP=wHrZ%04kM?(87y4GcW|P&K-=d;f@baGU16Q-DRryep&otcu@nr_pxCL3kWB) zRF9h!U2m31Dj#V3efjb?nRj4yE8;lj6UuKwUW;_yAoIB<^8(-%E9`tXquYR=!K@j> zDGE$@KL$;ngYudJF?z6ko!yL{Nm2ZUjc&&dnTnnkY2O{6aP(L$5> z;j)=PhL9k!tWvWX6W+F1=XrB#;V)n=vG#~e4VF_D`+RuIK8YOE%4GJ9c-~8wO3~>H z2Ve&ig8@-Xf-G>lFPme(zEcg{u7cSazag2`SqJn7g>)jlo-k>>WoosmB&R++B&3h} z63IUSqCeMZGH+Vy6pN29H4kXq$_>iF3a=9je>edqC_MCj|5vJsB^BK;ZEPH!^@5doYk3EsBh&)?_sxnrY=i!B?>aI^T3W1gm0wK(Wd z^YPXr(Ffm$Rm}RiJJrhtlX&=5A84gt_x>4&yXiJ)%VAP_uBqTgCxQBE} zFUZs%R{fb;YVhzS#Bo!k(r7ZHG{bis5YFtJ`~YKgAJvA@?_2`{QUEEr&wKcj%jN3r zR~3L;KIL+Ihnnwiq5QVJMx8%KDEe4f9vu6L@TM0f(yr51P21%Axzj}cuuvQa3VT)c`8fit;l|GCMEp8^fVNVb zji2U`iFpw+{X0m6Vca{7v&ryR!t`yDnQ{{(ZW!U&a?)*^(vTBHr9wJam6Ykh&-IGzE&PaOor}P#;GGZ5Z~*qFMJVg&b}Wd$5VBFP$DziDT#{69_hWc{4rv59H4(Fl|S@FnmHoF zmx_bNiOwg*#tCk&t)*-0VC`$-2Q!+ub5t=w?u*}Tjoh8n=&Pza11B!6O;Z?=LVygY z$w-N%Fb_=Q52&44NSe?9p<{`z7^PN{dANu4>02~ijeaO2H?P}Bvh(#BNqo?_@{QG` z5p_y(6;n72>#oGx4iFLDf2LWkBrI{MXRIFUJd^*)!4RWn&wJ=&`Dy_>^ zIxB+RKdXr4nZ)jnTrd$wa)C}w*j47(l4DJKxZ_Fv$*$7MFXo;7@85vt?~YsjiQ3xQ zZx{wl6spae)KkUM+I)G7-7xpXesZFj{lmL4PonKPo1SA zx6(TPC;9pM*+)A&V7sL5r+y%qIya|pJ_;wizBn|1l#79i5g9#n>%| z6?QMa7)?809MM`K8om)749Uq3rb{-DsRWMNOlJpZ>*(Z&9h(DmZB0m=v9waP9VO&Y zWNAf_;nSON`z3LIK7Lrm@9gRx50>db9ryBHmmDdNV+v&>b4DMPOgaG8@5d?#68S_o zNVgJ|n2*q@0Fr*!bzLyJ1L0H(6<|1BiTt&6l}8D2OgcQrq&wT&`J*KDUyNqCY!^T% z$jA!IU9jUsX(&w!gVf2+r8>;T^+Sg1@kThjG7?nbI5FsIkwXgo0_-q9@+9UK?~@Gx zJYcgQ?cYq-ON`$*cPKa(rsiW!vbUe;n0to4T2-gf3z5QQmMb|iHCX3W-{`uIaBs|7 z5-xf|%(1U^x$r`~jp39}iHTw}V;V7>tJ$1uY$&r?Qbuk8n_l#Hdj1|s%(pg{=3OlON%+`1W_9itZxdE{XhZ9LLw@>%3##^p8B) zk1=9dT~d`KHb^snwD|=~ zD8QJV4^mz<^DOqm^ShO@)cX>TCQJ-RfEMXJ#sbWbm4mGGe`oKp-@WWwr6o66h&Q4R zHa9X}2zp*2dkeZ{Leqg7RTIjM zKx+4$^%=9?(?iqtkOcF`sYcMOXy2!|1X(QQrUPG_&cu7>Qkqq+bM$1C)Pf&jl7mYU2my8DE;v55CsXSNJYn8P4_95N4M-2%xm^FA=dabX_ySB3=a( zpAser*!zGo$8!bM`r#Ayi+tasN2jA-Fxyk7Zt@C!e<7clSWXJ)5)t{`2pU5yg2UnWE&7Z21T_8NMuKhHetm^^f8tp8z z7P#&fa*ID;k+x0HDyeF87ljPhzL^#hco`m{s^`Zkl$uZb4Xsl0Nj_nHhGKyfWZQ>sOlYJ)&?bwsd*<-A06tAgEIbv{uxyJ>_(KaAplrM7L0{@$Cys z$7o(BCgTAbJW91WzxTqXgU}qR)f{5tN8Ph~^tT#4`2NJ>s>wvu^6PI~0|^$h^a5pi zqeyMT<2Y@;xOQcbLa8nM@o+3@%F!o=~zL+Ynu(L#1OFei#kN|E; zAk142Y^l8>3bYZ1+=h^(0Bq(BU!-qH$5xhi?&xPmoc_iU?0r(V?Me2Ed(83{x}5cBmXboh;EpxNRICh2;B=r|ZeSbC(~5^?W$K3-B3cn0Yd zgu=XIOw&MLShbz$dg`yoFPBzK9Wq`;`J6VW`q95kj=o*)h;8pIPw_S0Q)T9)I0KNJk&S79m^y<~Z}D#bZ= zE5CBAFZlRM6#6jT6dFSxiqsldATr22`@b>n%}jK;^LQoQ{3!N_Q*eE1Le8XzZ6mF{ zBm(zX72Bk_k0M#UvNc{EA+Ujnva$1Daoo%d%~Z)ziVw1^ReG(KtMN9U6T6)gI+M!| z%xmMXW3^4<-|p-l>u<|3yfhp!H*dn9kK?dW-2CPqHM;cNpUtEvC4N@-VlUq#s?9wV zr)g7GYox9Fs#mt_SZs&4CDyBD@BNlzMKDOlS7Nr#1xC5xjX|KY(1#9>u5XqSwg+xS z#{Wr1QzD@JnzjKG+roAK2HOxH_0E_;C_wlY@zsE}g5^9g=ZLoUUZGaCHY0~PH~xIx zx#GTPP;;0}G^fpMDqgoIwJqr=K9y~~R@K_0*!EE`&l}GzAAA`-PeSA6)4rX05`C|L zn)L|yh+(^z*kW5yO662V3aaj!=k+nCApu8e{TH3g%j50l;^vbLL#@*>*H}KYuL~d+ zN>TqctFteus<>m{z5t$b2QS3}GP;S8tmwAH^conU=MonkMW$|OF3jXKak)PGi?}v3nHr{5Y2>WJ# z|6nn8ZM@IRi6MwuN{KbL?Qy$f618?jg_(fQeB)9ST{rmc0zu}5<$Md#e;-l7K z=Jn0O%!BLT#*)Vge3W$i#${rE2#9De=jP^PUWNAxqpclNCSuRsDqQKo{Hy8$>puD} z+o>Ma@ogmMrd@Z&vJ<25dtxzfv{q|9nR1qopbEA#!9V>PEwbV5<0F#{v#XA`{s2(jqoZSyH z(}^^M*iP}KWbeCM-tjm-QzHFFK*~gVo^~WRU&YbU$A)geD$1W(l&DtxNn$c4nfVcM93acod zu%)8SZ{Tjr|1Yoq9~=4qI5Dw3N=8N?ZZ589m;u2*V9WyGl45Df8{ojXi?Nz)|Bxrg zQCp0Ae!Aiii<11qI}R4o9wnwB?4c2O@`QZ#O|Qb6SlgdWzaN#*G-}5J{ia06(42;R z7>|a%LF;$)J5Tc-k{W7@BXAuCsn9z<7peH&61aA>NS(a4Q8HvJ$koFe*gMt>}M8O)iD^4QD5`x8}|*y z8fMV_b8(>`--X;qN#LARYyZ%>pJ5`|>ewV34daC|uMy#eGfNet{8yanrM~~Y=?q52 zw}k(71%4KaM-%FNZlaR?-{G#i%Rqx7vy*=t%m0nPz3c_Bf*>|J73BX4tUW6N{4z0V z6@`cYeZbF503@)D5RdM^LU{L3H7Edpj*{+R|tS$~%Al zeA{TgSfT6pyEfpT|Mo=$$1f--JuK@d?(=8QvMQ#B#BcNQvv3sA{(|*h&LS^dfS*W- zv6UU9vBQ+jU9Xl{&_rkmdhWgd*NOwC1QPxEYSvC}QRaY`fkQOy+@>7#0zLNcA-;a~ zYz$%kF^c2CYJ8h_qK|+ox>%|3_}^?BXEfxcp9NPp*z%BZk&U@ZElcP}lK+ea5+bDS zl?PD0+qBC{kud-89{=E^VeZHa8*jfN%sV-$*Zvy*8zkHF{D+ijVi^B`Vt-cg|9VFQ zX4LR&(LCsX&*NY78w@M~BDA`@o%X-HKz_hi(3*TA{_hp?8yS5AJYI9q-q=lW#lN%w zp8ogM5cU%IIu$Ch+#Of{OAA&TN7+NE(;oEC+K)|sUb;xw(-`01lYE-9j;2AV&Dd+sfcvc)w}t5tj+<- zi@)aSpIa9xBfXX{9`bK40=5ZVf%^neWk+*AJuc3(yzh8^D&?-Scg&QosKy`NyCnSo z$DDp9#rjN{Mkbb&=Dx2P`Gj(s>POqBredjOsgJM_}TLV;SJbWJK zZd){{kFcn#tLLg_y+{CBz8|dgWOY^8T!QP>^VPl`taKNKtUuvL_;r^@Cw==1YN$rKb6Yd6=A91cerYg~`%^0lt1!3Bb^ z3w^F}U+%4EW2ux&;f);5)SfzDZ)7w@wm8yQP1T9c)O;GqJ3ULLo~d_|N62?RadL9H zIF173HxbnC0{#_NQ;Cq~;>pu80GOhK(GLN6HnR(-+fpseNB@}Zk9gqB=<(P8U6Nt& z@?~TIg=ioiHBdag6vIf&7%%91akM4(;Nrx{+d#{F5bmA(iscDEU&-K-zoD6aW8%^E zbPP!Cd+c$t3U+tPiB08_x&=BaYBEu|d7gc_pv5RW^>o%u_S)@KL8{U9m^eo`p|+tA zH%OVvLu|L)LKfl420I`CcwUY{HN|wAHE(nbG8TRLd6fH3d4~!}r<}DJN6yMBfb8Zl zK&pH5mi86GbUG-6^g6W0$uo+l%q?(dran(Kqe?qamyq~wr_+Ch%vvn!^uaUQ;0EYJ znVc#bsBrD-nB!JiP_}i7$X4&e1P+LwVq!NJPn#1MPs`6C+_?%3?sfWgGZn#}4P}dS zro5GRoQ`w`zDxjjQ|`p3Ox008KUmH-i=a};`jl_l4$1ow?gC>{m2yNb|wWB+=D9`VjE}$_V~cVHBi)y4+;` zoq#!B`Eu8*KaRsnTOJ^%y|qxgO$k|c*~xUj7zTt4aP!{g=%t(5M&$8&9{EiYaBh}b zqG$s8DCK%34!`S0rh-bop1B=T8Ryd!j8QBs)ZY}AtJFE8(M_gTm+0c6n1qn%9=&;^ zGBQ!>MxayYtZOA5X~EqP*iO?Whoz`wz8JKwrDFVtMNCZf@#@Srwo*Su;GOs*@vhjB zZ}|-vN}FnmnEEviJL%KHQB2^1v1YL@9MjfA`?bA!t|#f*6D3eyryZ^lS$`>$-o%V* zMBgHy$y;XWa@035Wi>^Il2%yAyghv^FZEdQ+B$~IjCBOAm@ry!NiW*=S?-T-wG{=N zC?~v5&w=!Y5c;!h71}QEO%nPm5Y+;Z35Ob|f_$oN7atN@>5I^EnV-G9tDBIzKc2NK zUS@nK7P~*gi7)=5vtX2kaA3OHBTlN=PVu5=B_{Z?HnS3ku(QBx>*>nIN@f>mWubpQ zts`pY9;L9OiF^f*%K>noj)8ADSKh#jq>@|R{Ng-lny_r2_MxDE5 z`ZuRb>+6ypuBWLw@agJSMCG%omkPCNve5o&U9mj zB^%2X;;H>6G_ja6jmqv9Q0ocs0D74E@}b5lEjCaQ7F)dH=wT7K7w&fY^g?e)Iw7Q{G|v#S?@=qz_J;NAA~t zJ)r(H9InEk-ar9{1i}7(Bg>2JZ#OP-$Kd(uk^vS2#LW-y+=}t%Um~*PHeb;xycE2y zcg$-jv{K1eiXq}KO*Y_O>5TAw_wLJ?Q!qAFZ1UrYA=`+*33*(*yv7h8$o{Hclo z8%vgn8ddsSa25vu7zW`Cat)Plj+q^7U>+>&EjqZV6$>$wQqhCz=iyTBXYj zmZf-{X=*U++n?^*#&^3O&CNd`VmVO0*!%WEC6E#8kd?W3?$UGCJ#ev9= zoj~d(&042MVIRA7f~{HE2=o4I1iP`=PTGKO z!)2gBecOml5!JkrWL_uhAt32I*if&?iGSyMzHtBc8j2S#pU9W;?a`_7jO&vsL>(P( zxl5w~Dfju|KD>-X`dZ-PyA8-D2lN_7r>?4MSc899QG|KtaG!|HX*yR47%6TLio%CL zv@*V@lX2e@C8C%}0e#D`hxi+X4BM{9JH)c&kWd)y`I+0;=_ET5?~1bPVK8TqY@Xp@ zg@*i7GM2%m=q*21vx8Nf9P^QE1yU^(#dn=~A9{#L7HtIRUq_kx%FHHchI3nQJ$Fr0 z6ppYXRF=7xGB$JTO79zaUKUaAnOABc12sy;Wep&SGGe^BxpA*g%Ta88c=3Mwe!T9p zZZV?OH%9>2E7iHSy)6sy04lS`hhwos(>r!%+_)1 z6<)x9Tq1%r%P#t|*~c`fS?pu!RLxt(C%d7vY33ZlK0&TAqoK~UsN&%m1Wcx_7nki1 z1X3&F=h|pee?>-V*cWKk$L8Cc3@PhQ1!Iq$V~N(5Q3gn-`6($9s{>*crgNWf;O@Q2 z>YdRnX>XkH8{iS=uWNuRAi#?cxac$LIqw zET^6D=7%}YgXLcczVB{9y|C*NsSj{L*v$d%+Hj5sxZ!@j_l%EY*`YCpTv|Aa({g8)@k+0|c2BlFHcVLaA^@Vy zAa!}XF6(jOVKnG?vNgd~_X~OX7>fvB41tAJL|~w)I!emEhIYj=RmbGH-H>^K{+kNIp{k(cpeacC zWGv`J3tk>*cXtU1S|m+Ylguv<(xBvk4_sz-`P73ZHOzc6y?BzqxK~}zD~)Wb)QPN9 z8eSlxIG*h3ktZd_Es5)RFeow|&uKj^(#U+SN~_b-)EzCVx$w*!J*tmdHbpj$(;{nd zz_5K>Y0FUSwM~H%*U9FPZw={I3K^$$OQoJ<$-y##^4WZ3ppst*3A>h!95kTWCp0~V zt-+AeLUZ{kBRY@b*VsVq?&P1s`88kS#yAlKKtDfQuL8|H>;r%n5z#VpHs8F4rr)xy zDS}<(U!tnroiC}U=IIYn5h*af{qn$7RWbVow=1;a@)Hp_3Sa#?z&N3*4GcLeDIXT= zUu*|4hqqrTD1hSeJ_^KF^=O+9XBV`AmIJ+RT3cY}4t*0=hco-u6F zkn!_suUi2(fyXah2&$d;Q?M5SC7^ zQ!=g&UBcT}oSf>?!eW1*xX+}|oWm7=Jbf5Q{y&f|A$PQ@+G=HhICB(5^H9``QY}E* z^U|A-yH3Q^l!hKHE2qj1pos8XkBkkexW7HDa@I1>{DCj9@iO%#4kjLilL;b ziI->u;>G$AfWH!oYKx09={3BItF&Z!p)`g4z^-#wdZePNQYz@Jy`)5A@c0HR8@;Y5 z7Lb>_jp58W@iNGh3U@z0u#Io0snk{7y9(9F2`1$f_=zrN))oT`qVUQ`BroVleGU5{ z8<)$vNM<{h-)zeyDnd@Xh_7xTO%Wh1YkRrdcqxk;q~)RbrZ1i!ye;MagTtnL^l3~T z_4j z;M~+UH;6~BqX&#OhcmZAb#4Fc8F+B&^Eb= z#h3{EJNy1hpMRvJYXnM0wVHe#=bPfIoUxFFe`+)F0aVvCu=Fd-9WUu$FA(AVPAd`axab1rKy3N999=JjSU+p}HYQcaef2op~r1MWTbhwmS|8{{r^Oj;}KNr~@KeEef^(Yp1trF|{AsYUM@s+W{Q`Rs-{D zXb449G{f0Qh!^F}BmGnTpx@aj+U!+-9tuLvL?VbeZOr2E5tP=MG=%o6U1s~vLEdWP zfGh#SBYtj-(mi|@`3?im4fYqc68MS2in&rqRZG}u@21aUI6UP*ygYxZDCb5%_b3PkDOQD~4s3Z16Es9K?J8fT&AuXU6@&ZXEl)lPji2WlI9&eq{34(B7i zvi_$*gqk_m+CX+J%Sy|gQwt}cWODl5*n%W;b^jT6@zRHDNUiwcpFpVdj>KSu6m0!B znri9$13++c7Tva0ck|D!>ggc*0>1RBU&x5^hT3FYm|u zYqprS!lLO%aJ2`0=;>J^l$Rz!_!*#wn&lgP8nq3!hhlI?Na|Ok;1_3#UU<^V()Wg9 z0Z|SOJdWv{%Ov?lSYq|| z1)uZ0SbjBps;TN9*cA9*9`{`9*);KM4upezjlmlpo@bC<0lnPiC<7#PYWr zEdeR%!TfW9BtGv?cA4`_VN>zX#0-Y~MRhs)EIS7>W_>jt2gKzc)dQhJJzoYVhvm40 zhwHIQK|jDBedV8{k#%zToq0=+l%V<(BVA|6FdjxDxDs9~V^J`2y3=aO{yfSvBDI$^ zB$T$(zXfl4&DAnzdut+9fbD>=(M!;U@jYX(co(QMoXX(bZN5qL-!#&~XZMYwJiV!K zqW%@F-~EthPDlU^D)XD~(;S>x&swXpt$u(rGDge`cz_L7(;uB*Q1@v>j$7GwjxOxL z7{Qa~_K?>f02<|pG;W3@xd9#xg`{xMPOId=Cxgjn1jqT{${Z@K3e(I5!vN{>mdRmO z_x8~nRXsiI3JOQ_u@WsE?IKFU%8vQwTh08a_(w+54Sb&AlYE~n3eF8Y=-Wksq%s~O zehyCs1;Y>}YRqcfOFGY4G5s+bp4(x^qohQAap|yEV~3xnINn&U={ve#`#jlFYLK&<>Pkw&zlGyoU?18u zl`?}fANwz71l1dOqaTf^D?6g(8ymWMs0T4vvv#F-@GqLJq62x;LsfN+Hy z%tVt5t3(<~erI!EqG1YE3KF$gqQrxLKv@g>`AuaLP{|#JS=(;+_VtB|g_4Q`gc7x4 zYLnhGIa<=|>+8;`DX`6lpG~5mfSM&-|8rXWR0=&$7H^!#{2!cdzP)k%#idGh$bWNg z@@{&<_X+8{BzHcA)=1n7}jHHfY*^iH;5aQ z`k0W_k}H^qUyN3KNgqIy%Z4CJ*GDmI!{u(6lT~J=cE0$Odb4~kDpTU2q{>~?ieIV9 z{W1_m^RLXh2$W%i;!r^dswi#{<_o^$gxZ^wn+F1!w>P|yVV(BL#46^%5>*j<+R$TA zDf*+QBIMj1HDeM zIW9`t$6KSlXOmU75wmlptNU!nNWVF606xZd|E}yNoI|k7`SI%?NnZC#=zRm`f9_H+ zBca;641dW!$o^&yzKmeE;6QgJN#7>w9SJPD|5tW!4;vM5j)!JynM?Y$HkyXmcu^j< zGCoYoIK(9XZgWVJgg3NPQ&VO8!x zi;1e8UCOcz{^CWK*5T~+Wz8TL_eI69FEKs;;ZjdCex$q#(#uXdD_Ib?ytSOlVgGJQ z2^|c+bV89@)*CYv*J7Xnt)~#4kWy{B=VxqIimy0-Z)@50wcMQt;!KL#asqy`Gg#Q1 zb#LtNta=y?l0gqOdIeOaWX4$C%!RV@`}gnt0AoL*cFJf|o|UY-TMgvLC|N!pSR5<~ zwLK^y2#?N;eYZc5CJthj6$#f%6+tU^qa-wZZ+^Y_$I*Mak1Vsji-UNf^~Zky=Q|D( zHu$Jg4_~=3kxc6d-z|{wIR+kGc5nC@^w}S8>GIV*X|c;VwxH+#$us}iG`9kTIw6!Q z+I>Jgqv(CGypFiOROL7X_}5Cu<|8Txl-0?~S@P5_tgmX3yno(BF?R|!kbw|tOyNHW z$6sS{dszgyS#oOjp;WT*Kdc8@N4njo-A;Bg3L6u}up}-FLLOe;9jp2TKtNj-Xx8-d zZ*Tr?KtCGLfHn$Wc|Pq(EqB9|rP=^!KuO{w>bZ7(ZV7C6rn0Yr`B~cCjlYb=18IZ8 z^GElhenVYsr} z|D6H>@dfVM*~~5KMyuX{WZVno?gSFj9c09hd_fk>Mj7O4wf(WS8}zd zG=@HpH@1q3KGuAii7L1_>tF6BP<}%k`-=V^n@O(>z-K-JGTH16cE`*3)7!0x366X>MsuWI;1i*JDs=2!?}*NYGgFgF)=bO;|G{nluTtj(_mkz`gedKat3t-%d=SO; z;tjOKsP`SW{i>qJ60<^>Qt`oIZ^D#olASe^falE>w=4dOg051d&Zd9?28a13m-q7dc$zyJk!pcqn4M+Ma5AhK{R@WS{IKPv>fi6!&;1a z#6w6N4%?pKwApE|)PI~$HQ%wGt&?-IZj64woj5WSQRnhh_}x2+3(v0ISU-AK;0&UD zRa=Q@@Q7ffvQacLO6Q4Z*7IyQx%bJVPb76o!0n`rF4RA;jC%3c#(d{!#n>9T*VBJe zI)B^W-RH1jz{X|XrG~@(&<&%sv24NClV#pYe6v-a30+ZnLaWU2XWyiZfL*IBF-D*2kI`xKBrN?d`y5(SbDjDS# zYNc+M!pAXY0}G6Ha+~is3w6?X$~T81=Gx0v`cyZx*QEuB`x3qLHX%*pRb}QQk@07x z&bv1{bjlU+Jj|3c(<9zmK|DYEKymAp4vyEXh8d7=>rBYT|_|w3mgLQ=0 zX*Ry-02O+pp4Yje=FbEHM+lzpZvXzG_&N*y#0IDHw@+JValMJ$X&YlU{eCd}Wz)W$ z1eGi~54=O0?#SQ`jcPl%ex8~#En&uw&d%^f@||S2)14yGqz8`MCtpgsa01`@*J{8u zY%g~AQcQOSQ{dW1@4KtNS}xN_i4`;a>KSzf7}W~brd}dBPX75=7`P1S^n{1Y^g_2g zQ~9a`h|&)|nUDkq<5SBFnnjM?W=vgFS)|%w0WY z@U6`~U6X>Q4@nFLI@LCa7d-YW(8)rbS|)#NRcKIZ7=7zLaph|q!crQkICj9~6DJ%3 zMXP&*iEk-Jd6YVpjI%-XI>AzHizL(sfF^UU6`@IZYAY1N0zTOSp-{|C@oU+!;7>=K=hRzI*ijQv=NQu5!|;+Yha(Pz;Nw zYVh+*L8HJbf`HeyioF0$XRt&yfd<{f-Ti3x_B~2$U}7=Kw7p zAQu!~#S-WTE~j}e+5$V7Z@vU+db3v=IsWKM0yJPCAZy9iE;ifJCzxKD)5Se`NsF$G zv6X6LFmIS0YX!X}o+*>=);q?X*+lp+NR-4qu%Q$Zb^u?Gq=Nf+Fi)kF4}{Z3R}F5R zFS8cm`hokDBNJVrq%qAfnLR<@O&`It6;d@=WmwdU!IHv-CfG* z>yoG3XS=1wW~raUDZ&I5(e@+YZh-N`9~h*7AEK3l32yUW=nl>&6F%30U%d&pGj?o8 z?|5T2ScGRpl@T-?qF3kq1y40((z?t^(V{L*o?j@lLu2M34O)xF}OSE?Kq+@3H-e9FZVjeUPsrRk`=v24*q zk}M?y=@&fDVIbwGmv#gaFnIVE5^2~38>>u&&w z&TJa+H!1B_E%-Co^N0lll3pnTi-ng`;=;sQ{KZ{N>1Y7oQTYD8$!ob(jRiZ^gy#H%mS&BQ0QWUEaY>zbtHmP_F6=BqRxON1G z%JcO1S*=>+8_C@A;=^)Qec^mKI9>I+3jj+S+5H6ywX9+S#I@#I#3X)PUO3IzT2# zx%Sg;4l=`nH3_v#N}-Cs`HRvL1voC5?PGEOV;Z$kEeM&7jSWmld^$$DXsTR8{^sB? z)U}D!fBtORlvQi&zIy_TZD)tOsEf+w&3 z;OG6>ai~f|uI0Tl62xCq`#pWJcf6m`4NRstRVISVD^d+8T+Ez0umO$-HBBKMj?N^qbhXgZdb>;Lv_5$SuYD`yW$=lGd&+zpX z^q)_Vazb#jrfXb=j*{QYZ{T(4h2g2@thL!2C(jp6;?g&&z~AI4mDkvgvrUYPDtE>-NvaIJ#hPMb(sB#kqv4Oz>wVwd)A=IJ{DosIV5>iUTbljwf z8^jb($?Hhe-G^kbNI{qZuJi;OZ{gcZ*ya-$XKG}>`_EE+$&Ds)M)tcp=J!dQCwni? z1G}e?=HtmO;L7_$;zi)cCp$B;KtZ+|3u^N?rMh+=JHdKS+-TksGteMZRf@qs>uk5t zZN&7%{@}SJ)ezi;KI6ITFY7`;JxUe5W88-x-!4l&A(<0lDU~&TAP32a4y=0j=pmmH z3%>F6s0hRE&P-!gi3B*0IwlohHAy>ej;c#4fO?a)YXiV%b?@~;YS$8Hb&RzmQ+X|e zX>746ivy@wDw++i+z!QBD}>vb=y)q=7-qC*%7$cTnRRNir;8~g90A^gDkSFKr}@z( z#I;-Y!@llIe%J6S+(3*<8h*-#lpsSkaMI{f&=9-DNJDXnx1;Zh2um`MeoDbCUNf)9REAh#MccRj2pqe*U_1@v$Q=8$l{7 zR+wezVJk>d&nfqSsPYd>fx9 z*+&PMR2imJ82GjyUu)-!@gdHy%HoS!V~;h6KE>g83-@@8j@ML;WJbD2ZP>~b<{YipIE_{fSvVNB~`xVSJT zvP;M$RXz|ie*5cN{nXL_c@*Ylla6g>o%~PwVYW_~U z0y<7ZB$x|6swpt%z>6<5rW!7>%`Q9@%S|r+I8)3j+a1cTuDWP6_bHQ+p+8Drem)Ll z*5)!HW{@j$wKoBtY@HO+GTQMBP-x6Adz$TgW@m?8ZC_ z|8nG=t2EDvNOK`m-wz-X8P_6XOs6y?uKwO>q=~NlV?y|7j;WA4U+$k5$E_L`5+5EQJx!c` zHG8kUSJTSDa20VKtE0QUAlBf4XTCl7uHoHO$aHr)0`?hO0ZB>-jZYfM^GfNl1>qF; zdH%{gN~%uPULF1r^NZ!|ap=?h3q_GKu)5q(rxgb67(FAc=U|zGHG)Xp&VLA~i4rwe zXoAM9pOo7lt^FJ#h#yE5%}S2}_+d>WXR8)(YV5DS(recs!DxsYo$H*~J`PoJp(*<{ zT4bH>U-YujDtGcYtWLT}f#-~+BC_hf*Ea7re|;@Hpx(*sX;9;_%y7%$c5y&}@4t>- z_b$gi3g$jtZ>!lv*%O^~rEEl@@$v)1O{`x=Wwi`y9IFYfR752orBoC^>#dPGwb8Lh z^X_CNNPisfB#5tLqsK1}Fk7HU;ioFx(t)?_SG7dTQsMc}ee0z#caYIr1`JzLaVG-p zV{)-Yrs4=(TnKNTAe%&y?I(Ld|CuV9FR0{mM_}13X>o~i5$#lVy}Vb-AETI8*T**g z{hhmY)fD_=fnB>K|` zTInj@aKf9V7t2ICBR0{^X%N0k)IO#?_*LRus&bt|W)`hV!X?)!nNjcwWWC!=6IVvP zh?U;}<5ynRiPShRGiMr}UIpI38*9iL3Lz@FxQK%Ix!^r#yjXX39{+xq535R2u)N23 z7JKB3&voNkdq99pp_(L4)ADiYqvfjpO@6b@!shi+7#js7(&~_qQZgy<2Lp9rDYve9 zlO<2UnOPK>zs&6)GrOC=aLDI?pzso{M4e2}xrD$G+TRBFduHbv<&w>h)pH!DPQJdM z94<85Z)$7~TAFScVd!U1*RWlP5X7*m&MU(U$7~{nBX^e(Nuy|5g4r_Y!TYdexG`~m zQ@G>$=<<*|KaZ;0u9H;6E+tQ?MYXyMchM1;r^<;6{?WF43wt$inFDyDD!6RhEyH5vlJh;KJe`Md?KHxNLD3txLNbF z_17a@b5~ec&mR;DW-jAs4J@ZkwKj5kS?dSbhSk~`aK5K2XQ?M@q6EC}BQpj{D1$Us z!zWb+s`u<@79Cao%8HhWYEPWLahiSkf$Ce1le8!37p(R)ZpQKkA@uH|=<_d~>hfO> zC-Sg~E;m1Wef#;jhgi>Tv6Qn}TKPmzAWV%7OYL|PnExL87gWmR$RMl$JskCa|487E z&Wfn|52A^q;*n*l_?6qXZ*@h4ckJ*ZCx%77%N`CsdeK-8q<4|ba=zH zq#M$vH4)v!FbbnBEpjwaQin!ol78bPJX-py#$8#beYO3w|Ain*+l-M86?(GTdRLX#D#y0ru{fLC8f97pI0(QMrR>t-cZv*Yg^DzSK9)GJZwkvMsY=zv>VM;4Bv=&r}b3NK~ayPYp21S0+ zn=pKACfk~6m74@KTxK((YEREwp4pLeN`FLXKBj%$utskn4WaYWwcc#``B`Q)v|PqR z69c1ulFX8@IzEQ zp`SzSGyAqMG=8eN^>lNI7+`h2#@X-5=F)gisdad@E=bo z$H?6HkHK`QNU#yp`jDGp|2t0o*U6yvwLkD|v0xL6ufXLXpX#Y&z;P(F2+kYa$v*p$ zVdM2?$~9*LdSN{r((f}oPp6vo%B3hZ2aD(W1K#{sI+ZaOnb?^+SB%uTh7U#Qlicaw zjG5mQV<$40rL60wv@JXLKYT!Lu(uMAxukkQ(-cIIr8}DtWs_r(bN;?C>g8~@Cgl*5 zp0@o)y^8V1ZmZMHP+Uyi)^bZk=@b6tmeH-u9TU~O^~|l!>#1_D0fv?g=$BfDeOG31 z9V$WIMdPmP-NA0Oi@XE&}hwc3E414i^b(>Ym<$_Q!T(hSiqiL?MM)a z9z-P@P{+PcC1Z(fQUE(eVY+pm9srT4S|8(fV5w#OzR+TP;;i65Z=Q!HaHpZF0Dq&d zn?(G#yYlT)q_S!ZRjXY~>`Li)DP*(mM5Vv!XTJ3BZ!9B;#LO+%@)p6$@}Ec`fiCmR zm#6OI(5@IA4ZWR``d{`Qo%qH27C(gLby@b`r}RI^2kkkvkgV^sWdQ~TR%{p;5BU;pP{aV_yrT&uR{ zwfMLD{^zs)<-e(zaoN?)lS6EMCD1~lN_qCcn4=>1qc6yHy})wLu&n5r-@a<$bp+~&By`+Xy=l0Nr; zu>iGC&x}cPkIb#yFBiqw^h&=1fQ7tf*{4i%b&H`}=*cD^RsJ(v-T!~xAoAj;X6EATX!TVmM7gDIC3dtw1>p5l-vbj6< zq%iT&DSwLv8ZO#2f=#!8qi0V(9zF2{iP7xas~0>btbas3Q&ds}xUvSnMqAI-%64jY zdERbDvxt!y^f)H*nr-%NAsp{-YYZm-@)G~Afx2oS8@7iXh#zXoQs5oU*Lgr0wRl5= z+OK#HX%AymkW(>)Y>sIuu2gO>(Kp4k8A;f+-jTswJjD#{fUNjg>?^YmK<8?rXXlkP zD$Y>I^G>_2qxPI@ERwR|!~nz2^GsmUjB4}Q&L5N`bO6aHb=u|~yiap;eot5pK$?1z z*hu#lnp9dfigY55H&`UhfN`IIirO%+Vn*#svQzgtcbNj|Yyi{ii7%9Z;!pw_Yy0o# z>#vy9w|RHP**eMnfd*aa63rA5uj|f=X|cU`^U@l z{&5n~KuF3>W24`=Vsj?|pkpk5;@5h=c9=l5#~^#H=hiot%1{E9Zjz9&mmFUmWJ6zM z0jMhCr!*=fBtyn==UhpvEB@;rC4E=cH~co^q2K5fHUOB{!Lq@uUevSv2~VrcJ7t*vf0C?Rt3}O0n3p=Qf5~xR?Qi zJY{s2NR^KDg9yL<`K7!?$^FMZoj$@Z+1@yopJYz_e|X4$yEzH)AIF8^N9^j5fWgtA zSmtvxMR$vWtg~@O9Hoj;DOBIKBlQO_nJ^WRoOzfdp$YU9i4)YTcjY~~*(y3CQ;289 zN*x|SIi%iMDa*rZyvdE9nvh)a$}&i~@aXp+8E{3aN# z30>VXN;NZP0hVV48$;fmI5O&gX zn{fDlZ1z7lZv$964F62oU&tGMw2zU*292d$^qYz@=f1hhJr?2~*p|SM$c^YbQml zNGt@mgV^WsRek>NJ4mQeFQzxA!)nq}6~1%x%~dC)R`vf|3&5>yAWTp7@38Fp^iOqV z%W;cS%BQtX$^)MWkFUMC?qXjn+s~pAEj)PjzQKc;Q)^^2=Knqdi1A6thR3@JxtpaX z{c<*=9=-Vm4C`2U$-EX!3Qye#sKV1Sm=TUoRla`gwN!N z3lej27~1(F>m!sy9jG@Smg)wbWbMi&9^N_@W9C#V0OK{+T(3$^muQj#tBjA0pPlm$ zbggpKZ@1({HQdX20fLe_`J2vLjhlVCxUIIprG#kF?A_nz)3@vOBfs(88cfEIMIzB0 z4upc&_nrEAG#qWu$8^Rm1;L*z7u73cUdfX%a>I{KdVIhl4H_F*Ndi~eKynz9^8?U~ zs%w0`D(R`GPrg&#lsoWoyzv^x#yS@#I2>>;Z$=wWJG?196;tcZ&>Z4hSt#^*{IZ(f z#fxM_OuQD;?-ZbfNcE5du*BjS)3NHMEDa1wNK<177XKEy(#ebXrVLC%I z=4w~A`>>Hr#Ko30s@I#&NQ$e$32oQM;2J|FauL`dfo>+epYeT$46kKZXORP*)4Onx z{qAT5D&KE?hK$lfMZ{TLMe%*Q*}9;;{`K+&PxkN=%J_!k*gv00^>#ibs?Q6ad<)H? zbRk?KzBmc*6^BSA9geAOPZkl7i#wmX(UY^Ar2_g5ViZFv{LNSv0gb068=4Q021=RA zBSbC(0WlW-b>2VUoBHdQ2_M!Ej51{pko_|ECe>&35jpx+1p4T z@O<>;L81k8--VR4fOv-gM=|c}Il6cC+qR9;jV^iDA+0)-ILlXzAxD&8lz0=LU>jfp znB&F(c}*;XjaVoth{9^FRKC%O+4StA#V{}pZ?h+^7c#&=!v@YpqfX_ikA{?Q!fQ9a zrQ8C%5CV275R&!KwNpM571iRFY*psasIMS~3Yjg1Q;E-l-tP|;PmLGd!%0ExW4Tu( zY?|c~;~-F{|B8s)iR!%P)fU;r4Iqx;Cits)E%L)JMcJ#9mp=faLf2>?-~bRoSUbON z0kX=PP)~=|hQ53+nQ4z&Uhb#7($cLJ0GwNsta&rMtXBPotAtfbuhMc}2Iy`Fp<>#l zuzNkV&gs}-7mo?tcaSan(eVD~O7_NrCXEs^E5#6|nH0b1im+k25XW?g_|yJBxO zi(9apc1bP5Y8jfqNT(t5U_XUJDHM!Y273CHYfe`2^frYrqav91z}jczEDr#IZG)R2 zn=b4nQMdd(#|eEhpz`?Dz9TCA3qZoBwL02(xRZ#Y6nDPrc$_Vkz^I;dqmMt`e)q(y zYnS^|7vtUW`JQkoan4mz4Tm3Ocd{f)pU~Lu@@dst-0Z=@Yz>>Ffvn@jzOEUMfG^Yc ztLnlZN|r1A5_9@wuD=x=L_SxcU=V)e*JzZI{T|t1zGh$Rbdt@IjIPPq$tT__O2% z$j>>HYkjt+3?FCOT+jNT?s6VI?1QDdMI*L~vQezAKD>dIV1iFzQ7_Dc77VC%oJ^`x zwO8+$=}3w7c|BWrUiwJ;J}V)sey2v!#I(p~rJi9umnG*2W490vvDrsmW3F#+VoQo_sc>`t zvXnl#PmzA!bgAYivAZd5@MD!$e&p9^zKgi|LM2M7xKAYK9UhKoP*+zS)rTq<57j2I zgU~LbanEs!p|8{Rh-fMy0AG%>UmqY>EH@v|;AgH&rbCa=(KqMGsJ`&Dv1y&*EG0s+HWzQTq9J=U_Eq)b-ONok2L5=ir7%kCjuidhrcdmy87o~ zwq}WSS~;&b2AAvQsRb74HuSVUa1nlI;qG)Ft&!FyRHsxeoG!*pZ}4!If05bgJ&^HM zv3n!=Y=LI9H(;={o3E~xw=?GZjCK`;SNriZ4)&3QjQ|D z@G*x;3I_D6#!{?0sgy^bpCmnmNLR5*)wh?eKoq zR^ow#qfT~x6GB{juAmGYVj9{Jxq0gA%myDGFT%aa#)v;tF$!m#7fWuRZ?XI&76zt) zNj`ywzrZ6v(oJ>|8cG~)TgxKs+2Val%8F0-R`I*5r=P+gO*yseOdRP&K|)Q#A5w-g znJ|5;S-+N(%p2%X@JsZ<>B^TD`my9z6{t}W)gQ^16L32;6D?=UQJfB@CH350dE}fH5pn24PYHJ``VU_V&MadA_FRQlk0o{=@<>c6PHx&C}!9k~V!KY)to8HP_rdbF$ z+^wXLJJ`TkR8}~rixGD}>|zLy4f}G%N9m?%_dyyfIq!pl@71EYGAtwz|EvucA=h5) z0(t3v0+bFc*}`qJo1;JSJFd5#8S}fKrJojmj%xOHkK^;ycrYDF{~i*3~``V z^OjGmdXeL(%xcEu+H#h`e)b2%$b2lD9P1X=)H`hq?@OP=&-CkUay>mn_3ODT$y{aT zH~mt5de+X-{uT>I1oI*7wJHNDhE{4VphO5JN*1>%f=>FSV_S(q$e%uq5ukL~xTTNI z2#@narsNFxG2Ecw;YJmONBcAksZEB8c&JI`Q1K9?ztb#=WFshX=}(8At)P-}_}zn- z=CY;7cylqTdjCmBMsd!-59YDoy-!$?79nl|`p~aos1KAr-=&E!A2(`mIO9_y_t5ui zkCf-dpsn36wzcqH?QrNial1}3;$?J(lfX6XKpi9f%pB`|lCzs*IpSVDejUq!KD~6F zKB*Jf(%N4Zv7*b25purEh>z%>d&&=FZ-bmDbsQ@Nc4zYIz^^26FYQM_hA5Z{I>O$% zSJcjfMX9{@mj)p@_u4k97KFl7+{=&2EaEGyhrz6uREf%|_fM+!>}g7C%PMz-m7Qoq zv~PVSp8g!{;U-$%Gba?!@f3Y8wQstDHCZEqmpg5aQ8;gO=Pmk#|D%?S07M zT!MQE3#i?+u5nR8SHhE}n@}fJxcnzDAXcF%u(}&Qz3fTsGnBq}OhA5&6~I7`;|>_i3gg3}-;tG~K>BTFO!~)zf=yMQAq_(Xvh^eHy^27l%^* z(0{EbV`0-1aXz2(8W>^|^pbf+{2|oj;W}o=8&P*~bIgrNL#w0M_%dS`W*zV-_=b`7 z#^>(pbupZ=uF;Y`%I=xM33Yuv8uFl!)50$xi({wBoU2BT9@&LyYCfZ=3Kt9DOUY48 z4so%kPC6cbV6|^_5?^?K0s0EgYG*}XgLZIxo&^E_y%c-(nu6u*GF-x3EFRjD6d)Cp! ziA)EQ#tsc{+^$a%TXs8BBN;EXms;#?CyL0q*{b0A#U<+fPK2@vb*yAow7j~{ti;M} z=czrdR&R;+S3{nQJWtv1D|_+$ZPG`>w9v_s&(IyA0tn=LNS+T&Ipn2y zBbuc8?=f6)kj<>E74ss-s_j=m)9X8ZaNd59Kj&8ZkbWbf!Te06C7~}K0~L1jGG6@K zpf1e>UCMh!Oe z*p<4wm!$WF<;11L-n-zcP;(n*#*+(AnzMiI;ortzE43f=Yw!?qUW4;msdzn>%Hwc~ zPVN*B=Kz4ep?w2MsOw@1obnQ+v)-pEy54)ZvbRC)t%9~a`3p5weDl^YwxgzMj{~2Gn0Lj0!{Gd_CHA&Fb<_lVb3z&jyC?=a!47nFNu}{Ds zv&@}7Vi0XaY#}xoa4D(Lq(7aSgqQC07Re~0-kk469}(w7k_o+1fJlg(8SD5h00d5_ zGioq%ud5+ffZ*JPqUMR~XAri>vlks4Ky9akUs7zHaC zL=eq)Cnma02gkiJ3y)hR?HE1!X}tV~TZA}E!nX-_5j&B0Fs`DNrRVWJFl(N=Ke>%a zWLu2%!G#zu3ojT`a#2>WFk79}&9?Y$nM54Du8sq^PH+|1pS_v|XSFt|az>(SMcXlAg3oDOa|b!^M_32T_J2^8w6 zGH}tj!bE>CAYDx&Vp(1=5yVGkQ@WNbQ2C*i#0Iyz#Kipb913CWh=abP3+_#=vpe+n z(Wx=`@_g&!F(j0qbtGkbM3g=MK(4{q(ATo9mQO=ZD#e3hcdy54;-zO{7;-)K0uv&P z?4ngDLL7WBZtHx-ed~G?;-r3ay35=;^ZE(&XwoiS%s9-spxbP17akc~KZ=r#l-xPl zo50cQiX0|Xt_zp|v*?MSey^1qhb_k!!N+3oX@A&m5au2cov+vR^Zpz=rpLvgIxCAq zu0BJJrVwhEwq;yIy#Z5MA_%3# ze!~?Jo>*cSnrI4k17CR%ZouF)0pyB4{$tn$Y!7Q&qmyr*;%xf|MgCeZoF3W4lm4Z1 zG>N~iDFCjP_|y~4!$3^PzV1j>-T0v|&3{I?dv}EyPyUnx$ix~*Z!Y3e8C|r*a4%GI69)L__W#QzC6zRMSY0vd(HYGZaUyLMi%lMwM?JP z=(jLG-WQ3beb^2^zh(0acW|}g$rEtFvH&l(M)qY?|0gPg)^E=(pb&D-Y8K1yFQPzu zUkn~WD@Ox%CUx5dTo=D6#so?{jV7*N*m=Msz$wj61-W1oFsgyab=qFMEkH>ScA?4oD1gdfkGiY6y)aq9w(q7IYa` z_UfE_u-3!Gzw!tS)Q7R?W~Z>eUo2e1$sWpv^sapBjtQev?;YO@@Oz)G@Sw?BU|@!^ zZo_9uGa*{o&8YBdwTE_DIkooe)j)qT=nc_H`fk1QN}`=U8qO-g9saTqvQrL_x~w-f4(*XG_93WxEF10f%;9ze4SG~bhERx$=|}6FKi4K?tr7UTQt)(F5P5FG zh;dKt_$S`!2GB~BYGa>q0G*(7R3~Qaq_;PBrN-|M{c+Y~=EcX?k^Y~m%<6R{X81Vd zA(6dXmxoLK+~iGWWg4ZLMDQpeq3#{k3+`1mf_dCl=d^I+bI>n(GF5r#q%}&P7U*Th z*MnQCLmrYrDCbeI@b_sWCyw)GI^0lgxRHb;h4A|*IZ8jeg0ZA<<-RtcF=YX#@2Z^( z9KXzko7@7KLR}Fv42SODjf#58czslW2h$X9G5@EI4G`W`ktT;)b`OUZ79+HHPwH%p z-);`!WloWV$@E>hN{DOb59}@oz-uihk)PHHNpZR#E>Z)+Vxfgf=R|s~XD8Pc7N;HU zOsq0=_`UhVv_ZAYls#d)7h9k&Aj&KMiO{;vx_#?R!KMf1iHqHNrQU=)=@r)!Z;{)= zRle5N-ede_L>I*Wb91NkX0nZG5AWz%{kiV(C#F|cir>iveuy{B+=!Y4q}tjb#1#lf zfT=nwVu2?IRqfqL1|-Mwp?TO#ivdRPdyGyC3T4XL)-{@Pqw z)d%-9b}|xFJ9G_4QTK~XdDU!$s9w%93xP;7esIQ2TXL_2W763P83~_Z@GclD`e;zx zqzq*V@uGxq0Y*)!dT=qH&@V?J>fS|~RPcisksZu{)}!j`@ZEV&Sao8*VH3Y<7(G2I zpYK|cmL-v21wVuw!`o~gXV#ZQ zRi#8SEVT|m^w4f#!R`K{{A(t8A9_**F(b%$^xAiUe81FqX5;u6$$RflsH{7H z84PrA;D5@on{PJXiC6Mf-RAmQBgk-WJ@4=3RQz&RC&~`J?kFkMsK)BrkHg9LjI+cJ z-+8|1L4)@Du{HRHTD&n_T-j?>M~tjZtGZv9-0Ymvr&n~Dvlu1#C5r9Bp^1uUO|j3- z-NUCl+1*mhU2YBv&r5$U=k_6AL-df6Cx9Ib+g=Vu(GliwO^Py=A6)s|$y0jrCf={B z6i8cw_-mjS>%zxqVNSbfl*w#ghpor$Ndqx=h}M*@gD8Q7`VgwJ%7x02e`r0}IGQ=( zQ4ZvCQ3~k-T%AI(5aQz5161$?VwWm-y+0wnG5M@4+%(^RlEi!Vh6z5{wU|Mt@|}J) z_yw^&VUGy1PF*Xr<4_&reE?6aUKheQ$8P{t?}a!#{RPtpQQbOPFt`os{m*lPiF9xI z*kws-@hNHAvdSL_X3;EaX^E2#5ml%^yOUk|@OJ`t zCW>pavyu@0ar82B`Ak_b%QhijSgRW$Hevjv>r)&94eW61+3M~IN^M=haCw~!BAX-q zrzlyEVPFb!zDz@&GE*-9Pw}&_MxbzwezyMQ%3D+U0#MBTo8nrD(aS>M19G{0Ux^?ntV(s z3LwWehz@&zordqdOg6c{Os+?sDz|Is{F*lD@vQk}xO>a=k2gjmAN6rrnF>=>Yxb`F zKu(ZfW~<#r4L98PlWV}Fm-cpXAs9Dd`Q z<3YcTOL&3XHJ1wVY86!kHwpiXk^{pZKl}^ndWZD>+aqKlmgs>Z&NK?{z1D#9q*Qgk zIe)zNIMXdE&uKw@qQGqIKC>A+&YQNjLjY1yEweDt*X zZZ}~(vMc`O(unppSz+&7QWZnujFZ?RhViuNz&IZfMQE1TZckvn5py2LK%~DQ#V9mY z|4-3uWlP|t%G~~RCdjLo5GaSwZEVG0O_mdnX7QP{?g?RrrjQ9=- z8yV(NIM-GnZQDTBfu@-DiGx$FWV!y`RLAL}!b=Xh-`sl}Tel8A4@%?h?a%7l>Lc|Z zF5J6KL4ad`clGON* z3-~|(2wwifXj&%7o%%H#HK9|GTa?Y}O851IglDX3(dniC#LARJ!u+4e6mQ^pI)b;}1`8yBZSix$e8NdL zoLH41^s$_bJ)>?VSscs5w|wPRdt6a>$MpF2&@OuqRb~C&6{VEHHkD5sBzn(0iJRJ3 zl=N574{Fg4F6-G;{DUHxjI#Tdbq@mPKb#DthlbDFebE2Mdfo>}e0wGTL>4aK9Vw{X zNwYGelq7r|hK9ps*!}~+Q&o2-=Q;XSFZ!=z**vg|OK(Pc?!+z=gF9LZ<$1BQ(DOR^i6f=O+D?cH=Gx^mHB?`1_Wbcu_-1u z;ueCBR~6i7n4|W$ji3kB5AGup%3d3WPSpcp3 zMJDKg04AM(2Kr-9H-~9!!naC~Rv3QNxg5M}k&@l~Z@@775*;59j?HTS4Gav`24*7r z%Q;eusb;^GrBeXLE6vs5fnql0)RmH<7`JmRYKy6t3oslT{_3xI_EvARnxPcH9+TAv$$6? zo~>6oO++%7;V*C*U<~~WTsCI7Z~O)j9va)DeOEZTjjKH_idIoo-9EBvzjfK4&9*1dGsMo(G1LLLep&UH z>w__{`D{|wGCfbpWTsw3$aC8|*`{hBM=8`T>*0QtJ^zwjE4)arK?OcYg*V$qWfS2?za_{A#YxhezMq?S!Xd?{F-q*!LA)h?cxBcC$`k=~lqbpohhw9|j zS>DGyW=h1R8P% zfMyv|{(=~>FUHgwcH-3lF8k{-rupS#)OG;Kdpr&IqExLap(bpF+%oF?V!SBRp-vElWYaC}>L3*vZcJd+qM8?p;81qsO+dw)s^AK@BKlaQ-$ZYOcfGE)Uq&RX5Xa79 zL<(ndXyWc!yblozv17(cFdE#~#Yg3TH&=3}UlPCq%wu5FBm?sY$lekGf?^^PCPi}f z-(8a|hL`F7kR(5Bz+EkMIvI|m>`q#*PVg6|97N7-W}5+y@*0~Yk`Ht1p0Lt%dAZA= zby3XX9;#WwdSzs(%{td6Kvax3I%#=wW861YXkw*Yo)3TDil{( ze$GJ;Dwp0i0xHJ*MXxIWfHzYs!p!?0TwYI_p$v8H-x>|{VPF>UC5!yQ`K|(6692E6 zDjRtbS65;&`vMWzI>)CC@I==e`v&uBdfOBic^hD_^Dh&Rqlg_=oY{U zVtt|ht0yjBUgUKYMYg`reY(htsE1{iTGu5c-6hmD6E-cxB^Rw($8i?*F;)v?aS@Lu zgH9$()`$~Rn03|loMyyL)`ca5y z<9}ng6hp}smP!Xr6AJAOeVU~oswf(2L=v`cuN=zn777iQ)~p0cTbJn|G$EL?qOw=D96@Uoi|70ZJ=Bl}J*$@C&%(z37K)=#)+H>=ZGZru8hKm#Py5R0@?NIB^V;fV-o0r zeo?$(f-~&sU+OdG$oXRttUsn}9#i5#ewGHH?HXX&nPWEX`gR4c0WG5YB#NI3CVoVp zS_Oxj6uo)kq!H3N8$mkpe(m>IR2OA3gC91B- z8%vtGwbCD=!1^_&4_D=%ueuK#(&avU@g2F3d8PEW0Z8@Ft+c_B{jZHEqAQ(_THR{l zXZ#0)g0Wxpd8guf&2Hlr6YpJXKc<*0)n4aU{GpVcPF<>i`+5`(d<258&$sD+?oEe{ z-C^!o?wab`H|Vdri@zMX8#$~SbM|gzOK-l@wl)ws!#j)le$;C6RM^#Syd;uAMGKZZ+-f5A&#qE zkSU-Ibn}RY;{J3+5l<5);MtoUA@e5qK^-ZHd(Q)p*`NXqH9u#7e7d&au(oj~xp2jK zq-)84&Hb)wK70HYw#v>eg?#(pu&UX8ea*7VA?$qslxTIMJ;cb6{G>^9L0dT?Xp-2! z7h2!Kjh)dQYsT{gv%N%;%D$)WRgaGW9@=~KWeke0qaSC(KOi(2&o&oc*HafRNsDJc zxw+_e5qajWs!SVUHN%fET@i~e20Kzp^)%z$)FFow^Y|D>=OVG`943gA7pzWGtq~YMAgxH? zTc|t-k{#ufkyEv|-&B}OZWB7w7x~flq1*w=|H0)@+{_mM60xeLiw#(p8^ap9E?OG{1d3cg3_ZD-ecO=LtZhegS! z(X+fmX&V3r#(@~f^Hio&Vv%tB*{}By^nDu-1_@2PU(lN~whVf7v-Znol@6EHq3*xw z2zHOgH;A5edS7RqqJxvh0Ll*Gz38C&xU%j-TrC{DC&o{j9Ddg#C4AZ3vfMu)7_qPp zQ@#iVxGlpQ`pVg|m=D=$7*Ey88WHnw$teM_{lZR<9jTs;w#n>7W(FccKf|!lEbSjrwVvh+ z>T?m+R57m)1zIrr7c$X+=wMANz|b9Zy$oz~EM~JrK{-MydZf*7h>-$03x@71iL7C3 z&;_-P3K%7EQ2aP~$=E#pZo=4{KHF64hwoVU4LvEKS(oK{v=a6M)#uU&(2*+HA7Cx#4<0spuau_c-cG^o)zqJ*YXMF>yNEG*x#Cy-xfERBL3z!Dr2|P7cxQ@Ob zHlS3nCxoJq1>{xT7pghRBb(9E#=k+VUw)6}%HvFxBF6{p14m^aQsMw&ofw*5G?>~h z#8jxA&xUN^>^(-PQ?vfm)$q(J1%EQ>O`9XITxb+6DkT?me6x*g7#w$!wco##dTnD} zX((IA*ABUa8h^yKcTg)@F>sq|O28%;Vnm`9kq~HbxZ#)lT57-fM2@oM)E)d&3S46U zSrq_psaDBE?Sl(1_^azPlniy6?J@VQx5UF_65A#px4hi*7S(3)KpfQfXM(JrUA>-P z3U9R8FN4-RgH4w^fccTezru;a?rlQ~SEW{v1Str2Y%M>nc52kXB>3UaF9cN5Jcal( zi-tJgRpGjG_EXXnQR_*9W!$JSTBw!5immSCh&%@Gqr4sCuO32h7ci^GP72({K?E?@ z=ayWUECfgeGb#^mMtnm2i zBTi9|tlphamm8ZPG*zZ|*IE`O`21BebgL0uD`_3%&0KVV~iXNYL|f;7*~L z-7>?i(9C$+dCiU+i19;H{qJH7nh#Q*YpO)`Nqw5SnoGmNjYRfWh$w*GC;kqAa;RYA zG;fUF|x{PhbdpdejuS9XkuJdCc|l5rykexcS0{vpH1ahbHpLN6n%rvr_0+ekkabE zZ&1nIrsb2!?RKKESnI+m9Oy*fZXn&vCA(xx1m3{4lsi`21tfaj-r`D7lwBH((RdzN zD3ir2C1$&BkD{NL6-P-Y7YRNtx8qR-J3;moY{;?|;lUKr;|V;sM$=VsPU&`{hlo%^ zTS|@ZoEwO_D%}UAW(%n_?vROnNNS^Y)=j(i8_DRI2)gytxj>aVM=DpyG~2jw$LYja z{>PrcHtnUVFUHW@BbhO^Y^{BgT9Jm-` zoC8EQDA;sDmBt|YYl3z2`WxJhK5QdlekWglb@uTQuaJqGfH;uMl8PMmi8xpCrgY_cQ#y?0xD!0?3`CBRb2~G!^|$%7swLa z+^}bhO9nDcH~JG-1j}y-^lt(Yu0h{lm;##ofmAw@dJh7Q#?FIItJg&|D-H!Xw=fw7 zzWI2O&R=bGOwR=1hJ#D^Kjr?@mn)-%lpYQ+6J^8Vt!S($8oI$xE0y!xaWZv!>C!4O}ks_2phS{2>$>ZzbnrA0ZsEpogxD<@Vq~tmG#K4#Y;&DRJT{{>D#O z&2d2iy!zxa{9t)k`^HsrZ~Z(S+3YasX8*Q7m~x35wC*G;WgpUTbx*H?ve0I+inX$p zZ3`1~PcD4-^FiW8KnEFXeR#iZfy@h)t@_hrmQrWq{PhT(CaaQxWrG@{HK}Cw!Z+D({hz_#fEORDnIc?-tPdJ{Na(?lL39XP|!G^{2G$RA1|aO5Ufek{Wx?(F|D*q5&oTym2MV#7X_S<;k^( z!--!upkTyBB4|hijLqe_<=Oy|00ZFPe&=4}VcAQlr*9?GgFdzx^5nBaa@rk=$TYTPikO0#?|YKiTL(p`hW<+frCa8kKNY68_h&WhTP>G#y$;w^8VK0v&X zxKOT|r=7w1nAoai)EW?XSe!O|rw1a$Gk)Lpgd4zyWZGU0Ce)LzwLE2ltu_y2#2vwE zU4N>N9K%+v1lee91wxpL%_fuBHIG-3!}{V2XXMdF@v=pi#S6kXBk&0Qi^uYIa90q$ ziQDS{Eh<1^w>A{Z#(>Gl`gxFz{w)b4TxB;nB5x8VBRyw`s!=x6r)sJY$HY))Y9y+Z zIe)~t9n0?Q#-&#T5|%O zB2$Lo6>M;4@Ifh1h(J!c}td2}m0*{R7df9@?5 zb9mkCJtGlv6gZHIPfOync}qUsB<&A<=0Tr#b9FU5E50$T?{n8rV~EeJ-^dz4BA9Z0 zx;Gd$`c!$U`B5sX=7;UsJX$Pr!s=WWZvQH(bxLrdcEzu^aeCRq>EUZm0@#OsV<@=} z8_jb!@96(iWN!|8{e!saolgBKB@-AyZ-W2^e`Q!wLjs{n7_b#Bu7_4yGc_71DkQiSGo#et%3-NkZ6JNqFVXN3-%w*F@0)F%5K z8R4rEvGJAHQN|m~gRVKcZJ{lPQBV!=_L8sdNbHv5!M&GemDMV&Wf=w0zW#8=06~0f zx;n|{@V6oH)BWK9i$m0j-h7DCJLtA9guUTS;c$bZ^fo`f+nSp{C>aWwv$qMO;UpvnW zfG^l?J;bm`1vR`c45cY{4I-dgE*oL`7qCexBpOcsnCed9XlX}Y;oxVJzSnh{;tIqO z{HWr}Tk)*AL0Tn;*XP#1Rf`8r)k+ti zBx?km%onBw*wSHyyG;1XvZ;BZl+4$af1LL4UXp+gAYh z;X6lnSXdP5DXk^O6OiNLqiuxEBb&(+RBe%k6|owna68+6FUvIkGm8}L^^~49Uhibu zvbv83SHbkGeGx?b?+R965aRK7flmDUUX7IrHdpt7wXFj)xP(BaQ#kkN z;!7Kcb+!x>n~8+lKXq(3lB&78I-2Dtvy|_v8o*`EceombxgRb02}w*rjnf@3=kJh= znD$R5rzoU^^~ml4mXuZ#yRFjFA#0g#P1;7q=Wf;P7O#y!yT=o*?-oIH+&to&1mlP* zDo?RPzu1Z0&PQKqWPj&aG#+;6K(HuV#P6<@ic?8J=g&1SJ%$#4vfB_}z25s(Og|)i ztFZ_ax9ln6kvc*N2pksKv@2`J30t&%%`GKiPBTqv88UW4-8-5<1|Z$~X)rA!^aWF& z|EW6ASW{t9+d0Y<^LaRf?(~GCsdi*{DpR=0X|O~5t8jOXwXU#&JJ4Q~8J#J%L^cb&LcWV%=96A2cuoy~Z0(LDuuO;%k@W zP5JCPXtRthF&nW=s;Zxt;Wk2+FaygWLjv)F#}IiV%VWcH|3h#w^B0ig(Ktj7Eqe-r zYQ%sVh9~j~f)Q8ePcYR`ccDYdS*>5y3%b2dx(Lu2AiX`bCgh(*@cLY2rL5b|1Dq;A zA$_*+b9i1tq8KqQZZneo$25}!==|PvOY-Lq9KBjv3YPW#=*#5^QP%B)$Cyl$#x5jb z*>LvEAaNaNMd8@Dx6WIw0?o|fcpPGQ6!CdMwuX&CM&J#(C<-O-i#mOt#!OL(U5DZ) zE7vENj@wNzq9CW=9Cs&ft2dh2czSmOMG;rue0Jrc5(sc#6q0SDS)p?{J?q`)%7oU{ zXNYDt%|r~d4|;y79=d4TZpM=n(&&|u$%o+I{nnm*BW2gmioGF`q{&Tli~KwHt$5z8 zWqs?s=^Z5q8@`H9o`j?R%k5vjMFckIspg<4po|BIdYn1k{qU_0W*QZC*~<#262fBHV$rA^yN>WC6#f(V1VIdp0)*47<#IyVk?&vM)0K ze!oEH{%m3a?cp!&rT6I)(DS`q>p7t!KQaiO-9SnW4fFD9AEn9rpHxf3hXFe=jcJyi z5%}qs?+;E7Ls3aoaQM&;^1t{(KiDA4J!-#xpGKCwJ|$S^Nt;sac5&7+mta2~*S4J$ zw}|OO=`Ethnr49I$CSl!;<)&IL8&UVbwv2^RPVZUtw7h z&#kn$*lc$(r&O&~VeD+B%n=c!8K1}Ap9mGxtnj=_W!Kd@Hahd!82B0{dN5O^@*yZ# zVA21cJN0^E!KAk)2#fSx!a(Y0M0S5sRgBLqSAusk`Dgbup4Zs_hpe-XimGe-FcJbH zt#l(IE#2LMpdv6dIDm9_cStu#N=gph9Ycq7cL+n*(0s@Dd!Ofd-|t&%{+P9hHRsGe z=j^@j>%M+w)79uTUyHl(E#}Y??t3*j3+=YvRokr54B~a*;UOuMrSY3~K_gg2tGwq>AYA}teu*6^Sp7UT|p5XDDG#8EQxzfxH6)D@6`DIltfVb2Fy>l z8Gi2U3fJm7)O|_=f=`Dx*W2f9UyM4*r3Fa>V&M-@l7ju{LU*UUL&4<{^kiAx)`$8V~eit&1(&bPV><{z*FM;Mj8+n zd*2R|0lg<1qB*u3B0qrm(jXW2C|;=+ zSIZ1Ul+!9{Fx}n^1iKBh>s5Ce4VE3^&P3N>$^L3?tIs z(S!@o;lv=9`?dph8d?qvk%EYe&G|ahLwi2VEM#3S#Ffe?VFJJgv#uhdFXL>OMlBlK zOM>fw!8l&!kY=D8GH6CtzP)KH@5K`wa|&WCM4BOcz(hLZt~l8A+u%Mqwpk|UgiHn@J2Db_9bl1Os(7yf^-0*ZhHDbs+n z-hQWSe_K1(=7;`7GJAyEz^43Ug$g0T)6qVOs$}T%3T#&8j71KVn-EkcUjT#))#o!i zCtA3m9g^;9jKBe=awc2(qgRmw@eI-c7;3K*G}YN1sy9Zcrb@j>LiS4}al3$Ll!lo)i+`+7b;@ zF6DHn_dbtjfH%Z&!$@QD|F~e3frI*mpJF4>=5!#?`91hRuzKU-`RxF~<$?=-;%Hkk z6+=6o&Fpc^WRtq`joY|Xg<|*Qra_mC%TPy8Sdz(VJ9RV6fza*#VxFUhWS1y08f`ZB zWa0FY>xinwen-je(H~m}Cg}E!Xm=#DO$=GSYZS-;>@mYlozTCzyv86jnSc(TPmHz^ z>7J|n&AqrhK@(F9DAvs5c)5RFcIVaZj27X-@C^0jV<|C8;NQpjukX%=7Kg=kfQxO? zV+Ig4gzTJr;(Ebll7tW1LJ<(5bP;d;evj;$1+ae=C@b$biWSkFJS+H)mGxV!vIEsC z0Gk)Mq|Rh(9U37SMInq;as4epZ-cDlrS($d@S2b{EBFc%MnC=xtsZyUgsb^)$Os1= zJ)TA7yU2}+Pe|CxS>(9OH5%$kh2*UhN9qr@BN59qXU5Km)YeDi_M;*U!hPPvKW2x( z*H#60dyan(x<6cy`yaE*XF~_{XkV(#ygm~>Rk#0iLE*|G3_=XI7=8f*6FkqAsB!`g zltFX2S^MUoYIq*hdh^$p4x9|JD}0-q(tLA{AW{2>|I{yij6~>`R7RwI=5N0I3}C0O zy5(a(#2K@=+PCmUYRIRu3Uiy?Icx~_BIvq=PzX0}SP-#gqpzXB!0s@Q6PRV%@|F2m zIXmD3(r6Ci4Gv+9do#9jcaQ&fd08SJd*K@k{XaesfoyQgxw&)>p$ zqwrGi2Ogb*`_>Gpa!f=ZuWL{yjdYkw-hgV$1;uM`1M*;x1KN)@N}b4agYAqQZs_k? z{%eFvVIs=MzQTM#>`E&{pA;z#txM%{KHZ+U__xU6m?4}uqwVoTz39r0P8On3X`C}> z|CqnoufliZ2*(i>M;wUf54$ymwDFo;@fZyy%ijgl2hZ#^i{sOK!yH8>H_m8%c#vY) zeZBp5l1yGGG021yS#W2hf9Z`pP-U2R-W#}g^}Wk{xL2MmR`zDp7~p-vBy^jto`Q86 zPc13)F8NIio4B@D3;B`ulZ+GbC0>|H?LL3=yDd730)_ZLFq5^AG!Mb@Cb8GI7febJ zA+{Ly@QrA9$_n!)gN9zWK~~1wvj<0$&#ZadI)7gP|KijDKg-H!^0qDJVY#8f?=0-y z*CZxwt)m-Kw~;=IE8BrEus)~${jXyXxs8?bcn0{qJjhM3{!4h1!S4H) zF=26zv)Xk+2AK3&mA_!`Y4o`M7JzyK2#-TVyCjE_D}IV~_{GzHwGyzuc~Pp>G+(o; zTej%>#_J9lpeM;00gJ=^T^nV$-!YJ0UB>qolL>Ir#0$%^&eu9t$^Iz+W1-lal+SS5 z8+Bz76Lh{)xP>2ZSBe8(t~{W0c#`k!3;O~M#SaD?3DTi>^!fi%0rb?{ZhS17G|goO zOhnFsz2X_o*Jv|!R&%d*D#XA1+a%HLS78(L<%@x8&bE2A(b;PNm+&Y*zKR8^<%|Pg zUhz<9*I9AvG`VpHP^S6N<)t7o*AKLvbL6er?a#F+?6m_)Tuv5`NuToG4Tob)#P(ol z+XC(ewE>6Ut55tK&4ATaAgah2$Ec2AtxAgB%Qpndw6f`Gg3i+~r|+qZiauN1t0w;L z$3MY%LU3KEohJZ@sAlLcHwO}e$Bp{L6q1jB2pGG z^UqZa)%>SRHHID4(r~=sW#o6>1(VJnGe%sthfE7$!PuErN+~{oUGpCu$grht6Tdq$ zQ)X=5;Ml=}v&qWxQb*ZZ7y#4z01HNyLm}5(ZyJ_6@6HQDzUqkV9))-A%Z;u%=eXLE z_kU4Wpgcowpj7sJ8Y}H4L&wutKTI3+JR6fXV%%u3;%8m_;bOykK#?E?Shejgwha4Y zRnRY+^dE$17ZztEBKgblSfNI~OnN_P;63$2)=^C11^z$--LLC2-_$SU!giq3F`!Fz z9Ca-5;N~KMDM|8NS{WRydXq8F4ILOzEyl3V@yuR&{rO5Y^Gq8ym-rLm}#HTMd zqZu2wM^Mc3<2A{RSWDe8QPwokBleOBzRki?4O{j@^*UF4ePzp;zUpg=u-mK&KEr@p zhzInKpLsRx^Q`+F61J9Hs&nL}k+bQYT=V1VZd65qK`Fy^k5fhvnEcb|f8g?~J#?$A zR<0_a?#dc_M2`>B?$qq@M}S_3=%R~x*g1^t5ljuEs43nQg3k~*HrbM=!Y0Cwby~)DsCrvegWc}lMxBTqQv5vqf4Jk7qep6QV501?K z)5WsITc83Fr^QWGW7cCVpg#6^*qVu@6hf0I@ey+k48-VmJkYdxQsIzd$7M1r*VyYA zE%2TM2wm$0c$_UfvGUinQkVEk+GC`sGwvUh}M#d+5TklkJF?r2@1);=B(U?eflf&nva0kcKIKKA3d!Jf| zNB!GUH|+cgMi^wO40zrbZsPS(t$VTCKHFmY@L`(3aw@+iBuM4~U@WCF!*A1IqUpKn z5HCqw=+4M>gw=9A^_OxT7fuW^=e_ZWdFS6WTkbW+mPKkguV;GoJhsp=?C4Au0gKKO zaJj#~={6;}Q6>|G-VaAXy+uCGa|W1)#2g4X;r_y6!(ZM1bJti8?4DI_Gko%@28~8v zt!BQs+NML#;cOdo5B?zQuybjdB$mvnZgsQTC4SxopP!KIrjx)Q|3e07>43E4z`wCOW9 zxNUt4_^Ep9NYPbf^Qg(>M?4Vf-hpXF=$(-r9~- zxg-0{4YkzA0ujI6ah#k8cORWhD8|p$d(=J!q~^Ds3JBpb#$S!s95UYqSFHynk*aM_ zL)ounwb(k@QnO{FUT;A`!jBM9{(1UmJIlGr=oj=_{1-5-<|GJkf++H5mSTq@zZM*Ns^(vF~QrpiGuFV4Mz9vU2 zT1|=3e=+vuuMiYogWfzRzl#YmI6l9aB)-eiNZ%ewVKF$ibNj-w(($>y5N}sg76I03eRCc_6f~FQ`Q;q;z{81W$ZP$5@swM=ujq-vn z%)%VenA4Yc$26qk1f8$8>QnvsI06c!y8xnniFeEQuxWRt{+h;*2nnMakRJ4LgJ?TR zpg7o)$j9s5D`$@{Vh9P6@aa8_i4hY)D~c&n7}CfzdqXP4)P5Z#zeYM5(fvS4Se5~t z-5qN=(0P=K7J|6apC6n+Y@Mf1{ctE`0Kq}8{@RC3N)Nu|*WUMZ!0^biBV@m%HI_5fonbMR?)c275 zSZb;!6esTF?Vh`2&cFmftJA>d=R23rPteqAMIShVIc!J|rW?|=ApjT3ZMqzr|33ZI z$_c8a@{K!^-}HE zz=i}-F!wkBYS*WW5DYd02t-v(aI!03kh9S@>@nktWn&mYM9(SVz2n|FB`E$)ZztUC zk0;{0h$YAUrGkFC7>-P;Z-&j^WY+J+0 zTdU3ODOhzH-+<+)36jUG!gt4YRu0~~J00Z4bfJbhqve&Z?5;O0a z$~^Hy0=qIACFkRby(tVh;&PU8kJLc;v!NI!OnZM+d^57 zd>5v<+#bJsnMvI1UIo;_(Kow>hE2)*AGLU`KS7)Y!}#tjPy4wJnkX5*j%a^5iGT%T zk!OihwnRzx+Twb(H!6=>*?D&>M6%I)(kAY@P#eym;u5fZ0vJOI8fIiS;L0g1O=+NF z>2ft|f;s{YMJToMgWl#@<54%HVI3tPWj$rmMPO}_>e_L?a;SRCYhu{lgaRS5*D z$1lT{(kZnipM|5fMFk>(ivT7l7)^!eMF008Rs|X|j2kTxhaHH7SI+bnfG%m(dj}sk zTI}LgK>a{LyLC_*HmA^zPv$aXk3X@&NT`aE_YV7S%ocM|lu04-8@=Inq3W&O8yJKkSb(O&u5mn-R_u zyWoeV$p8kSH9scI0wilFSpi>jL!{{<4$RZ>e@AD52NmQR<3$$CBF6k&TCpKWHH$a3 zYc`@PV?5|0cWtarDT9wX5hf=pnXmX|H=P?cQEPZ5-P9e1j}~qN!jpiyWb_xJJ5B% z7lfZ!uCx)&YdJjB^F|pYA{-%U5XxB;gn1oCSClAqR{Ec=uq>TV93H9|QxnBxq0UZTDPNUHQ%wOjm_ zTBvb%ZiB)x?#5|_Au8ru68Mzs9rwJ<2Iz4`ljx@| zqL!!s?4!nu#nbB3eUbW1UH;Ys*gGjy=&eO&qUU42vmVK5V*ha1>}o1#jfa5BROQ$F zFbVjGVvnx;k7cyW;wZ4j&)oEFL1Z^;x4Wlpz&iPSt^G%HO0Q;=L`3jUzx1HIVb$8Q zj_PfB{I=*q@V`w8C}%qlC*;$T-@QyDGl~*oc7K~)}tx@K;7CG5hesj4*LNj=|)yd#X&@T?>Z$hu*d1H0jd&z zA^Aw{6J9V`FK^H9xgDCAL);M8{2EV-YO;E8F2DzZAP$4(1QtDNBGeLf z^dG_?{*Y;&|N21G0MFMI4twJA=!Dv^pUr z&(*@A3UIIDYJq|Ot-Ao31*Md?&1pO$`9_qR(gLJoroL{crnUl$*^B5bUP2{PRT(tU z$uYhw@?sf0Y{sc~Pm8nEW-+uCfk2>OO!EYf>aUlJ7!`-7sDz=akdNeBpFp+3aW-NF z0t+p4wJ(^eCY>Tuah@kVv1S)UFC5QAa!*MQZ>cZP@m^0w$MK&((x8bgOnX z)pEFx6>2T`!=n+^--SrKe85zYz}bgWf&zf> zZ?9>pVhm)m5K7SuTltI6y#_V-M$JwnEDR*<+%A znJb3OL`MN^ld=ejxgSNl^pfy(5j_qo@QfO7XOSMB_r*~)@STG%J#62U+D_%pEtH`R zZ!xJQ0(1E$UWU%)$E&V7<20Z+(L=>-Q=y39Cq!jnDLaG&3YO4!D|Yg%TG5RArS2Mc z{g63D!i7vDgeau{U|@ks!84C$atnX7)aEATvS2hF&*!{XFVLmkfbKEuHMHnj2o4MD z-J@ghB4_!ca6zAEmoDH#=g$OWa2?QL7aAMr8&fmFsLTdGQr;mkYXEg_i`O^h7t8nD zGDAf9Yygx|d+xO(tV3ZC&UDiRakYf7MY{)2)I&cZp$#B^6mm-A+s^Q-VLlL@r}Bw+ zOb4Vu$2s3MCA%&}zL(Vn8__rJe!^ScZfIFLTmXhx2H{bX$ymnMFyXI=(m#}O`2n!h zA6d=%&@?d87Fn+2Ld>xDo{}JR`g^!<_(|W}f>PKS_hAe+d{%!O9wp@s zYObS!h+a@<7Q9HT{5c8?LJIJ(h?8(l=4~^67F~`rj~BUkw?r<;E$7+r@GnT*TYU6r zgnz$;o+2OjP$1@9+`r-ABKBMU8b|-`pb<0oeN*IX64*3LDqVWxz6QD)Hn7nf!++MA zlx${N=X79pM%jCEEF$e6RBbV(B;c@ToZTT2E0 zqotj{Qd!o@C?uK8F^4a6+z-wfM~IYE@H!4iSp&(ST{cumv#ZPs|)uBW?hK1?N&+b_lWG;4OL^w_RCLKs45Zr@F*M<8IVb!&Cb`+_(t zB@4=4Cu2?DRML!RKc7ZOWxwY%&5en{RVDG2ZEj$t6)hn*Set3oK@BY>i2k#2q*t@D zh%dE7P4X%)tnxe8mOcJUQgb3KN{%r!T7V*orEI;OHcDxD%5TwXKR?vkj#Ua&NLs0$mqnuWmn)@7eDQNQEc7Gh>ws5N_?shmz@d(rz{ zT+;DCWhq@L*3C(H|C<2~8N26fX*Cnsg_W+*)bF?l*^H)gf zn~l+nE}7XG;253hGQ$f$kaw@Yd}N74LNt>p}#qFaxQ%nrwZo zoi1C@JIS}U%B_d|PF{T&ocz{j!!1_UN1nsx?hRsxEh%ev3h&zVJ@niI{k877RFe&5(k@zTX4I1vEx!eb%BkvdO9?&({r2HSeH)w` zp0;=C7@^ebxn#d@6r+BGclaLr%9HAh8n}r=Y!A59glo{jw9SXXPLU4?Nao(iGLu{9 zDLxxdqHNhDnD^Xf`%M>fSbQ&|AUA1cY|KWU7v3P~_ks$T1Gx}^ln)K9EaE@+)jv1b zc1d~!_5QJ30QKc>{1lw8lt}%A9ubET%XIT(VQ+6p3Q?KS7svvJ#ZnbyOb%{13co^h zNaD%g#Wo3s>X29=YsZ~Dk+h2W>s~GO9iL%-CrgY|Kmqf==!BhF!zs!&mQomZUbkO|N0{_L~MVt^I+Rp`fIXseZ&8r ztoW=%QIxL|{Bu}RFA-l5cg;?S$Fz5X(8J>X`e@PZ_)@?xXJn0R=KcL_iT24ve#3Et z{%!8>OYi@`5yH>v`<;RTkNx{!{l7O?@;)>&&qs|G zd-3W+qoM}GE5k>7qR(F~#nXRnOTZf(ezbV6!ZaZ3 zD_8-H_e${%;61)sW55&-C34-gb>l+HUv zU$5Mgt$PE4VF^_|mzUp|;Z;M7pNAi^GXuX;>H zqRPuM@Q;SbJ`NcjLfmhd-@n?@qJj>`qONUv)Pk zy$ha4EmV-sKtiRudQ)C|V!ENbO_9T$msYF?!5n*;$mnCMQVe>C7XqEP5 z&tPB6WsWib8I=K?zQFl?CsEVg1mIXd&01a0I^Yc6OzrR@CUsUpW8Rf1k4c>$Kc^1Ge}EY{mfLYQKN9wlsD*Lv3R038Uw>v{kzt^8f1(?QYQ$*nbX zV5euDZmZqbvuxuH(10Yw?|vEH9>E>)%pIxo;GjV9ybj;3ZCgixBD`1liBsY@553X;*+6$_?oIleS1UmKyxS|Zc9UT(zk^ypp^0m+k z{UfdFVzZi=tyIX@RQ8YApG|$ILVNa7zQ)R@RBjortazhq?=ZG#_kcEDvVHuN;r<}~ z*>bt-Q;l}Rx7b(xDt7BvwhhH4LV4YcRN(MUwhw*Ps0%=zLel;11J9hng?jl10|vl} zx7$lAi$%K4ho%7C=eHY(T48fg1yoep%0Qud^PBEMPZ;4aySC((deH!#r(Uf#N@y|o zqC0eBo8;L`FSU2Ob_f8JG-m5ItD1ECl-VW>2ndj_IkH}ErrsIJ;MTBFD!A5%pdJ*R z+o{R}ewC3f1BUR+sqmM@Y?m=qe+IL zB=<=B{uh&?$xY=%667x#TbXS#MZNZuiyzaVNPFd@#JBaG?A8aJ?CyxEUq;)glGt=O zX3}`Az4*Nk(_pQE%}S2GbWr0b>7qomz>}toDu~NxU07^|ieskg=!A;JHxx?aaDc4U=9$ z=m%(c3SHrHFS{|YUfBI!RsZyrHJr~Qa%-C3?zqi+*pp}mdwJJp$!IXu^Q#gndUVFk zzzFSc#V;Zdp(Xs14JE})H^#zUBo7`STw`d8?G4QGxyFUtM(~Cb+?Wjeyb8ytWV6%? zZLwZ&p;sN?M35hC^&Cm)e=gjM_j4q@Wi+qemx~o^^*plYq!D6^uFt=?(5dC>Af?>kR!8d!*l8A-hbwzRL}5; zxb2d|$xhm{4{RlT*e)S6E?rZbG>q-smdoQI9#^qggd;NVwSG34VG;A#l~h|SEho&h zKJhJgY{I(KG4|v~i;$!H+zp%C(fKp8HXMnSp07T71%`Tlp(p{U1{RzZDmkA8)pYD5$dJN_``iJK*B2)9t|MwJJ_l_+gEPx){2Apy(w$vK-GXM zyqhfW&fzu-g=U5Dmvg=qYaW+<0TV{t7C*Xewe5>2cm~*oA(!+w$O_XCAdIVicENT+di(&AQz;U9u7OMz$o_Wr`F$Y4ckdX%l7^Vn6o2jP-1mWWF{W|0)ySj*Uu$ zpR6v2BlZ@R+UbWkm5q2-r|_=$H)H6h#&dD|m5FPL%?ocB5TYT2WJ*h!LJ5>K+g22&j6RvHv1Qt+h9w!qy!D>LxtXh!o?gridjkL$PivV9!e z3LfUz3BC^7ThFIQD?e4WjxfQ)QDR$6pLtg3$|?IzBi(Kl;Z94-P?NC~zlZFDdTUH_ z5$K)%#VOO2_6l`$*UZ;Y$Zf{Gw!xg2oth&SMj#rq;6og?(KQ>B;lmwjo6x$$#okoR z*Gv|grE>-3|JXf|dW{I6!_ff0nEcwn9oVstDRdQCI2}CA+cvN~%{_ru=1PT*R~k>f z153{onqyzz9F*5MT^OXO#uLSYDjU-`Tb9YqN_ zj!RBWBWve-?CiM`evI5^O>Q@Pa3D9;yv~O}-ty~*1(fMRZHP;jtr;c72m#xTI5VL< zn${?R`-t`+ld5h)j%-w4*2BG`XL)N^*HTeJ8}g)Xd(|pw2!c=Rn7NxvBgR)UAOk>XL*MjpM$y5xQgoTuG=ell?Z)wT;}TjLY+slS<3AB zWC22U)JRHEV`Pnx#?|xTMM$`GMV)!|-hAB=8}YI33eLqB)b6etpqV;enLc>~a0w;w zSPBlz*cQQJc>qJPj@m_yI*8a9g$8CCV%WwRMEfC zla(Ij76?v<;*^Z1U-2)c0x58WV_$#t^tm|}x!=~7s_{S|N*mp}XliL!`)Rr0qo%;K zA?iDQ4JBcW=(O#og4<}w5kdy^Cx6U=GV}f7{bmmKkR5XQb{e;H>$SGD_w|_u9xhy1 z>ul(?w2U*&+MNhcoyOyoksG@DB%=~8E5GdN1x&<=X2bdh zVWLpM**Ea{G>X5%;qB2S58`JENBK0q2gxKNBm>;TTo)7ch(0v9;UG6z=VFGaGX^s~ z{P3PrN>2=-)1Qo4dv)NsIls_{&f$3#KO@~cWc2W3L_(Wa^=fX_P!qr0e*RrL zlU32Y)R^v?taEy%%qaJ?bb(OLof_}4fHl}fOcrsYEPZ|eXnT@y*U%j#=l7U(e11>L z=H-#(&OPFNu%`;9+hFC$j&M1ySzPqj{=(K#HIsWcFRI03$%RPkBvv2PB*F}AV9A^l zk2F~g?`3t~5F*;g8C#o=WtA{8qBiIqE!T88k_iDCFOw3P(sUb@KpzD0`FG{UgGr)o z%zBMdfk#;wX6>c$Kvz?$@~e0O~+Sm-o#&GSF zbh_J;*@q1W6NQ_uagno=5~!MAy-VwBb|e`jnotrdy(yVFCOWcN>a|12h@B7~QF#z{ zcS;>aA`>jP&deQ+{&hEIsQ0B)gGLg9Q=^g*7L9?zS899y`&7rVr=Gth zqf0WaJ2Z|%l7*qs@t_3z zQE;=qOy_FU*L(9cVXSoGs+{#DHVmicT@jNhkR7lUD}pQ`7I2F<-Peg!CY(MN?7=)n zL4ghv(L4;y*n=&@$Z5Sg_xAf@BpWZ+SvHD(Gg$9cn+{9TQ>7UkWaj>yn1hIYpa{breUu(IoulYyBqiFNJkCH+@$C(!W5v>seX7fq zDUk+ivOVRO6lY>C&lH}SHSF2n>9w%px)>xZWW9d;UOUb;xudO$b9oLr4+E(Ua zSi@wPgN_TMmMgV~TD~5ME{xVIgoy{yob1ds6&63y#k9%zRz2q`>>5cL^INr7qgPb<_>-5o zgsgWXA>U?s&%CRE#YL1&YAs%*@{L2~1<$9}&TkN{(bm^j?E`v=#1&Z6g5^A2G>7Gt zlATCutUCBMKuK6q80A~+r zL3)bKYi zQ>Md7;J4NT)y2MfVtJZ)?4y?@M!f+w+v=$Ic>~LcG}WgDO>g$4OmGL`olaR>mwhBg^hRf#doTGpDw7Vmve*W0;k>}&Xot6+H$XlggzC$(q-ejw$IZg=5y5_ z$&={Vr^_)I?&lS*+sNlnaHgHMhBNhQ3!8X9fnY_2qI~x6vmHzYa-@kyo2KrL#g#)N3FIcOvsm8bOFW=ybi{PZ zm==L?X9Mf($~yP7si0$*3rA%iC*XMxA85WlZ93$=`tc-YZRW92Ee#sY<^`;oLFA~X z8ox*S3$2*(5r4c8eS4GI9D%>sWNST~K^uHmxGJDD?urUc+GtBQ8gJ$ z7F)%X;4)0C!OkdeMbOjlo=vqfx0u<>vEyWS;;Y=z@{wHKq3|%_&E>)T_Zp6p@TwgT z7FwCe#AVOrnBmmA-X6o0$>G6?Ty)JBbt=7BmFDow#$+33Vj;t1 z5B@W6nfmIzb*6u|-+U052@HM(P;#tH)~wB&;b1oT@Y!!O@BUcFj-)OF>S!yaPz)f)53Q^puu8pD{sYHRN*Z)N_Y1gB%)BmNq7O%?KmJggeFcQoRSi5 zrZo)v_nA+vyzS8CvAP@n92n9M(KhHFe?6>;jN(2Pe07=LSX8WK zgCVc}WC5z-SXDa@Ua;gzpGUPq3z*0@BAtP2)PDnJ34QUUpxu``qqaU83fO)~r&@=7 zzSYh(WiLZk(L*jVB17baU1m+xeTd;a?(S_TQ7c0Ni6NEGU=(2$Es&OkiyF!eY+Ro~ z)t`n^mL;xkn~i$RtFR z*-9$@o=0ZG*6y7~$}rZr2n(8x)hq>N{z4Ecw=n}W9sOU}JMo^OiTP0?NApGbMQ z;QKIUj4&+9`o(@VZ)Db};(x084VN=$7k}|<>0{#Y*|wJBrm2p-{eCho$5AT(c%HlU z#E$plMUw4f0MRpZZV=Dq-dV;ARaUuHXeGXKeBH_@ja#$e(#BY#SggC=+~7?k{neL7 zi+-AxozI-+YuPKQbrzP0zmnZ6yNFJEMt7IVet-RO?^bc}nYZMNK}(pJDOyILk6Ar@ zJ|f;T0w3ma^#k>bbIa5BL*vhhqEz+Vb*z`f?K@}493K_oj!S$H&v4CyV>oy8D4sX$ z`Fjyfj-Vh-AEU@3CQd1F_fE}-E7d0qsb!gd=q*l5NN^vZsaIj*b;Q(rnkq8BEb{;p zf$TPIO;gCS&&F=j^x2NTVt*95sFj!NP&`B2L#Ms=>DD0AVB-CHr9ivXyE00et62Aw z?46qTC5_kb{;C(@IHK*(91#nvN|6=*%9RZ#$`{qXL|?CYiljSu)V>)mLDEtNr;0B9E6ecT2Gg>T4BaNpZQk$lXKSlb<`i8O-q8D$s z%S&1RRR+eLpmGum5f{VSmz*!{&^h+uH9wRPZ$|x^7qq*#j(pfd;QGkKuLcSevZmI5h4&S#;fMX z#Na1MwfDj=q*xZzq9jqoi*Tr^IE;4Oaj zQt$z5q1yInfl^F8qr;a{A)9u|lVGqcDbq*qZGY9M0(HGDgOl$n(yX9*YO#s!_uj}g zxcE~nmMR!?Jz-w4)Lp$qw#2@sXk2>#;&#@I zJEGzgc3(kgqI2j-3;NSeXLv)Xm(tq3=ze%jIMkR>PSo9?t0wNghOLlmu*7QwFVm^C z>#@Up#`WvY#BWttDRC6-O+ZL}vUkQOYD^ODueu-F8DV^hl2;Dv^aARs1Lf5B!=SXY zDMbdA+UC&wa9aVxvD29uH{F=34b;>btSM031T8#6w@uqYvRMXJ~Slb2t`>)FFMsaP$?ghR5(nWjJ*K zOeXITJZTmt3IQftS1NiYXHp7@G>&~uPA2AI$Xl!#Gi)I@D5EBWH{Z@z3FVe39jHva z$Hc2F?}4rSE&mHfhaLY)wa8US=%n%rgC~zsEVD+X;=H}8BZMnF7?kLrX&e4@XTp|254*;UFtvlxXs zzDzYjsIyYA1Uuakp6!}{foSGJ587FC!xf)b>8x*`&mwe0f8~vroI^>yd>!{ew1n^g zF|f`qnbKHT1>0A>c^K8&vEj%WsGbPip%%>Aei-IE&P0_DcBh!)(2;5A_c61 zW8$Sm1;q)l2vXiDqn1QXl+4(4L5E!=Hgv>zdfb5lis^^vmacjSmGfU)1cocbV3m8- zy6M}L$P#e&ok@aXrRJxhEYv83?iuA4?s!clHy#m21?I;N%rw1C5cf34_pQ3Z7YXjf zz+#_1Uuk2=^!X1=r8}EN&u{}uyc_nh(ax+`><71EQhpClFBcLFY%{FZt^U)6fwgWd z*To~+)-u6pCk@N;wrnqY*2`wx3UXl@Mx%6J-1Zw8_se};5IP_*=ucA||H}m+GkiB8 z-_qz9PS?>NSAbZoXb=9tqEY#IMx~H3@EHNubaLRcm+^;7jW^Xp&#w%b|E2?uyK&k% zSa3)pRC5|-qb46ics#}0iVcUqZ-q9D95+T|G+GSrs`z@VV?fTTDDYfj(e|gdkXp6g zj+Q{?^0e5%t}_Mdys{Ycz1KGo!0moG$R;#0bM|vVDI=;8l_KiQK26F)^j9qVI`OR# zl9YJ8v?TJK!#MJp0)lozkV$*uSiUKV)YIu0e^l&f!5i4^T-8_Z`SV`5x9u~_QfAq| zrUA#fcs|J?pDQF>8OCa=fS~cNW+1_rQYwZ@#I4GKi#U5W(^YRY@{9V=Af0aroliUG z73E7jKb0EuB_T%bJ;?@{Q;#>vl(%s>fdoOdLURQ9e8~01MPITd9y=O}A;839P z)0Ik80=G8SN)^@!eEbs=;s}iOz~dh^$})JNu-w}L&Da^2Sse`zKM9UD@&Bzoz(zY(kB+1GEUS(dpw;?N9KAFR2{td_bo|w4zBX;aR`2+uRWRKubhj=fK(>{*CCltwU zcZjJW_IrT;SrNZ4BCvqOB|=uUG~@5b`PVfLFZwIP(2o~iRQ}Nnfo~F}LHhnlBL0ol z&08D2?%*JaV$ryJ2BUX-X516lSbnA`6)k=7PL@vYBRn$P65^t3A)ry7P;NORRc3@u z^1=nUF=r1I%}ClU_iP*;yvrs(jHdf0^h!77(QExPE2~;u8_H-PRf)bs{G{40K-C-0 zxL-DhxLnLm7@d;a@XByOXLwy!K3axr+m!Nokar+UmfmrV%c1Lw0l0Zw$+t8H$X|^9 zk}(M($=~(?93vYj9NckZ|1D^7o1D1?dXs#6H1kU#b4d{V;kR7Hwdm}Z7=|r&&yAnv zE}iVD!-ozc9yw7Z$~C?xCY_9XjT&^i1W8H@Vd?`#5<1l$CuNgxFD*tTH??JV`NDmIn~B{mbx&wmWnbQP3d{1J@>pV^^q>P-EETBy~n}ZL>-@) zy6*{?8GaHZ>?`^X3HucOzfw~$Q~pU!@lSF(L4ywwt?3zGPzfI=|Iq89r8;-))#XL| zjQ(6IcASvZzK?fD`jNnhfJ;;D?v@}bKShYyGi>s6`DqYX_kH9gFOXroP;gB=>a|Eb zIv`VQ&}xU3=}v1Va@mUu9RyU6-%MeSG7e|nLv>LpJ{1Gvn23;=V&0`LqW59jb%NDZ z&+hl4D@S@=pmt-=uzc8R)WRv)WfuLVTLSBg?4n8K?*;6S=K~xaBvU<3j6nHj+x)}0 znnT!?V-cC4SIsT3*rX=mJBEHE8>zEaK{a!Sr~N(`yX{+~FA2(7K-1gZ32Q{Q zVLnG2ihJ)`tesfV4-VrlsMY8GM31KgK>9Maw_WU2H5Eq#aQf*x2YWiW$9dZmq*Q~7~PM~O?OrDj?1!C z&6z)5Ein!ojzy&{9d1lC_a!qrlJEk}s%EvFSQDPBJSZsY2L^`WMQ04LJ{fw}_BLrf~3wH};T(tpkBt^35rMjJa^KYpMzLAw38j~sh5cykGQ>ZpT~?G zJmuGerhfgS|ClYMeY+(Q!C}<(QLM&cgF#|H!z~SiT1**U2&f^4wQu8S91oP5m~o!*5j?0`?zU_Q7Ppr3mmXB=F^q%^=%AN;~yoGUQ-ka0;1YYu; zKO*Q0UL`gK@y9ByOBcY3RD5rYcz=5=RXG10ur6MRmqdeHkjuP}V_ zm6Hz@8V^ZxrbCZL?fu>^b}Qh_zfSYI2zwM5IBPZKE>lPlwgf~>3hG*kbDI{yp)}vK zfDB`xR>FjqV+1zQ1UG!)@XT#L2&OmEq`5_yCeNi$KS@9>2Sg~t3(i{QC!b0`h1p=H z;)oR&Hk};lxT7ExQ(=zMHO{8i)aZxfz}_@psrtQ;X23BL$XYfuk}C+lix24qKgG$| zU1B2=G4!_yth*+JTUpTz!;(4UL45$R-d%c&$?^c+{+fzHr5o;Ye29cMlj)W3->CXl zpjw;N?Znkh6%=7aHcCCjch{&iqp#YU zvFJ*9x>h1RO&gO=XgsL-E_g(0$Y5R{_$_3p%+a0vnL(JOZ)GTvKwl7X z<5h$9G*r1A(&NdugJ)~qj>#7H0Vd$aREs74$ZRYpr4&BdU|BfKKgvXeO~NMvnj)DV zf6{jM4GLlRmX0u>;Ix>0*%nU0TBvfVuc?{q^}IW%ZWN{+3oHQ;KZuONGw#A+nQ2rM zs`-aWO2s=l4y!*#G}+py*KSu~k&c{@-O@`D%-#?5iSJVW08Hk)n!T^MzPyPoC{Cor zc}!@tWj3A}+oUjhuhO>2dN`jA6hLtJy0tv)&9W}GLh62S(5MH)6V*>eWd8%&W_9wr>w;uo0f9liruBsEK?=`av=!Rivmh zq>q&X)-rRh9#c|tTTLFj2ig6=O|mUBU%C4PTmNggk*M}0kLLp&15*1pKeySJwZlub ziuLeTGmoxX0Ut{;&pRDa2m?W^{?Z#2AR|2z6Y#%((KB$1+DpgajQ3ZZE44zSuo zN!d!cPmDKJb4+m@#w)Dm%9vM&Dgw_hjEUG^tN<1c@@Jk;|P=kMXM1lolU7yB*FyUh}KhI8lEJ+=@Puifvc%X4@to}ZWd z;!Tv1{Q^dt{jNwb>&HGf?60z3h!>5QxqQdo9b2TzNVg2^%c1z#pN5QR5N6B~g18pB z$>ytXIQn#;&E1R(wuw*O?hL$Cdhq>#&&>&8=rT|3d7hPz6!HiH8^c4s13ejm+6vGn zHA}C3?!U^7i+!M!g~8x8*6lW)3IG(f28UAKA=nGT&#BbVt5GmV zh>ywnCASfS8GfigUEt=>^V?YD`7ik1ymJ0IspV8i#Cfg07)`bwjy1Nf;ue_)f)Xwf zu4U4D%*NmQaj5i$htppxnqD~J(Ka=yJC1xrQP3`WLU=_s1oJ$*jJmmXz-6Q-yUrBg zc-dqImxvD+U-ZAhbNDHk<0_dK<~mewqC?9lY}o2~gT^%Xu&Bo)z~x~2E%kDskC&(0 zu~`8E4g#NkmjmbUxh$Njz_lOk*mrRj8&BObvPNxxlxhJ0HR$|+lq=FSO_pPCX82VV z7BZb1K)Uv|$0i|$pHgVsJ+cJ(;YM{=+~o_%d+EA!CcPIUl+LDLjrWoY=m(L#VzMh~ zBFV)uvu)hYmACb#BI^*OppqyYOzZ&T(*OnXFB*~*d%A7lH1Es(k^3khq0TLAj zoIBf17TJDg0m!OSbo@_SjEJnFaEKyjzl5MV1U=Y9$Ii!TrFu-$j50jrIP(@S?n&TX zikPxBj1Ve{)hEWBK=R&cwmUOY*<6Ey?t7P+pvb^DH_dzYothjA2Q@#n5E}D?3w$Em z_kdQfZD^tRQPmHZT=3!NT>X}T${&W36OIxTwu!#3t7lZ5;^#anXNfZMGDFHnru-gr zFUI{xhLg0fw}6IZDCyusX<4hA3sKtYAgUUwy3sbqs5KDReoSjB;TN^= zkJXFLj#ce0q9WcjQ-j{y<6S`3P(!5ic!Ah}M4x(6S}&za{;Mm*y8(zWYMNKreODzG z#FKXuFd>Ea^eMW4kKi<1!lXB@m#m!b`8bIi$AHPJjqQc zAsT{Qo}sj+T2HpxkI`#vFnFOI*@tdYQKW)yqU@ykR`!`KBz~@$z#K&#-JC=JLd2Se zg5ujP*%H3i8W%_{_J|73UC^;+{+{ZsBDP1~vm4t^6!N3Uh%W|=3O}MNTE*c;?q+zWnC)`YghrDHtZsL>u=VHx>jwG)BWEVZ znv3{}npK@jN?d|reUH_kk2F?Aj0!Sdu8b1%NHFl@@L5DW)p?9 zD_X~Me1!S4f$cx~NYsmTf^H-f){&BVwE|)JNjy<_CA79F?Fqz;23O83vLAVa6|21 zOt6-tjKu2nCoUBbZoH);OG3u{R%hmDUOoNkE>wP{bFIM3@8QF|$XG(wom8ldUI3=5 z74no2;0^t$7yyLd#B0OkB>%I~-mDihepCwY`3M)WhE!FmXO?gZkJ9#YMs|a*oby#i z0zb8PH1gTd-n%YWNAs#HP9%jNeuB=<3@(!*fcSg^M9P(oI?)30bOhi#p1K*zNOwp&&MC zH<+P}jhe%dH^M(!ypa#K};81o>$pt{gXztUP=U2E*qAB(*)YPwV9QUQKXa7K~@eus~RP4{wxVc*$%*`84-tSe~xQMw4Zo?XAi4vj=fK_rBQ)M zHrA6BNBb;8a78y9!{%=ZrNsb-fC8sP-QV8FYDYRxlj~-_ZK1hmFla}vRc{xd{;Vwy zu+v1NW+j$0`Gvd@xrn=%=0hu{mo9t}jb}I|==oBgtF*qa;NF~4M;)4R`_OMHhr*$K zi`N9QcU!HnZA3`0S2mpqUf;N_ZyRCH!MuRHAu2?D=GmXW(a^@dS&Nm-$+JLiF5Pgf zFQsMg;Fr(A=}9tjmOogrO@z*Giu|UN=&k^XL?iOo0n)_A<+V8*X%*o=?_gy34GIq2 z{RbS(w6_XrA!HRJl5J=Mfd{8v${~W*rq`?_(G!;+lAouEM({lvb+&MPWL{A?8jW(T z;}pSVsW7YA7>7oHjJ(CXZd#EgMpIGWF+(cZONduXQHDy|Zguw?wVXQUxIxajylcaH zuACzE8g)kBhf>beYA_;qU-hP1Lqkif$VSXw_{I{S-gxaWQI5!q^YZTcPXYJ2n>5-7 zq-90Ht2DJ49CN#I#dNTEL_Q|$uDakA)x5~HvQsaAxr#MXDX?goQ{Q;; z(XGmw?MY>-*K(q+vgdQlvfGdTQ+>Vo!oeIF?(+kE^N`bE{Jzu_Pgt;K7<*7h%i;dX z5W_vyZfc~1sb|izo|NI_mdG9XB>Y*wE5BKqJlDQhi?N7%)8=8GlE%eUSxv8!u5O%TlMnt;#6{Fv%dVoI`8X>vRZ>hX-^VwOWJ(%?$h3Up?33< z_q5x+tAn{OZ^VXcxpjarlAZM+uA(Y;@SW4gbXXeU#Upa1x2&33dF7VFJ&Fe~PdNk9 zM4Mu<*@9oi?0oVgYxR^@ks^b+di7~Zczf9BqPR%kqp~H*?V8`VAJ4O;j-ol8+UK5x z9bWdQVz&wcCa*~|Lm5fXEDLsq~2@r(@!b; zhUQRm49K!~hCMM-&q)N;NQR3an8>9aI*`zYix`$q@@^zjJ<_}2f&`%?>6XSlvZblc zyD3ORL;a>BJA_c6<}v+9#bdTLc5C#}irKR?*>6P1OE=i$H$*9^-~srH?HZmVUi*Z7 zA&-WF-cQ0WHAblS)(W+nIVPsl$ssd?ilmlf=hJtxtV>3+8%M3fo>}{HE~7G&vuRKKC)>MpYY8__Y0$DSWIw zDkd(5GRWx@MgbW8WbKIn#crF6mv>C*BZQd*tcCOT=tf+-!t#cXw^*9Xo&e43n%@Myf?1fyoo-fZ zB-&jUJYHMoZwLuuCgGRpY_EF?1~1o?s-m0T6yKV_DXJR|c)qQw`$DS$DtpV6aP9NG z@wuWfl~f_^TdT=Juo)8P>2crcIVoLHFSO|CRw**<7_IaZ+q+CBHFueGsEYMWBOEDo zE(m_QRIG*lRMpvV67+u4E|q@7q+>8KD!}*cIaaynrsi=fawZah?)BD<&c|E-{YXup zF1;MIKK-P4?yxQFN3p;Hhs+Bq+8~wm@n?CGkzn@Da=CgrE3<5dk7>>dtjzzZpMG|; zMy58{-={{VMJXou4=o}|_4K9=Yj3kXYW?1lub<{6T*kd1`RotP@fP`uI2hxKpL&I< z*?*9z-?j1od@z#_-1BQsLxa_Le5Ku5xoR_ly^|2y~=pI6{Fi7?*y+$X;3 z3{(K=zpfYwml>5#Pr`D%V-r)cQk;kD-fgC`ta7!og4NQX39%pNnBZ~Th5EE!FYOw=hX2) z3LhB?_OEiQLAlF|qee7d_b6z}dF>ZJya>eZu5oPa62R|)B2yQ=Da{002o7+&h3hkv zbTvy|iHh^|L2Nv*nGZ-PyWJnFb-FS81?hqQJQ9R+QmJ*-M(u|wWhPtNg^YU`-2p3H zlzpXM7jB@e7i!oQ^E#D9p_Pm+f5aE`1h?1n%RN^K09Ud4Vrlqjeh40m$Bt_4{Phh= zhYwojLC>MoyUCtQU9qwC?pIM@hGmwd@%@5BJKj2JAh8-wUZCEU1Qbh_e!#A{A!qE< z^I+h}ZTq@ERUo<2s1T#z>UKAl-e;RR5xdQGUbTATqRBefK{B?>c}zPc(5C){+Y+AY z;pIV9mVCU*NM4C)cAe|4ef9wB)8M_rn*>Z60|$%inX!6#YFeltK(7!kY^9ci+Dku=c~h? zYhNZjmf}7?tVKZCVi_zoBbg&{QTZI#s6aOm+u+dR2K8Z&&PJO#-=<-=@0n>!pCa0m z`BGh%O;2nlQSH`-O!2q-BtN}7FzP{FFdQxzRwy&HWzcE(*y%i*=DmclUY1JXvnF<4 zK``=D2spi58_8#x@j9ySN!ZEmRLy%OO#FD(^W=qCA0Rx`5$04=HAjzW^x8s+U#2>& z4s;5tQ$|&t1G!inSliwEriz9WhZ}YqYrsRXE>kaW4X>5wSp3*d z24+tRChQx#y+dw#wIp?kFQ+Vk-D`cCjK532MtgzYm8SSK-I1e_tp+7!P{G?SnLGe z#f^srN<}JPgF@MrA&4V6okV`u_vgn8G|}GQ(l5n>$au{{$@pDfG3Gb%xF3>LY@W$` zEEOv(8S%R9C)^=>+B$SlcDs~8sU*G7(l~cRo}eOKGHIV7J~nORgZUGQ@O4o2NMa!D zB3ASWHUrn2EG$Ae8r3!4WP1JBFE-;rR?SLjV}CS#)nZ?)42XtRUtMLUdB>@+XyjFx zYF0?UWWypIidQKb?`nP#NT&jY><&W{#XGd>T!Qm&!zM1yupN|Lk2`P|#_NBse2wB$ zX6*dP8w~}&X=m6^VWS0;uKpd}&q>}O2*GEHi(hD$mt?z$9GsH21#X8Niv6hO?YOk> zqzaT6R-coHpR3{j*;V-&kcp0$sP_$d9dAy9jyJ%jd(cRYsKb<6PTdqSVu=)QCi=0> zyurhD>B|XbTg?rE+c*tT^zv3vwAafY-s?H};GR*bt8b2!RCa%OUXOcc?p}(}RAFfj z_1c#!U}P>c0#$p>EV>&@xgnk!$2hR0Fn3pEGLX`fER(_A3cGCS z-CA|E`J@llU)h+#y2}Nykp{2JqxUF%bPAMszT> zq;0^AHRJIq$KlP)2!!(s<6};At7=f=uWH^Kltq z2eR0|kZaa%m{uj*7?bbCQX=j;A*KhR0mql_7ojqHaBM-lB0A&cy_MF;{WG1_V4 znY57>;b*na4^O`hYZ><@vCQ-&v%$5|O8Qq%<5l=_SXW9$_T#`}Gi4^g_j9D)PL=(aQU}1 z3onQ;&bA~3-@QV?Z1n5l1^v4l6!KGqb;(bR{lEypsFKsg}fJ&Ny|@oUMH! zPF)}_Y6{miND;Hn2Y2(xa|Pyc)e_NMHk*;_dmAvLLCBaA$c5;#U)-W?!nk32YZSM6 z5JyT>Ur9pX+CdpWH_r`QyBxw6-tQN@icu|8egYdXcVv;s`Zl!Gf07XR-?Lmq=EgiV zQoRcvE?d5{UzI_I0Dbr00SP}Z@=w-_4`+73OXS`&6$^agiR34sieJhupC~Y$5vOWx zw9x#p1%F)H=IHBAZmOF!36EL2IU_|hZOsT}Yxx5bM|jfhcg^a7kNkv~r)nL!CRAL# zb&gDx%tUjn2H=rd@@ai&W{}UN#=UDf@4MrRJFv8F;YQL&f(=Tk6y!_Pp(1s4_DA8S zRSfHgsIY+snnx|lZo_NCZ6r7ZKCr8rz6X=>8$FW+M`xBGzA)PV8R?tXpSK0du#7F+ zFwF$s+qaO{n?|>_k(0v=$e)$tId{t+MYCu$h^&niS<<|FabFz65~y1D1pd2Y_|xBn zM%>9@H;-fHP|(WVq5PhMy)KyEoy!lQpyTiFtobKc1{bM!00l*9C#cVUK>Z?6DnIH0 zXnClL4C`Q0g#Q4k?0^xz_B{@Ja-u(q-CMmEW0J9$*tA*yFTc|^B2XS_e$PI7JD z{~8Yz&9?Kckpk{Ve5pLsW9kiIFs* zFeymir@FWIU)AirhZqgCF<+fg%uj;eC5Ihf(A;(mNkMz`<&#UH(Xx0NIW z_~I)cZ9LPnvU3^1Uv4Ww`n65?Jd$Zrr!fS0?QS+Jahd1Y-4>*I15o3Hq7p8^by{9A zLzpKMf9p!lcT1UG-c5%OC_y7>V*PWhbT*d$mED*iH8d2yHmqY4RVSj1?Rb-t_B-GM z>F)L;v{{MPe{^ViQ(N*FVK_e#AxwQTk>4p#d;Y@p=j5-`<=bB9-pkO)KT$cwGoa|K z2W`xVat$J;zLqurNu!03=H%Xj9yHGsR3!h(uK!81e_gx|0V!GD@JyZhUm4P08z8W= zM037oT*(>!6>$Dzb9sH?lP3nGT|;Zu+AM!g;6Dk@uVlyn8Avkc!ej9Nw=!;s24s+C z2Ry}bf1dAOYX~H?Dd2W(B)TyEccyBF3$nYm%LeByZ6b5szb3<_3~l@Dd-QNx9m$_( z-448QE&StMtadz$Yk5uaPd)@5N&?tiWooDGz5nxNR1b0e!JSG%cQg&(+`8uYGPz zWq%T3+avk=_y08%R7ltQKOs0Y>3@zDfFf#S0$;GT2jfY=9~wM;Yl#2Pmqc*ggmoT6 zoGD5FatG799{-oeqEwIDfb~ge#lLvROJp46{!{JNg96H{%SHS@vnxaejtg=$7Hrr5 zH;mIrDWKcT@@KSz7_VW3(%hX8fxknLrdvqoUi)uR{*q`?6FwTpKB)V@t+|N8~_b=TstsmqT4d+j1$uR38} zwg3GB{PI)#BrU(k_h(Y6ZXhuz=G;Fw`Lpb;1q1+Md0x?$`&`)BF)7D3M1) zU^5P`3p41Z!SaEW>Pzkaq_%c6l8%qk|N34$$*GL``ss1T&_YRgUy6qlk&GpMJ^V9G zKpd)oM4eVgYx;t6)Hv*F@kPGcXSb4N9`*Y=EtqJ?06Q7t!4i}{Exj|>Cw_YYt`G6#x zUCBf?i8G&Bb2|)iRi3YyC5woQ67+6(HGGtXFP+RC_A>1!PEOB{}!yRnALOS5`97wm>d6O{|sM*E$7z*^7K7g@h`yFxx*~E8RQ5ECv}%1V zTZ1>&%g)BlhYhbTZ-GilD+YkrIIK>-es`CgRin!C$-!b@iVTOLBpaAto-NzwaLF{# zC>j)@KP)i>GPe>Ts7F3%sJE7%+vDy|8~Qlck&s1Q35XIIKq&qskh*oQOc6-Y#yq>4!45*05M*yk8>9pxXI@#+^{4D$nrco)-l-kUHQ*JTFMtzr%K>?D) zWyuT@$0+a16V>8_ck2^XIvgflbnp?!Mi`HgenEm#iSAACKE-IeEAZMa=1nTv-bFvL z*|1&s8jXS9#dLOu@i3LMoysZ+@yuI}Ri{D!@PT~l%T#w*f@Y0F=VBn@)OEr(_p+sQ zCCy!~%&41&Fb3315rPLO%+aPde&}}@oNMW^5Jpm_+g!Cf<9$Uu4LS^RFHl*1gzuhh zc_%M8uDzhQGU!W=8)n~#1l$jydhd4B&c71UIj2sFi?+Lz z=UR-FNxPDVm@4GPwW#+4!KY^6lQjs7P6Jd|E@hz9=pd2F&+^u0zd((1tUSH9@sIJl ziMcodeKfv`Zb?25*0lzn`kA!Vq@0s z>~P~%FQ)w7z^Zz0=gF@Of+pccgUn)2tRe3Z|!|QzK>B+{?OxQ6>BrcKyfumv@ z;TZsWItJzGhZlsA2A}lvvn&XnNDk!6v!N^LnoUE4$poBwf)s`e8;vRMP(A;uz_Xz2 z77lvQ7Q!KIK{hzKBs^Amz8acim6o-|7I@X(grXVsJ} zGwx+HQEugTT#I?168Lh0e}wH*b}^FSx25cFO7wMv}#UYLx0{nDHL9!Xx@o^kKf&0 zI9!mQeo}~A@bMH|grv1niE&Zb|LkbSPkeE&ji_h6^B%GHrK{9qYIs2nXr|=wiradc z#%7rOX-T8ffRk3eoAOyjuqPq1n#a zLWE$VUFs#jDm0-~JLSm{0w<7tbiCY>Mewp*^70hHHfoDjpZx0;4TZlUBu+WSrQt;0 z{Ql`(VV;}v?sE4h)-y{K14gwn6S{A%bEevEWo-^zAAd1-IL*lFRc84!uTNJ^q)--Q z-)_+q?q5cnJ@R^c@8Y~Wjw?h-bqCjV+O05-?q$L&ZmaRd9~|#P!(CiH{0X=~@ZBKV zhU!%pF_kUw9IG#eH~K{65wv?yweoHtB!eye^n_LOmjAAy0- z{L?IX%=GM5{7RNo+C2!uRXR}_%`g3@)d5PkY_}U;oOj6`%OQ9o?$kXwX{t2O!~CJV zotmCRP{XG+f|>(Fz$9KJjHEnPp*_h}O_2Jzx{?om_;mi-SrA6eyF^br(6S(ScI&90 zdS3h()#-oIUVkC1voLpO#Cw7MCC3<*FCY7%lIlENurkDJ9Ibw-I~E@*_H@~=^dS>e zmSgRJ+iGAkD9?q;-v&UcRZ*f}8z-ynq>8H6lAM@NPfYM%X%M}}T|ioRbGlEw+go>% z0|O1Wq}=iQb;nlZeVc-9PeygTlh;9W^A9s#XD`GfPMYe9mGXUwpB1VWN0NVas)|tHEXe70-%9?oi+HwKLL*azuE= z5)N4s!7_1_k)&|wi^?4l+zXp`Fl#{*KQv9fIduz`uDd*{kh13YIOrqq{)LmB$R{mb zQSF#N%-OGW;ySx^BEc=Mmu9KfHAOSeySp)g(aHl640tH~qq)Y-bTCJ`YJsXs1+v+U z^iA4a3EAfd(HrScuyUMZs-dw#tBRQY7>}huF&gIEOl#wTTaBagMO9Xv06XQdYS=sw zUSuxRx5$;#n!>K0PW$G#tv%qlKZ!TlLCxP>&l>w+nu9MjpS8}y z71TznEk>Zh&xM@g)jk`Oc8l5g5}6iB1Y?w5K0F1qpD66~VoGQm4?;CQHA&s4FYuC1 zlgD4uopZ%tZNz$MYvM@D-~pzLY!5D4Dy28abouvstd7rK7uKxQV;9Hyio)g=UzEvJ zq7VHK?w2;?)NWh#FPM_XH9!V&tqyF?+V~1VfbA6Af5?%sYT)i_bsY;geWKDOB&l^o zWD=bF`Eh-!aYLq)j`@tt7yb=1WYgR+~Tz?%5p>B+Vahmnlf**9Lcp=C6z0SLR9voGzL zwPpalT$07eBm#!bda%ZW@tVsQ)`W7FpkC!F<9>8$K7iB<-^VCMMtt8m8ZFr`yt1G_{Mr-8)%x(5`N}AuZYr}{{fX0)_ScmD1Jooh zI|RUy*#{RV<>7I3d?6Hfq_nQpILEW(FocX(R!jG(kxGv872-a`LWC|92q~roS9v!~ zAZq&cB8WLW;Ww$n6?eRc({H|^KYi2M0WA6z3hQkU@6dqAT`=K_XaLO8QdL@^%s=9>3Wj-=XjK)TEj)# zWeRm0z370sgx0tKSV2Rq?Jx&8eON_lGHz0pu_DE-N zZG8ZhQQa6WFfMu#Bm627RL|aKvL0SQIHuLie!(J~mpa{F4SnR#MQT0*wR%r8&jFpm z=|JvOy_6=IyyeU2|2in%dGkxzhR@SCjMY~FLJp~imYOVS)HK6Ebl*{ zjXe;P&R;hSCSVlH3Xoo%d8jZJJ)obzKK7Z-p!?9+D$e+XO2D| z)vb8+yXqWWZti_tsonCn8KyfS|3V7A`8}|(7^Xks65<7_bcjsPoy?lzEl7@U$9YLc zCWx6$wgzt%oVlSRo^;76;$k5jzNp`)p0PYwM2S2SvuE+T~*5(;lNR-woU#tJxv!%^^+R(`g=~E&=t!>PyEENyn^@E zUftQk@a{GrKCE!c#m`pwjM8dK+DplYD}l)cZtMT!Jr%d*czLDQ9N+ZegM)_c%IJw} zbmGG}06Zzt!X9wVPU1MGv{8E1X?(h}p1q=c_}5zuAV;ycaiJLJ4-xWKM}N_bHl znf*lF&+k0_dk!x2mVWp8nEgG78_VSZ&*zU_@oZ^ox~@gJZKku~J&8|bt}Z>5TA%5? z4%Hz!k?wHBYH`H;BGq_#D|=!=%czI6I58b=+^bH^`GZjDHmn?td7yA~aCcaBkn^|) zq1PQj{!ETyYee~BD5bflI*?-cc6@sye|dhAWiiHquK5{h0^@bX%3%FsDNGA0ho*qz zf@4XtA?gd^H15$DsFWoQF|5;~m1`_ev4(VWRHL)5;SWa@83Z~#gg29WPS>HRkZX3f zgi-F!Q3$U39rdhXEs%!WW^s$$I6vQG%QosJsC1$pVH15E1xgR4P4G9u^SG#yCY!qO zS=+yV&D_AGfl$w4XC~L8T|IN=zIJ>5}1)>Y{B3EgGZQD+*pfw2G-;!bZ>r zGK#F&38~4#i88)-Dku24+ot_U7o4ct`Y>I8mjBGdq#6M`U5*Q@q%FZ*9u~5c0U2MG z-=RU{Z3dB{RiP^9^3_T{NR_>K>q%IRM5v3@xT&YSz;Fxlyw1UMx06`a*RsC%P07v< z5o`jfKUt&c>#dQPnS*n^P7{Ztht6o4zq0_%R#7 zLm>}~8CVgE<@Xn#uEQ zuZV6IHVpnytW9z;@h=RS;RV%z30I9w?j7fmBylvVgwD1w^wHZdX{QW${tI9?$={gQ zd*p)~@MY)k_g|Q@$yMg9k51o2hDkf#iyO`IIAIC@2K)X%;8dI-;K~?#{F~JL z^FP0q+x3rBxF8sKh;%RHZxHnVT>C!+;4dfX^8fkgzkj6j1(buRkUs8TOX((sSeuq-uDxZ zfpz*n3`^@Z=G;!BrXdkQE<57N|JPUzFy8cfE?r35?e&M*6?%h2{KABto*g-yj933_ zCWp9Gjl=3adyMWsk1Lc!cLP%#Ep&75b<#TBv%f70aALsSr9+~ea454*^!QABApeVc zpxVGmuXPwFmO1qQD;W4^UVdHlVSxEFL3zgZTVeBO1Nc2Erh$M3k#B(*_kC1@KU^@q z(aHGFEcclrfsQF3DV}rx6>rD|gF96GLXYIbuBeow2o1>ngQPZ9%ij>*o?M}Usd{ck z(7XTs67aQB)I!dyS>G@e2na&|>Z2lrWQ%-!@+kaoR$|tJS}1boz643*kAG?ST5)Gr zK0PIv`~&0r>;-_E*)z%-lm9b|{~{i4-jk#T#F`=+bKxI%iT}H>{{Q<|B$0eT@2>|L z4qf+Uu`DGMQ%hCuJ>@~W&kT9B-TrT-W-u5ucJ`P){lp3DLfWNn9VY^f4{mHJK(#kC z@w74&xla#Cxj^#)0L)}cDKwp@D(qUYMkSz))-x+hnIZ2*ncJ^(W`-BKKR*a_EC%>6 zDDs;BJ!X>j;QhKDd=bLgGc$;lqp_En_BH4yCRzEdHuzq2I#l(rJZQA767c0;I*1}1SNdp z93ICXT-xDyX+qUyMzXqOf^+2EH)MFQ1uqt9oB2J;yJ>;sX!DrnR)sDR$tt#vzhuKi~HN$e>oK>_Mq3n_H%-PDM|_S+6S^_q^`U?kp=m)4AsjF^Un__tnEg%4itAe zpvho6NAp1i=pgY-UwNZ3HYd7*Z{R=M!LRN9xzE!Brc2w+>>D@XsFl{E;-^QHkGwAq z;1b#`q@zIRj)yR6V zu3=?5od%CxL~+HfHYCV|vgnMpKlU_=MLswQi+;JGBMKBvH965h$|$I9dls5687 z^Mj)q7^8dO(iblEyQ7d2U7z*IY8l-yXXT}?IPZlpp1kAO;h8|)B`v^qz*I)NFt_@$2nse6cw~bf797l;DiKar`rMEDw9c_m{zhM#U|LOK zeEb8MxV&T6`r(aUY#uLNl~R4Niu2HW@cOGVmr{#~%BgYO@I?IWx^;z1oUENdSH-1* z!kCsY#)fmN>~A`uZ2oCn<|AF1VuEM=?_wz@HzKQCcC5QBQv|U|A?BDOZ-c!Q@7eeSRRLLXb?G=32k78z5C;}uK6D{QY=zTb z-x*f>256^I7U1rqR*6L`=SMT%tTONMYg@<5j1Sb+${g~&d(Kh#Nq?#qC2=k0r`GdJ zELd9&lv!aUh&Pm4LLJWfol?`Ex4Vy#`j78QqF$J4&mZ)1k4=L_!eRF=pE6h2;_ z0+iq4w~UrcbFo!^UYFT)rG|ni+hhUv@MTK7;c)?tinZY=jjacvJEvHr=dM5CKQlv+ z`_cJ%yara8l&DFaXsGI3{?BPK?FPMVxpDp zXhwC1%e0sk`PVR*jI!O3P3DfPbKOfo3&vxudt4mqc3{MyUY=*zA1A9`7f{8Bd0ky#*FJ|G%!jlr z9+w(0)@d@zCUZto60$0dcJM#EEA0QH!oA93ra_B4uLHN>yutH~4vh6OK`NJqiqA1J zk4cd88;!hu$rU+{rD%C0Kr*7gpY+(1Rj6|*uR9rmySU=i0P2JJnbUg7^X4yWo3)!U z7iaoeuRonFCKV_z0Uq!1_q9~_O_hhT>zFYGd24Z=$(rs{Ty~#17;`dp0V0~EHNnko z45&X2pUqDCv{xDB?|W0g9xZv{cJR`}FX5im`TP5<%<+sbJoNmwKU+% zwZ=f^iJ#r;NScR28LUAev=VnzBcFxDJkr+OOGfvv_P$hO8*^Z-f9jEU{@6TxePl#s#Jy!$ zl>OTFEikme08-K|IfRJP4FUqv-65frbV-AhfOJU-NDb26-QC^YUC+t2*1F_c&wan| z`|aH}KFo(1=A1MBaqRp4J2Luk6!G`mzdU(uv7!4WV_C7T$;g@ibBU9aKz;VIwi{H9 zy|%sJ`)B%&*{o%Bhb2h;)znm=6CmYUb-FD2UI}17lq=WJE?fGwapm$4j@S#u9gJ>w%LG0q&yu+_C8GySMzxfGzEAgy09r;} zUdHG&X%Alu%TIVEOS=|uS&_BbQZ4>;Q$D_th=PK`{w%$pAZLI)B~nH|bjD(hz-z-^6H3u}?l#tV#Z$7LDy#BwSv z90n5JUY$nMgzR%NGy=#UR82+Ncky{%ll++7!VTUp2FmxJRG)mLCuzJw(>H;FVodUm z5rV38b1G2uz|U%x6JH==_8{wlSD7m_vR_&bc8Qb|6`I5VHab?F4{eByz{k5uAC38n+lZ`gEv-ynrEUeyB4{INsTJib=oZ-7N$L!L; z>yzf(88>D3NWX7*f^{ZmasW@7cbX5Tz!f2`FT06+=JCp zpORoO1pJy6q5{~5sr}I01aX-)sha)jKU@P#o03Ynpc=MJsoa3GFD2&VgNz5dbeE0S z`;us-(TQ)4xv_l_F-XjM8u4NHbt?%!7;VSPXUQ<(yfCSl{jncQODSH*m@ZyVuPXZ# z_stw=n@hFeOrd*e)ft04gy1+{O@b?&iO!aKXrgHf*Q+SO1U#Fon6pzqevo-p)Skk! z-Df>ja9A}*m1li_=i;k|*Bi$!+g5WKU5Y&>g4A=g=ueu^%?7H&q|{*>#D%YNaM5Jp z)OK-`ZZYvu!oT*)1ScA$omV&zQn1auaM+(SP#%V^allk|8_>vqO&CO5{fbQ!hE5HT+TE+vO?JhDNnOzZkhyS$u`{-a6zxd9cCi@qdj<(4Dy#k8 zg1u32*bK$KRiw|UKJ-}*&(y8JFwKy%Z~kQQdKc%sv`YADg09kJ5f{B~6UR^~6I9oE zx7^kRy~p-CMkQPKQzLXs*h>O5m={sS#2t>gmkj<8ey3g3G*>%@uPdKx{Ej;mPjk3Z zwwWGI=y~1~%D~_|6duCxSf{U7oGC761k-*m>@N=VHm_72>ZM%a?NH~TdgEUWDGPSse(bzKWv1+LXRZxu=K**VJ0f!<P00c6 z=IPGyT3xUUIt3X>jA{k~jwW?G!Nh(>E<`~Jv<9g#Ab{&3$Y|lAEn~n?wPgcJ6d6xp zZtBN{?>+F-a0kJd-pC=^o|s0~=#O23Pmmn}&*RCEMCz{El`mnmAJot}!&dxS9xbCH~&*y81+o4b~ooqluo++p6Y=kH|1Yed$k(mc}gLJDA&l%diA!F$1{jVIygV~g-n zoe-u)lqade4MuqY4uxJx-01iUaWcocqpcVBR{;efj^c6fsJQW&zs?=AcV+pK=tqCe zW-G@NOZS{aZ>M_tbmf$;1A&~fOYgg^VUI@nj7lt13q7V9vr#kKUjJ3n==b<+pJR0z z&}(SM!e1^bu#+vE?T?R-A!t>aMSWebBSlxNk8<4-auXQ0`Ru7KhcRZ;Lb``qQAc}5 zV7;`0Tz|3t5d(DEUw;An+@hvb|2={&-GP&z3;Ov>pPfW{pQX8{QCP=`4H!>1hY(3) zgGylA~|iCo|&NEX#XGoSA$Q7+{;r!WscB}OTl?6OMgj%AtNf&w)%GumwcVL^eHWhNavGGB}13Qg$FAi|( zZ5Qd=V~_*w=&ekAR&C{zF*o3nSv`@X8*k_NLW2?D zdU6`R$F75})=FQY=XqZP<(e%2C&|7Shn>9GaOSgxb7-kYu-!H(j|zedHL^Ydyqcx+GR6U{YVo3^{0EqFL zQam5?^l{m9n7`M(>~!)xKrk0LSu`uf_u(L6oc~4(88A*0D{W(id&0OIS0xPJh`t3lF$1VA(J=PL z^G<`LMO^$`*k<;sc!oOjj2j&mzPNi8*)W%U*lr`U%>*oW5v;;u8VT&GghIsL0@sa* zk?(pwmya=rSfRn}vEkem8y@yj2U|w>s0k@ypE*_(`BwM|y#Dx-40VDG{;UX)yuA1i zDx~1>$bU1e;SJG*AcYmx%H`u)*C=)4+7l_~TXAZae@c2ec-Z_r5(#1Sm<~-j!|m-B zJM4C;P@=S?kQ_BtFw;yqgVL`T9Cm!}*Spf(dyKgW+r_BL?N+1hLzrB2O#DN(uwIN; zHActE4E=aOpx`_87g9H}m(e3%Y=uYco_kyzehRs(_q_Lr{b$YR84S=Ffg)0EiE4a6(fHNR2Nec;0|(in_2jCtG}bFy)t*7`eRWmzy7T9-C{WSWSu_eE6w-zs52 zFeJpawFTb6U4Ne3nG8v+yuG?BmQ$Nu(7G4sN%8>-$$qN&7E?7tr7&wXxA3RwLELzA zG%2@zBF|iYt~5UX*j0(-EDs!|aQer~<8^jx>H!W0=qy;;nQvB#WP7T0%ZChp5!)^; zNdj!t7VIRIzFk%%(WctHt5oXjEvjOJ-IkuFZfv(R&bio zMif}Av;+fmipDEUuM@(;u(CtXhSy}T8o)=Gm6wZS`G#9rq}SfAWb%&LK9#^qxdkai zrXXz!a88fTe)@vb?(ALba<1TT(MSJdl(XETgxFJyr4YePW6GQ?5`79ogiLJ2w1k#r zRvB^IzE5K8M$F@vQgx#aHE5i3p2%G2MH_DP?^s%}W@IGAEWg|JX$*<%=a|mOIZjNx zu?|3-?D5DU=C=O@p43homBdVA@jBX3#Iw)1&+#<@48#_5%Y5xlNI&IImePz_CkpS$ z@~aczgJ7=f4pd-oIN%(tr56_;3t|{sPu`~t;~yJsJ6mWJ#+|&b zJ?DoG7uBtNOKr}~Ef}0QsB?M8bB1sdc#`-9XBns(7whGK1lLivs-13H>-gqE^i!mxJqqrvaqNB@=-6>#5c` z4%fAsf%6dAHi~Z9Jq|L1-KTzb{`voC_7>|y7N=JCNq?61q3O4 z+dL+G{0R!xNvn2UG=%PkD~CA)edas@?^DX5i$-S*gJt4stDdG(I#rUZpi9hP#G?lK zkr@GQpeZ4y&0Zr4HifJ{cH8r9cA*y3XgSg`un#_NY?BtM0pC)q-cYqHfBglnqr1&n zBOR!kqi)~kFsD_kfEd+#DuI5j^ukvj4G#%gu2OxG)r`+l1R zGfOM3!C?eXTF!QrY%S?m!^W1){$kq;O_Dy0v1qHF84m30&^x~+&l)RRN_p-G3YN55 zaD`W(W&vbz3pK`{)gwbnMWxr&1uJ(UamDUTwFP;#QRv;m?yTfmD= zTSp6&!1D61zb>%9eY@BO8R88*TkKC*C{q)qwBS!OpZIGP%;U*F;>8mi5U>pF-j^H_ zWG(XWwf?(zdmWY%-q` zznYopz;=^I!LgYAmB|!tRVBLc%#1mg+S4}qiMxo;4}5xZ$OJ}6YS-~2yx_NnOVKZT zLt9Pj?@YS2rlt}8Wx$%Gc~X9Eg_~oN=9ZI+W|EdtgMgf&1lwtC8oJ^Ir~ElaCYRms z_HXq|V)x&d!i-d~EbQSL^}%`;GqI#~KYSX77xI5)de*4`IdFXiS~U3h*Z$-6H)kLf zBh72j82z|r@{iXIZ{7lN-8XM6EMERmN&oQt@uxFXn~04-!kpsn;D!} zkG@@kEbu|~##DtaU6A!+3^#TF_^iJVBvBg{%y!t!to2(KqB17-$BDX#M74H|H=Egv zX-M+t?cW4`QCMAckas51vGYpEk7h$z|2}ZjxF;Yn*Sn^5s8wKe@Ztu`U)TBHvoo0z z=0v?^3Xl?z`fbuJlgg?T^7L;z0o6BU|m?(GSUx2d<*5wJsTp@z<`;UrP@@|2cWD&ygFV+T56z zoJZI19DgJJeaKYbp221@vMn_m+Q_S`oZRxt?AUyt~s$kCq< z3v5w>6%9Yb>Oj~0x`i+0E(KeK!WQsf@|V@gIWf8DALo3!76)XA{U<{NcNwZwF|cHl)L|0EwX}c zC=6a;LJlghF|<~-_1N`L>fb^N@@dJxGCw+wRbeUbiG?X8V)e1rGm7$ zSNV+k5--1R>%s#+78zMF$0iEkBQWcUp%8U`Blmu3KBjoI-j7#umSFjdMny-9`omlf zNl!9wwHCKYU!q=a)uG?^gRM)in$$H}Emt#^U;HSwu*OU}aOM1{Z{fr$t~{Td?Pt)vgUWP&J$L zf6&RTb=tN^a~aNGRfr>?Kc~3AyS6m@&7eJuRrQ5Is@`HvQ z1B*iiZnQ4^soT-$PI})I^Bj$SZ%IqhjuvQ1t@UdF%^wpb2AF0Xa0+YWx5f(zAs9`n zYtkiOLJ+BS*FBBjt=wYJbONmeR`=_bB>-`>)qGRsH2zlvpqp0i{Fb^kX_|7r^+S6| zn%x(blz4J@>bM(ye`(>E(r^_X2fpU<>9%n+`?uhv{=vrn)R$?k3<*j1X(7lfSb^UFQNbj7TI;9yuIx3ErhXq}iT*YpXZDDpS1F(}>i!-Mn1Z_i6>*u>lSM_8$qi^wM_Ye) zm5`@hJJshcDqprUxze#nY14`m)4hVhA7QRUHc??68Hf-QRj(L*Q>1uzb!~ZX2ZibO zH7_BmfT%(R?DuA

5T_Y>XHj{(sZn{ZLJuN~yGd8wP$&8P}MdyRlkEGzP+~irxJ$ zJg2WAL3rH&wwr>h#AERtM7F}D zeUo6LvEJW|FgE1{MnNsnaaYT;HAr7Is5cJLFq*r$Txx^0Tj`BdSznV~n?k{~1oA01 z2Bn0CeTkKAPnQ&oh_e{EvdEuR+s=xTtLhOs>`yTjpC$s2Lch`5BK;Uujj=p!2B~P~ z)3CVuFD7ueUZS%Kye>|mZSyl32J=U$xJN)ji|+j6Av>=N7|`AS7ty_T4=9JtF{zhG zpc8ZL)GL4Qi}XfBmt4)ICnyK%^&jrYRq|(xq4+)d=U8p{X~~>gp9e*~)Uu6Vvhao_HRqaay4@zPPW%=!){z!Q7&bDg?nsAkaLBD_jNpOKN_62lS<{GuxM5p z#?^DFBIqXu0UB)g{f)wYO6Fb7cIo{Cj6*->S*Z)Ave%qXQNFdg-DHJnpU<# zv|qO|?0rw};crsBOeTW~=C|&7rwyAfieMpdGshaI+N!zt<1IiQtM5FH_|F6fO#8JU zHlSfgae299O6Z3|`-wo$I){1ddse3R3ro%NznTQ;ux^3%lba@+32%;$2s!BL4jN+6 z(XF$Rt*Lszk6nnqcdT|^SyfV^;~31nX0E1bUc-b|=e7cMryCENe)GZSXT_Bj8ut?S zUU$jI^9WuS^jmpiTGy7OZOImoFhd+WK>AcX(J)|6>gPQVt~r|`T)LH?J*Y#VnY(2% zFH;KMu086Kz_vMPB-tB+sxzd1>Vp0-ohm6>=}l-Ckw~;!^mQ^C$%RM_rioGmk=3E9 zQQ<3i_n@2Oetw(tS%)cS1J2EO&`5G#ftI-LoT?~aRjd`L$h)Uotiu(II ze=X8+=fhS#o0|#NVnws5jKCY9wVeQw=Z7bl`r~`Ez@El_@&|=@_7UJqjs&V%aT<SkFAC4G)(FkJdDnmsSNgrfQu2YFBkNQm;c= zd0oJ5bYF*WII) zj}|?zaynrCCy^fjg4g>H@*^?E{JQXhSb*IDjRper2Se`enPv^>2Solb>4aBW_B%71 z{l9VxR<=3wI9YMiWasN@Gt0`h7aF}E0#3Hvc0$WgJxFYa%gF|->EMlEWwrz+c90xF zOKUi#Uv5W|sN^$9!DTO~X$IIn##nI0XcO@%y2o;e+iyEkj^?`fD;By(x^E_KuG=h! zj3;cAT5Q^M{#tK%_lAp0oy|nK{4DfS&G__XY_%52rUkA|sTp8yv8)ySDSJQ0h{=kf zQEo=(VmBx7Ex!=AUdR11DhY2Vb8A#3;gsIzSQq(xww&E0KEU_%rtW&rg~1Qfho|FO z1hmI|Iqi`xYHON#-ow1=VmC@Zw6-{Q5)`JtQ+`;^dYG_%3$RTUi#ZdM3jSz>mA)PTbz|0DD7|9_JC zLz^U@rBNhHflJA0lymLVYuFF9u$>w)({$QHcLB6r)`T0X-knks;)C?J?r9mC_(r-# zEK`=}uwq0hbr0p1T(|z~O?LU)$m`XFP4*L#Il9?uUgPmtwpDB#*L&=lbFc<$mUX_> zxdWBV2kgDTCTC0I5f?;$8G-LNJH`F)E<#>n9Nxo$?o8*U&*heBkQ1*#Q|0Ci{k-E+ z_mCXZIZ(yA$>uR>KN(N@!3>?!Zy&zgz29shpEsY}#2y?&>V0-=&iyl>@Vs#snsy5U z!RttzkLT$=99V1jnu6A=#vy82Xr*v8cD2GuQ(i=I%PX83kt3rjfg{n?q2Zy*Z@IJ@em(LO=6bWdblhzF!w|b`DxJmj-yZK^CZWgQ+%SC?mW!=M&6C+9 zNLe}c0i-#dU?fI`8b|BmL{uV&09_d*?-ve%>Jl9P?Krp@6NlDqjMe%ddY3+LNuX2U zQ#!QC(>e;=3(JMR@Ac6p3Xs=Jmz{T~`KJG_0~3N?3eh8Vdr1uqJUk_q;z2en@Rli7}gW} z*rxSsl(N~x0G{DulPH_TMNpYewf(yUZfFOCLRHDv4;T{F_Qbug7|{`=HTMN0a^{_J z?Dg#L9S;^#+lYd%&)nu19pLgUv~0IVax!68pOzDz5FZ<^bi@EuEEV|ez($Jp1YK6d z?ooF$wHnQR@(fl3ZT7>SK#R9=4B>6KUbr9w&VI5gl^pp=kHST%Q-d&my|JX_60K#s z+PA99fPoaHm^q%^BstjWn8}fYFh}&mQt+FFpUZ2^Zr?d?x&iwtJr{k zq+FIWcq#IQH>>ZU^uDiyKt*nYX*xS3yQxxm0CGYjKj~B%0JhJ5KOZE7{r0$7GoEUnT2@&0*KfaEtKg&O>X3PT(zLB^^0a>@ z){K|ls6QwiDNT*qPQ#u#)XK$Y;S0z?j;fFYA$H`K+HmMH{P^d+VQANvZwL$x5*jVWR>a~>PR z9P<1&UTuTmnx!A9q%}cqf2Pvf7S;(GU9(^3vP%H-ey=%<@73V*U9Tug5i3>m<|(jk zNsT&psQa$ny?PuNw-Hl0S;p{&U3uhGn~=Xnaqv$6_I*#3F5S>AaVR!pSocN*wvOBF z?|Xt`_uBqdqIx|&KJj>e=t7&TXJ(;G8_1kCEWDvo?8*K9>A*dyU$*E=krrK{bQN6@ zwZ!IsZjZHLH*2{C%azCknqrhP2&Hf%V9MupIoJ)yqcuIf_Z?Q+f9x0jkfQ>=fUv$U256ncD*0A}J~;YIKmWKC z5U?{bZ-XE6cGJwN`dY+3;`U1MN+my_rjbVTO$E@FR350}fN*2xK%OineG7vI-pKJ_ zq9*E+W>Aimuh5F9KJHG*-fYTu=hOXHK_fs{a_Yumj5=d>PH{6^n%aPBTa3I+))Y&GVcS-7c}ZCmn*|LW1)R!Z}4MvLlC=V z14{Yx*Y3k1fUtMr&g6F+foaBsbFJoq+~Z9eWN8NRn~l}PqW z7&KdAZJWJCJ;WoO(s!=2R(a$h+Y!p<4e|n82~j3X&5m$!vCIOdjEnm3um)rVdyngh zuVLLq2d+z}+&ocS$1|%k);Qi6H72jF;qKBO);0es`Vb8}Cmg|TaOQaZ39(>QBHMN| zH2-;UGp+GbH&4N?oA{d&RIVL&E$ z5LMXkGG9W=h1{pn`RKU69?IXdKbWqqZ0+JSunNC5qpUH`M7$~!c7YxwT7gx6)g`sH zq|#xjr}D?qp`vXqnn!HcVut+;iL(r>%8KEkB4wz`v7Ef0Wo`;AVj3Y&-^t;j>n7Kp z-%)i}tE}Gw^rD@16rzC8(6Uob@_^;!&Tz_V5(eXQ@R43PQtFfFen3S1f#KNZh}~uv z#n%k|LEUUq$_I99oKk%aW!5R6Ay^n5)WhXS7aD{! z(|Tu4pDt9!?#I<%&*LzGL}~-Bum~IxxHPt$j)}>5KgibV3F>Q#_`lpE5!jAJ zAzuhP{9B(t&XpIsYiVqQ*BhuYAKWA2#DQ;fU($0>C?zy$^6x;4_4(#p=4O# zXF#Z&PX2PL)GY1?${_60>LE7NA_yBXKVkx}LXz@8xB|o}6W|K~rCG^AHGl~I9(;(>)CUDpIj~r5}$Ie=ZA!D0$|KyTtx=v42k7(1-LrH z;Ra6ViSXB!9u!}vxNI0s$!JEP@f<7Y#}{7$3MPXZGUmqG=U#6&hp0I^TET)MCOwD& zA5|%B3Q+_X0whLz<2g7SG=e$3+8W?JrptC|*qYvzUFDa@`ckavgghT@p7REWFQ5mX z;<3I$l6jo?PUCH!Li^+Z><$f;ix;@91o#_O1%ri!G%&SZvjCJ(88~~xmzeY{kQqME z6b4_ch5k>M;GH3)ac~Q>!XoLIL#!13JY!t3PcFToHsBu74f-G4BjX4nhAKUfjCap5 zNeo<4)tQzYbEBDdUgxO;*8R+-B`&n&p^33r5ti&^SyL#*u9SQVrfMNatlg@7siM!5 z>I2&On)X&!e>US_Hipqm`Y%-{t#~?CpS%{i6_)v`%0T~us4tdJ|_qwDP&H!Lg=~1!)s&Gf82#B6IV9i&D)Od}U zGtQm`vOylVy?Mz%(bL3y$B8MWEeG`#O<;fX4FmJT5aNDZ>+?2FqGE}UK2I(#*L48aOdRx%=ngEA;dWg% zq$XNTX=dkFN~^c}l>;|DNOT%c1nTw0XJf4o3vDb6oH6g{RuX~%YJ(|)@f$!F`Q%<< z#}Ie5*}mnBre{+s_6_}`UCaGgd9dnkwo+o#db@s39CFh` z+Hi572i(b)Skh$Dc|DO~2TustBRJ{@Q_My`9jG8Tp7wIK$AiBX`DQY%A%n(OG9=D{ zz2I$TJN9hvEvEMt%e|N!Odc>$z^}W|+X8m=c z*=TO&MyqHqPNmMhpt=JmDlXia?OIRd;qrV@Rpe1{Y`v~$LH$I7h>9vpRf%CIn?}rG zR?5UrhM!`X8S0)Lp>>#5iIN-!sr>(1BSKxggLx%okkmki$_mbS;2 z6ALT_78%#vShOs3H;Nb<4(P{w=Kar$R1w*SfE$_QV{~=_uPd!*iC6=?Qxk@Y%7%$2 zwUleW-roWH;i-;d{y##Kl`{~q*MWAt>;p88M=XPw=-y22d+Z5Ts)3p=l^jEim&eDh!|q-bT8&-21Go zcw@nUAIkJbx7NStFjVWc@#54oMvU9m8>BWkCtVz~Pd|v;!%~pmoa_2-;)Hu?&AU7` zK*LiDaBRfdYJTnoZiZE;FxTtB%&Y)H`tFBJ2RAD_-WX%2PoIAKo>(>WX0Z+TlZ~&r z`jaPoZ{LatDy~%Y*PdfgG~q$CHIp|_6MHp!SS{;v@z$H-U*mIs7vz`Y1eG*=pD+Q< zRG8#`Bk8Pt1HEf-)5JIz&2|E-^3h%67yngqYE0If+eS?AzX%69orp_r`%lw2^U7H! z&Cqz-dVbMRhFe+^(K2qnoq#(ma;q*gMw|N=2H>iMpJp@V?Ozap{P17Ke2=%f^i&JQ zh9eM*#t802_Wi*hum(_D_vw1|S0rg6H>tQQjUpmM`xBd(_0uPn zW011PZB7e9;F{D%A)MgCI$=|strsSO5#vX^35yYPId#r^VZ1QqQ&zccTZNN=)t9Y)d`?vl?_ z%=*hxea>$y;_xq1J$>O4UNCquA6QXZb;s=_eMZ9jqfr*Ew z10_=$b=s5DS=ltwW!ilL_;w&2Xpj5`kG%)LYfnXSvfmxqV!`d9KO?iHY2l-Tp+bzY zbYbrFJ$}wasA*-_ZU$6|S>9WQoy&E6)a+hQB>s)W z{twgZKS2uen4XSi3!Ra5FZ%ctgkE!A%lFJZjbM;n5^2K~HOnd0=X3Z~Ysph1?3aK2 zVy;MzyF&S9C6Z|H)jx?lkHsl6&k=F551%(*^Y+v3>`r3hl&xBM%f$3)m(Fy8?yVTz z;|4}swYmd?QoDcp5q(X`(R((5@SpSPIU@2UB}{(!1C;5{ueCBpx?m(orT-;?A3L*n zTb;Hd7rYg2eW-mSifLLUQr1+4;bgtq`0h?(r~phMsnV^`=p*+1R4mKh=pfX5L0!UH zC~LQ^)~6?c!G@+B@KDhM3;v`|sU!72-vOM_g=5Ueff2yV)*vD_@f0B(|5iM_-l!JE z)EBEMaOe~d(yOf~*@hCb{K}nj`fi%IP!|U6+3?m9m;F;%%0A?1E3}l`wC<34|8(TA zir*&dw}2JPela`vy>YLTy?SHr9}aZGB<+8kSd*5R8jt-jRzH!bp-~3M2{fHm^&s(7n9@d&7T>(e94*@p@ulB1v~OpeFTPx< zOVbHxZ6AKP(P{8o#1skv zD)TOQ6Lw~|HO2?jXb|d_y*^MrzOMiE#R6Ltz!wX@Vi;>0L=LUK>&-~}(GkT-6zyTR z+bY~1)**OnYkEF-TeYU|DkVl_i)`d@Q?7z;_}T(D7>xg(HUb;BS7ka0yf&-DCmqKg z9`&YJ@+UwSk^Zs9@%Mu#&kE!EYB@eQ$MMU=%m3W#z=$LWdnh7COSR=keu`!gR|6&5^KVRorEd6BLxw>Cev+#-$0|D{~ zyJHe7z!N@LK+Hg;KMi^LYs*AX*Aiq27rVXvM^0&0mR!^O6r z7VFXQ)jeZJkcRgl1KHA%#GHXOYz71(=svT^UI&jV_IP~od<}cyDiY2biuef8zTiss zO~5d?RPE%PSLTDrh$)fS%H{;pNLBeeN+C-6&wVxG)DC105&yn3kF#2?DDu%-KTVwl0UQ540=$B06Xfjw9mDc%5ZP}I9T9M@7_T68 z%KCE9qAv+ki8Q#;lPqD-DF>B&G(^Bgp1o9-V6Zn@A|CH)aQlv7-?O!d`e+sOUpG<% z0qr*um8UdQe;H!nX3Mz8%l8e1ddt~ftWS%*(eWxx+wb@AflU|w2Sn+g)5mLCWGbte zvolz)ALFyF)qsi1&79*(GuzrYabP2#cF{i3yrkRq)OX6E{r_=(s6x6B6)XI*@lk)l znihfU5OeISjOJ(aSI+%m(=sm@r{d~RmcDLASBuqn>xCjlFF#)0{rB&RqXZrh>rMf| zL5}87gLdqd7GzHu3z0GvD*!*e(if&8#(-pmN>Jij6IuBm=+mEp_3tqa&{SHm2?n2F zKjYO;GymSN%UX9`!m!`9Fw4N@943y1+`Q`FeXQ;M7wYZrPyO?SN%9wXcjOw2*Y7c$ zqDfnN2~Hmz@(tz_?iO0gIs>qES3-t|EDzTx(H6vJ+=GAA9?L#TaD)FHu=ugtz0n4M zPYXoUa!_5tM$&%{3RHdqa^aY?T;VK=)KH6)7-aI-2)yHzjD9vDZBBPp-pV$2L^Zc% zT=I1{M(eWvkpsg3D~>kxWl%&z&R-qvUVgB0_|4!2J-@N7%>eqkbrw+01OmzZ7@*aV zB+v=287I>9lKJ~wKR-i_f0I5i7$%;B{Ll%ggthS<=WNNI{O3V^SVXj7BGIu`4L7S1 zTy<~wVZ&3_RYx`fYpHlW8CfN@bZs{}&liI=PV7!5O%)<)h%@dk#5r=E{GJkI z7zSd|eS#U?JuI+kCoV_aWfzJ6-x)Q+qA432`khr~$vjSfMLX`>LfjO%fam;gMh$aS zc0kQPDK%73d;nhZmwRvW1Zb`DcS&-8X7L8ekkY1%l{C7xz6+Y_;>_? z!3q!|TP!~&GkLwpA~9yl`}t>qtvVrbDw`^bQ4hHM#HiNUZgmdfyaON~uK;NE5G(tw zuD&RStl;OTzn{^`zixew@P6-VyD+lScAcgIL6axNF)aZ(srLFLO6;6dDg4lFb0W32 zp^1^>=ikhlm;c4Ak&{{=hdhn=ic=`9oMgJ00o3O@Z=6scdMqMW`Cb<+MX5;MUfC_L zHY&Zb{aI`Pqfua?R=E<9cGO9$kpFH|sl?wZtf*C|Ke=}00m3oNoARAd>5KH{OVcBN zc@f_!hJp&7Oi1fPBh5ZRzk zbH=K+d zn7>`F0BGdM(OeY`T#*oq$>PrNW^rkW*qcRhn_Uhiqvf`DYcfu1mr_QZq*AMe_4oEl zliZAW1%o#DF@U(y(U(*W8go=pDzLZ&3jmjSYhM_8R3H>!sG?FS$y~7jt9Gy)rX16a zdgd;5suA1@BxWTvjHL9{33~7?Q;Ks3I*Le8^+75^zfJbZ|Xi!wuF7U@nem)z+xHF}*)L zcFvtnApLaHkOv^c%`OS3tz7Pn4)q^^?WL4N>CM z&+#eB>3BVe5OpM+Q&u}Efgia-phctVbKH#TE&|Zb-Ss|y40Y>QE&Y!`hmCwjwW<+*<2%@7w3A%r-seZ(QEXF(Xo#<) zF-pIYdfdFNv_w^6q=Iv30x&4#_$DJU%x+C4I{NKc%HM%0IWJf z*dJX3Q`4m_*mCvmnlP?{z>(zq;T8qD!!f?s^nfyC+(Q=bpYco|1Yexbe`M3UQT2?0 zaYvf`b&r?-Z^}&llcMs+lL96()my{QrHkD;Qk^(NwRRO%Lr2%EIP@Knyj9&BgN5B; zs2)cSr_l+PY~js7S53#0LGg_CNZwlt%Dkcja*sk31FKTN9%_1Y#E_mBiVEpr0D^e$ z7w#%-*JVua7U0-!TEp4Q$1FRIm`+sC6DECT#=p~kyYj%w*TF2X1{M@-Tw ztN^ECzA#Ln$E)JAN4noufqNLw<;XD2hen)I=hK9caUh{bsgnEJ1sJt+z%HujxdSh_ zN;Loq4$vOqgT6YzUg0^LNT*RQP%rKB=|qfw6)s-QXPl-`aoCJk`j9o}hA=YS-=OO6 zok4q+>=;|nLBl}TR5fPCMHX$mT+ylh`g`(_=X134Zuj2miFL-8z_pEjVf5Q()vWZ# z#~;$TfW_`=4ZWqc&Y2lh3v5}AprQQ(dXO#v_+ydJ*V7DiRJinQ+AgS7Zk;}IXYTL^ zqlfRD&)>ba>M5kd==Xt^L zDgV=wbMJGGo~A-Kf0@IU&)af4-J?psVs!!RxAXp@<1~BS?U;yE$#I-Xa!Aa&eG{ty zLBKc$|4bKXR;oLS9R|E>M>lih0BrEAn>4+ZH`vOD&l4?mb@=#NX{Sk%dTvgB++aI*e#MK%8Aih^%?-V!Qa%|p>0 zeNX3&P^){1MmT4#k0~OSkuDzgwp}JH7AKN;Acje!OcJm}NjFq(_g%@C&k@tG3H{hU z?HLAEISEIrF*+KDz?n+`BgbeVaap}jdTIJw4NHt3;}G4v|8$qTVXNw0{-y5i+SJp$=l$CASShn(-24^5WEio0x^pz9VHx{_ z!|6y|8DR|Xp%<$=)B>2nE2QI&asVQdYPUz)^|H-z@2IqNGfco|x2rRDDPE)!@X*50 z?Vz|qo@+K<@F`5K@`Eqx``2!OObnmP5Q8EEcGU|xn&+M2v7Pv@|9`s-#yRt2{m#@D9@}(F2Yz z)v+aiihz^*8*Fvx>1dk@uskf0eA3?zAfqPkZDqH@5ZKq?eYM=u>orCgB~Q; zpFfpe?chDytq3e3C;sk;y^u<(r?ynW(^a+9a@pl@e@{*KvZe{7X-JOJ0FV1g3WxrC z3=q`lv($RRIev3_oPa}KP$URXTmf?Vi=@)XdmND_`i{l(Uj`!lr92${vv!Hj2vGB{@oK%(@kc0?#%03$OHV?meqw>nXU%EYqivo7Y*r7OX;U)|<3$+u7Pk>K^-X zuNCZqP5Ih06&s(`MAvky<@E@s?b`Wo>FF<*>ViyUdZrp>nrhd=cYsAVQ?V246+|~_ z>OUBjW4sOpSzd1nL2S+6i%mQh6|x`D)L)#DX(s;dANncJRoKib@PGO`?`S&KwvC4% z8^K0Gkm$WjqW2apIzjXnz4zXGPb4})l<1;uy+rSw=xlwn5jE;Ja^92Uyx;mh%O7Jc zYxd0SnP;BozOMUsWt3Gz+k()q@~qUG5fn=-1?ddKOh-e;)3}GNi2S!VZZ5`kZ|tvH z_2wW4?}|-J;0f9Vg0u~AT^F1-@^uzQ+SaB>=FI(xDVB@9q+`>J+-YjG^;0XS?R@ra z0S9>(yb`!SxOJoiupU#H_s_d|0xe^bnn?RMI#^dX`k}8r1cyF(ZF+^Kn70+$Mp;4t398>73(uEX--|Ca zN=jBd{1IC@qDUI2@EPb6`QL1m+vU%=J3PNmrg=x#XH=7>sI8#z$;D=Nj0aZN?6um| zM1Y6Ao`{$>Nd6Xqc4`z_dh5{n3y*?p+Ti3`GZH;xE|rk_C`_Y_r{2Y9baEgtpWS_& zp)S`*YY7KwncI5@qN1v%l|WiRtPuBjGA)hAC61@A(}ba_1(pdv|BH{Z+=;=4V|~Uf zjMV;Qtv_k(ne-8_KcX;ez*>O}*o5pSS>_^mw_$fK3w~a5IVLY?@#b6EcsoC0E3Wmt zsiB_8Eg|JRXtm|CI?+i+ih*o$k zBY-ofr0)lWhRAP?uCY}}i~_v}=e46*IhE zf8&%LYtKCs%-# z6W5%qOhm!)t8&-LyD)Br-+={X#9p?jZ*0J7a%%p^nppqjZzH}v6Y*IH><7%8&@aAU67z2xYXGs#|MAA?glT^mpTLGc zv+e}krj(^kKi}7#J^rbQ{K_Eqg$XlMvCfgMxg+h3feeOoPI7445YU6ctQ{!4D-hlBwx@a-i z9K`OaKg;jJf)HOj7DJ|3`_=Y5m_Fv{Pbu*C#yW$EE9OHr{Gr#1Nh(G=mTK34^8F<> z90gQ>C=7ykNDj7vW{gh4gq)B{QF7u{(2-aj4_yElU$pE4z z3SrQ$`|^;8quqZ=&sxYbz+*?}aVcpXxsp@GJ6WqJiAa|*>Zk!^64;Tjkrn`PRcSuP z!|h@fv=|?*0#&6eptj*_Ih0?MccLIDgH1sOYehdQWXnV=O^}fMrzh9qZ3ERqg(M_5DIhLD8q-Xr znHAIz>Zg?*@wj3GG-+o1yOSOKmoelME!kfPl5)fUA3>tu@e+tCaI-s8z?BBmorjRT z(s$arv-ucC|=n7Qm*uRnNCdu>TEwk484}@gI8;B|hM|}XlY;O|v z-JJ6I?C8-@80iLO$9*(aq`?q?a^c_GQiba$?tbk4w&~nFx%e@D$>nr8boIbm+ZgCL znxqjk@jfiJLro3<)d4A7QcKB?)xlZjLwO!OhT8S&Y2YuUo>_90xTsl+iEK7fvm90` z?c0pAE;|b7)rxpP3|Lb;+>npHpnI%bloxkyDO$j00g?Av$?9?^)-UxG`&*;O@sq!d z9{ztBJ^DT|S?-Dy>4y5U1FGl8LHZdoX^zSCz>f@C(SI8~Vvmwh9@>9$Eb|T|z3PNz zTX`-^jWn6N^MfZ?le>zwDx#WNV!+pHPD zvO{29Ky22Ikm}i|fY44){U-F{Xvx!v8<9GMR-0vcL9>?67E#%pEORIAE{n=>JSh)1 z7pKk}oacGmPHGpfg(RR|%@jcy+xoD4Kj;*KMf%C^l&(A9h&Hvn`(mJ>x{&(W@W`kX&!O0QOA`4J0Wk86HBE`E>S)#BX?$50O-0H2I(*31^4)pNSo1 zm{6T3GTKGf6Uwd1aZT4nVkdr;7sM4c;p`gW6==82R+w*1Buo*Yil_#Lp~vI6lrUi5 z@S8+`Db>YqMp+~d6bU6PBL$p~X~Fj}Y4H>FI#6VCuP#m>yrZ%p`D6-tsHJxww`dp> z_SQ{@?d5+W4+Q^29)$Yhhsox@0QzsL1&qraSgp%05lfY&%CrKzRc;17UiSyF8034!;zw&J%|>1uc(-(L{9geF-;43zd;p9SytYf9QEmKwEtdqbNf@myc%5s2 zlUf|)jRkQ6Y)^?xQWDDpV=-Gxf#{(Fcv^cUkyqDK^p2O){9DENB2?*23m$lfE9_AX zSKIj`Qq>QSCkKFJd%sH27N$Z3JG(6A3O|yJSW*Fi_B>hi)Wh`1%!N;B=(LOS`UX=C zUqH=j_7%*$D`4-R#T`H*}s_U_i&5`kz zvE$e%=uTYGbM-UA-VcxLDe$F<^9^ZvF?1BaYaYe3K2XCaF*NvYzOJT^UA3^+Vd#{b z7h_2ksHrGDL%7sa6w%HS4GSH#n$c*N*ak=ul7WeL)Ecvh7Bjnq;Lp=%ej%4_S@?=y zm5iNaA>W)qBG50VoheJ3On_BEvKUFPr`FDJ--%M$BIQTPxXcnV24qwws1xYL&KhbR zR?Jkcd!X))fN1CwZNBDO{_$cRHnf&vmN9#><()|d-JCuKu*Z5Bb;~z#lnNX*xE;@8FPj@*_*Il!em{#M zxX2IOxtI(Qsgxw^lYE30lpk1bB(Kr?{L_v!<;PKGrl!h#+MeY1#R3=a**_Yih*s}4 z!J+(v{i(*O1WDWu{LPE~ZbKK0dxw{c3EU0?PK!e&X|n;1l|$Znj&rN4M*VRVd6y37 z20CJ^OowXUj0RUqlbvqQ0336VBT@>3s;ZxYy=>_zaPG`l2tIDPUfS3hh0z|XohK8~ z8+VJjN+f=ft#YWC;$5w0b>R^Xg6X?1`49;1B#M<{GKa+$d&A5gY0>{@ZE!;JcYf{+ zAC)0@?9$?Ta!8a(#Cg44(i!dd!!b{pi}0YzbIZU*Tl(oR zz>9sveJ4hPGUi@dWDm4!;m&t42|`*ka@-}?R*wx}%M8Fqgr-$(CqqDf*dm6MCpF7LZx4hkiIwARu56Otgq(WS7+&U> zoURFDUi6)a^M9*9z!8~62q};o0yAC9kF(X5a+Pnnh#m;cE1$sUcT0GSQkp3lfqfJO z9(&$-Uj8|ezjhbP0SZKZAsfh@?TQwL+O>5eCP=4RS2W}-x9A^)MzfQgyO1I1qr+Ko z(tO`3`7M~{j`^jB(sxLL@$MeCejkw%m>Ur~Cod4&5rKEM^ImwgTFB+R->m0p`j3rs zbznsQ`%Jc??g@~T0|M2b-!CkP!a*{;%wk<5n;1W;i&Kzwn~+}RmA?2?!#3JhtDGm- zBbaxCecd6zG{-dfC%k>h9;ao4%#*oog97iaa&#n4N=pNsEKXs3RHu^k&EL?*csu@J zL9Tu%lO??L8Xj!6bnkZr2gV$&+@HPu+X^7L^bHIGz95?z3+06HkMuIY(yvjjNcYAh z$L7YQVKP(xIK@Ie?Zv05V7~ta=EMk^fr=1%_!E(tKMp#?wX@9nQQJ;D+n1W=f&VROj;Eu`N}h|9XM#mCDw@ zA#F%=yWm>ZU!F7OiJIq>`{Tv}z)++#6dYdqgh}yhy(9n3z)6|F-SPYq?ZbN1ghWIX z(@%iJ1$(6&b0>_HLF#(v-Pjib&bVTsj!^1>FJ^~toVj;+8ke6#p2(*~j=5>?D{M1J z2cwrJmcjPh+|+Wa?3&iPbzicrxwhLQ-(&My_Bl=*LtGhRm zBINy=QGd!Q5BK^3{*e%7M`$Xx@L>G>ojp0Cwi8D*u68UtOaLJk%(W!Ef9`N#L(2`3 zj{G@KpHNeWe^7)vh&@o^5hz@<#u{gbJdM>RdyIujm+pBkrEK(_(3sZSgqo+ECx6IL zw}mfKaq-Uadw%4G<`DGM`+v^Tod!q=X%s}z`oq5wa;J!8Yh+4<-Oc*Ad!>PGNsU{a z( zoJ;DR{~$F(DyfI_wBrBURzMjfbdEP_JW5W7p+5%KuLyvIp5 zu)=ouQ8Hg6&+==r6G(-`*QKs|1(26=47)Iu8sD<_WZdxlg6%c00pZIDLxS>i9EuwZ zw&XxM>U$a+;vcmRQ&hTF$rdGXQzlI-aF@+teT^#fkAS}Qda`tJNgzW93+*vIEl|5p z06-5tfK0oh-_l$!5`^}n_HbjUZ~41~(e8{B(4BAd!>*xI%2QcX{M99qdcmc}?OjMZ zjyhhdD}QT&?`uEcTx0|tQ#pA3GZqOU_E3V`nAar*G3U7Qk-(y zP-nl2!2lkd!-ZVeQ>|KZqwR70FM6$rbOO~cNX2Ri*{weSc@127bEO2&jbZ_AH3NWZ zkI(!bEYtUc{8*x$^~IrD7;6t_^o*FM8kZe zXgN)&e)H@=BkKElc=EPh&dLxQ7dIupPWof7eTYuIW(~2m$E<{t7m?<8`M0iFkA3l!0!Uo8j; z-(Qy2ff-ctKM%GZ(|b>rmGi@{<^@>`wQ7Nh+f!zc$Bo;uIneYbpAsVYZn6bBOSXp9 z#n7}rr&7N~y{4cHfeLq{)iZfbSX?u2#BbEr4R)bhp-gXz@&}ABs-J!H{*H3W?{MzkWT1Tv zoA{Xb;Nc11v%NF*9k!ZSEN9zBIRGb$v;{~-Z#9dyI*F`fr>E6D1o$^1Eau!co~z7Wq%;!TMqFs&qB+HbEE)a7+?+9!%t{r<+AM?Ou*MuV4YH5h}4ybzFW z0a-nI>dpCy$LOtWOB;la|LGYIad_!Ty~|!4K>yHy?9DjADB)tM!BqnEA2Kow94ZEN zn#2outtL}SYAK6?O+hHYM~14g@8%@Pg4%k@%2*u=h5O%@uSl3pd<%N1wy~)!kM&X* z7R_reoyJoYIR%6OeQ`fFAI(=3eQY4#EA^OAylNIRhM#<7B>VMi2Au}T5qy5Ey|-Ai zCYkj|?y=}-g__NeLd4wWixA!MpV|rXq;Fcy!oaq1f>+NYYFJ5ZNE18LA}iho?yYz~ zo*dQ>ykBE^;OluYPwtf3WONMeHC_<@WWOpsB79-J{-<)M!9@Cjw}-h$O`Fs9opQaFot zwHBB@P0+{t*H&J}l}^CN+wnOT4^_+wPAQwR088h&)?;^p=TXzItj_K=6#B$|r39ro zqiyFk^L=;g1C*~n?_~s>*kN3P(guCD5ku7mF*~!b2KaNzy7@w`UyZZFl__3D0}&+S zUYxGO_x#FG>~c+FXjZ2duW0~Lwfr293C>v#BB$ux8Z-G~QA5*TZbEZ3dwuo5$n{7P z*A`x16E-&ni3^JaZ=zrk0*y@#D}#1Vp7DFRoJXN=fayxx+a32A{4>Jgxp9w>&=0HWrD1r7jl$k9nt5X^L$& zb zEr{lIs*!98d!u~#miw&WXltrZh6Qn7&j;#FmXI5E{j>9*YdPY5A(q6tgBdJoy!<7D zKZ;JYmbl%ojx~M)O2Mo;c&^R`MmU7JWhF4k4N7%o=CoNb$m@(Dq5yaw?+n`~cRbSY#Uymz|8>IeMEi0EOQ$x;Mq9gju`J znN#?g2pf{7VjkP?*JB_d0v8@^s? zg!rFZNK(KLJlK=y$wfy+GnYfw0^qto0@H`uw4j9Nyfl@#USRTwSo0mOs3|~9?jE6# z7|^~Kg3z7Bw0*6ysL2P1@mjbOtN$0>2GOozl=DG*(SCekdkeMv?QT>xkW zeQm2QyXW&9MBx#4Tq*;rOj&%Cz>A3!74y)bRv)uSuiYGfi25KKX_^cdDf@J{B z`2=tulUp7jbXHvE%1PN!DR``&1sH;B4}}M8FJhwu-CiotXtVx)GEZQq z@u=2d+C15`EN-d_NQypgdWFeg?*QS+?xWCxE>)wT?-iP-#ME>AC({(?=thEWr}L)+ zwV|xmp>f?+YmY*GArjqFZeNjCD4&Mfmhd3AJrn6wEVBm1r610fE}zR?_}$N7OJGb* zKH~%gP5t>q!#018zJyXo^d3}L+No{w;Kk01F=YP3lq_PH{Fx1S2sK?av=p1$Vdii( zvg7wi3vxn?9_Di1F};GS*f{OSgx0L)Ca;i_ljns2+3C>#%1%c|5>YZba&zHF5{nVd z7*H-Sn0+(#iV-9ebl(o3J>uoMDIMNR4~=-C_cc3n2Bl0cZr;g>y^u}O_i`M=4LL)#+@*Hi zc&^4KgBzthDHivA z_a_eaTE(t%q%X8K52+|!Z`#u-qV(@U~;JXkp{|&D}d2<<2z4ZeshN$1DvTs z{jv*LqX0-?gJYDF;geM!F%rx6(NdcX*Q+!;#7650EvIg^Q^^ZwApB7uS1-1r-0d)T z@)*#L))~JCQ`7p*aOUeSBB_G1!7RZ0tHP@ESoRDfb5s|(ySzq>bJJJ-$>WI;`$zux z9QLi4Eqg=PEy2IJS4Nh@pVPxkyYGjAwJn2jEdBO_S#^pKh&o!LYPM;nFbDnMi;Hz^ z(!e9i_>f=7qN#3PYF0%;MGTFGBxlzBJni5mp9;&%UG$gl*bM&vT3#;JJ~q zw)>W(tN4gBicW3*6wU?Kg>GnZQ0&wCV^OTP?|lMMMUC2{d!66~R+!>^8BVat)_^UC z@a~}r*5{)?SymSKuFnjsN5Eord-yCI2!|sQGn%x5ZE!%f8EE^|>N4JKih&&SQV|Qk zMeEen?F|qh&Z3{x#>kmB6h@i3Qjb1#fBl29c7$qy$|v_;+gAUe$yvMmHDf+Dw!P#o z8^tvXD=t@35XO|-0)kKhjj!N2kdCDK?Mvjuu$kv_jLYot28#D}*`NBt?S?N4BH6Z) zBPtmIn9EBT_kbztOvJ%$kV0aqTQS>sCD4vKUN3J`Jff*)fQPi2lqD5fWdE-0Jb@jD z-!p%;=R=qM4nOC+RAs6cPEgF%G9osE#BkRQ%bLXv8hJLClzK%REYcmZm?u@`p{Z3XEI`-&|R2B{&!zHjRsYcWC;?0rtLj=N=lU3=_-;6(6J!A`$*AV_GT zVQ6hcVz%%3{P7dr=`w0*PR6a0tY^+WohY2PwdAW1*YcH<+mv$&s7#%H?1y0zxCCgF zMLy%*=>z?B3MUHuy#8ywXlwGL#Qv*Q(bHhMA1bWJs{4#0T&XY38ftH<3j$oGgJgZm zE`AMXju2ulYQyVG!-9+r;kJq^wS+kiVd2}1+K$i4lO=w_O7S5s?8gl{-z8UfFRAl4 zW*we#v1B}Z{`&j~ZhXj{S)ak84pCTeJLR`HNf6+i-pNmZf1Y3QyO7;?e43FC-A}x& z2Z@B;YZrTTxx9@6)s*KMx}WUy1Ln#P$qYlv509sa9RhsAhplbatewgp56}6( zFlkyYo`G>kqCOz}sqD^R3n!}~b*0K{sRfzneeg(0N<`<(u5m)D^QpC8`{n^i`;UD3 zQ#qu(I@}LDU7>zFWj~KC^@vS|(hq;_kS!X#em$DOFlVu95@<21+3E^3Pwx{3@9e#W zYKd85&;Q|jwRH$lvAaUeDsmCFo3{x{{Aail)&0+Rrh zj&I|5S5Bv98=jx5xH9q(s}760HVOhBc;(3*SoYn4qXX@U;-oLdflQT5-MEn)QtCP) zHEE;QFR{}lA0zRJcdD?F$@%}MM#qecaEV?1C0OhN2Rp6ItP7jOl<*P3eQX2%zw3_o zPy_M&zz-9gxgYOxxIN|3ACqeIO4t4{6S6A;s6a1%RCIX|_Y7+?sr`jjicLoq;ya>Z z^^a(-JL-?JxC{2S#Rl=y7)CO9o@7N}D~{3=B%5!($7CU{TksHg82w>ng4(XpMDuB$ z3dFI^?$@2<>e1&2JOpDu=b>}|6oi&WQ7=gpbf`T76vKYq1Ae5$<-|%v^!)z^mci1t literal 0 HcmV?d00001 From 4261c09ac92554573308088745c57f8554a93b4d Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 15:02:34 -0700 Subject: [PATCH 6/6] Fix links --- content/rancher/v2.x/en/cis-scans/v2.5/_index.md | 2 -- content/rancher/v2.x/en/cluster-admin/tools/_index.md | 2 +- .../advanced/helm2/rke-add-on/layer-4-lb/_index.md | 2 +- .../resources/advanced/helm2/rke-add-on/proxy/_index.md | 4 ++-- .../resources/advanced/rke-add-on/layer-4-lb/_index.md | 2 +- content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md | 6 ++---- .../v2.x/en/monitoring-alerting/v2.5/migrating/_index.md | 2 +- 7 files changed, 8 insertions(+), 12 deletions(-) diff --git a/content/rancher/v2.x/en/cis-scans/v2.5/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md index 87da892d66e..ced269fa5c6 100644 --- a/content/rancher/v2.x/en/cis-scans/v2.5/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md @@ -9,8 +9,6 @@ Rancher can run a security scan to check whether Kubernetes is deployed accordin The `rancher-cis-benchmark` app leverages kube-bench, an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes Sonobuoy for report aggregation. -> The CIS scan feature was improved in Rancher v2.5. If you are using Rancher v2.4, refer to the older version of the CIS scan documentation [here.](./legacy) - - [Changes in Rancher v2.5](#changes-in-rancher-v2-5) - [About the CIS Benchmark](#about-the-cis-benchmark) - [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark) diff --git a/content/rancher/v2.x/en/cluster-admin/tools/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/_index.md index e1848728eaf..9d65c984350 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/_index.md @@ -37,7 +37,7 @@ Logging was improved in Rancher v2.5. # Monitoring and Alerts -Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{}}/rancher/v2.x/en/monitoring) +Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. After monitoring is enabled, you can set up alerts and notifiers that provide the mechanism to receive them. diff --git a/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-4-lb/_index.md index 2b119a1a6e7..4e1706da721 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-4-lb/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-4-lb/_index.md @@ -50,7 +50,7 @@ Provision three Linux hosts according to our [Requirements]({{}}/ranche ## 2. Configure Load Balancer -We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{}}/rancher/v2.x/en/installation/k8s-install-server-install/nlb/) +We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration](./nlb) >**Note:** > In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX. diff --git a/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/proxy/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/proxy/_index.md index 454f98ac60b..05b3667a076 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/proxy/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/proxy/_index.md @@ -27,8 +27,8 @@ NO_PROXY | Network address(es), network address range(s) and do When using Kubernetes installation, the environment variables need to be added to the RKE Config File template. -* [Kubernetes Installation with External Load Balancer (TCP/Layer 4) RKE Config File Template]({{}}/rancher/v2.x/en/installation/k8s-install-server-install/#5-download-rke-config-file-template) -* [Kubernetes Installation with External Load Balancer (HTTPS/Layer 7) RKE Config File Template]({{}}/rancher/v2.x/en/installation/k8s-install-server-install-external-lb/#5-download-rke-config-file-template) +* [Kubernetes Installation with External Load Balancer (TCP/Layer 4) RKE Config File Template]({{}}/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-4-lb/#5-download-rke-config-file-template) +* [Kubernetes Installation with External Load Balancer (HTTPS/Layer 7) RKE Config File Template]({{}}/rancher/v2.x/en/installation/resources/advanced/helm2/rke-add-on/layer-7-lb/#5-download-rke-config-file-template) The environment variables should be defined in the `Deployment` inside the RKE Config File Template. You only have to add the part starting with `env:` to (but not including) `ports:`. Make sure the indentation is identical to the preceding `name:`. Required values for `NO_PROXY` are: diff --git a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md index 8185bd6dc39..c6e43f7248a 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-4-lb/_index.md @@ -52,7 +52,7 @@ Provision three Linux hosts according to our [Requirements]({{}}/ranche ## 2. Configure Load Balancer -We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{}}/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/) +We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb) >**Note:** > In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX. diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md index 5aecaea6bde..d1f2a5c1558 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -23,9 +23,7 @@ This page describes how to enable monitoring & alerting within a cluster using R If you previously enabled Monitoring, Alerting, or Notifiers in Rancher prior to v2.5, there is no upgrade path for switching to the new monitoring/ alerting solution. You will need to disable monitoring/ alerting/notifiers in Cluster Manager before deploying the new monitoring solution via Cluster Explorer. -For more information about upgrading the Monitoring app in Rancher 2.5, please refer to the [migration docs](../migrating). - -For the docs about monitoring for earlier Rancher versions, refer to [this section.](../legacy) +For more information about upgrading the Monitoring app in Rancher 2.5, please refer to the [migration docs](./migrating). > Before enabling monitoring, be sure to review the resource requirements. The default values in [this section](#setting-resource-limits-and-requests) are the minimum required resource limits and requests. @@ -79,7 +77,7 @@ As an [administrator]({{}}/rancher/v2.x/en/admin-settings/rbac/global-p 1. In the Rancher UI, go to the cluster where you want to install monitoring and click **Cluster Explorer.** 1. Click **Apps.** 1. Click the `rancher-monitoring` app. -1. Optional: Click **Chart Options** and configure alerting, Prometheus and Grafana. For help, refer to the [configuration reference.](../configuration) +1. Optional: Click **Chart Options** and configure alerting, Prometheus and Grafana. For help, refer to the [configuration reference.](./configuration) 1. Scroll to the bottom of the Helm chart README and click **Install.** **Result:** The monitoring app is deployed in the `cattle-monitoring-system` namespace. diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md index 918337a8194..f28ba241414 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md @@ -9,7 +9,7 @@ If you previously enabled Monitoring, Alerting, or Notifiers in Rancher prior to ### Monitoring Prior to Rancher v2.5 -As of v2.2.0, Rancher's Cluster Manager allowed users to enable Monitoring & Alerting V1 (both powered by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) independently within a cluster. For more information on how to configure Monitoring & Alerting V1, see the [docs about monitoring prior to Rancher v2.5](/rancher/v2.x/en/monitoring-alerting/legacy). +As of v2.2.0, Rancher's Cluster Manager allowed users to enable Monitoring & Alerting V1 (both powered by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) independently within a cluster. For more information on how to configure Monitoring & Alerting V1, see the [docs about monitoring prior to Rancher v2.5](/rancher/v2.x/en/monitoring-alerting/v2.0.x-v2.4.x). When Monitoring is enabled, Monitoring V1 deploys [Prometheus](https://prometheus.io/) and [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) onto a cluster to monitor the state of processes of your cluster nodes, Kubernetes components, and software deployments and create custom dashboards to make it easy to visualize collected metrics.