From 0473937df6709c101d37f9392d0781f39290a037 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 25 Oct 2018 13:01:21 -0700 Subject: [PATCH 1/2] new pr for messed up pr --- .../ha-server-upgrade-helm-airgap/_index.md | 11 +- .../upgrades/ha-server-upgrade-helm/_index.md | 11 +- .../upgrades/namespace-migration/_index.md | 156 ++++++++++++++++++ .../single-node-air-gap-upgrade/_index.md | 12 ++ .../upgrades/single-node-upgrade/_index.md | 19 ++- src/img/rancher/move-namespaces.png | Bin 0 -> 23180 bytes 6 files changed, 202 insertions(+), 7 deletions(-) create mode 100644 content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md create mode 100644 src/img/rancher/move-namespaces.png diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md index b79bff45c79..3d7d0c93e50 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm-airgap/_index.md @@ -24,6 +24,9 @@ The following instructions will guide you through upgrading a high-availability [Install or update](https://docs.helm.sh/using_helm/#installing-helm) Helm to the latest version. +- **Upgrades to v2.0.7+ only: check system namespace locations** + Starting in v2.0.7, Rancher introduced the `system` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). + ## Upgrade Rancher 1. Update your local helm repo cache. @@ -37,7 +40,7 @@ The following instructions will guide you through upgrading a high-availability ``` helm repo list - NAME URL + NAME URL stable https://kubernetes-charts.storage.googleapis.com rancher- https://releases.rancher.com/server-charts/ ``` @@ -73,6 +76,12 @@ The following instructions will guide you through upgrading a high-availability kubectl -n cattle-system apply -R -f ./rancher ``` +**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. + +>**Having Network Issues Following Upgrade?** +> +> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). + ## Rolling Back Should something go wrong, follow the [HA Rollback]({{< baseurl >}}/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/) instructions to restore the snapshot you took before you preformed the upgrade. diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md index 6b0aa735bdb..7dc410bd5e6 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md @@ -34,6 +34,9 @@ The following instructions will guide you through upgrading a high-availability ``` helm init --upgrade --service-account tiller ``` +- **Upgrades to v2.0.7+ only: check system namespace locations** + Starting in v2.0.7, Rancher introduced the `system` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). + ## Upgrade Rancher > **Note:** For Air Gap installs see [Upgrading HA Rancher - Air Gap]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#upgrading-rancher) @@ -49,7 +52,7 @@ The following instructions will guide you through upgrading a high-availability ``` helm repo list - NAME URL + NAME URL stable https://kubernetes-charts.storage.googleapis.com rancher- https://releases.rancher.com/server-charts/ ``` @@ -75,6 +78,12 @@ The following instructions will guide you through upgrading a high-availability helm upgrade rancher rancher-/rancher --set hostname=rancher.my.org ``` +**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. + +>**Having Network Issues Following Upgrade?** +> +> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). + ## Rolling Back Should something go wrong, follow the [HA Rollback]({{< baseurl >}}/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/) instructions to restore the snapshot you took before you preformed the upgrade. diff --git a/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md new file mode 100644 index 00000000000..60b58842f73 --- /dev/null +++ b/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md @@ -0,0 +1,156 @@ +--- +title: Upgrading to v2.0.7+ — Namespace Migration +weight: +aliases: +--- +>This section applies only to Rancher upgrades from v2.0.6 or earlier to v2.0.7 or later. Upgrades from v2.0.7 to later version are unaffected. + +In Rancher v2.0.6 and prior, system namespaces crucial for Rancher and Kubernetes operations were not assigned to any Rancher project by default. Instead, these namespaces existed independently from all Rancher projects, but you could move these namespaces into any project without affecting cluster operations. + +These namespaces include: + +- `kube-system` +- `kube-public` +- `cattle-system` +- `cattle-alerting`1 +- `cattle-logging`1 +- `cattle-pipeline`1 +- `ingress-nginx` + +>1 Only displays if this feature is enabled for the cluster. + +However, with the release of Rancher v2.0.7, the `System` project was introduced. This project, which is automatically created during the upgrade, is assigned the system namespaces above to hold these crucial components for safe keeping. + +During upgrades from Rancher v2.0.6- to Rancher v2.0.7+, all system namespaces are moved from their default location outside of all projects into the newly created `System` project. However, if you assigned any of your system namespaces to a project before upgrading, your cluster networking may encounter issues afterwards. This issue occurs because the system namespaces are not where the upgrade expects them to be during the upgrade, so it cannot move them to the `System` project. + +- To prevent this issue from occurring before the upgrade, see [Preventing Cluster Networking Issues](#preventing-cluster-networking-issues). +- To fix this issue following upgrade, see [Restoring Cluster Networking](#restoring-cluster-networking). + +## Preventing Cluster Networking Issues + +You can prevent cluster networking issues from occurring during your upgrade to v2.0.7+ by unassigning system namespaces from all of your Rancher projects. Complete this task if you've assigned any of a cluster's system namespaces into a Rancher project. + +1. Log into the Rancher UI prior to upgrade. + +1. From the context menu, open the **local** cluster (or any of your other clusters). + +1. From the main menu, select **Project/Namespaces**. + +1. Find and select the following namespaces. Click **Move** and then choose **None** to move them out of your projects. Click **Move** again. + + >**Note:** Some or all of these namespaces may already be unassigned from all projects. + + - `kube-system` + - `kube-public` + - `cattle-system` + - `cattle-alerting`1 + - `cattle-logging`1 + - `cattle-pipeline`1 + - `ingress-nginx` + + >1 Only displays if this feature is enabled for the cluster. + +
Moving namespaces out of projects
+ ![Moving Namespaces]({{< baseurl >}}/img/rancher/move-namespaces.png) + +1. Repeat these steps for each cluster where you've assigned system namespaces to projects. + +**Result:** All system namespaces are moved out of Rancher projects. You can now safely begin the [upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades). + +## Restoring Cluster Networking + +Reset the cluster nodes' network policies to restore connectivity. + +>**Prerequisites:** +> +>Download and setup [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). + +{{% tabs %}} +{{% tab "HA Install" %}} +1. From **Terminal**, change directories to your kubectl file that's generated during Rancher install, `kube_config_rancher-cluster.yml`. This file is usually in the directory where you ran RKE during Rancher installation. + +1. Before repairing networking, run the following two commands to make sure that your nodes have a status of `Ready` and that your cluster components are `Healthy`. + + ``` + kubectl get nodes + + NAME STATUS ROLES AGE VERSION + 165.227.114.63 Ready controlplane,etcd,worker 11m v1.10.1 + 165.227.116.167 Ready controlplane,etcd,worker 11m v1.10.1 + 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 + + kubectl get cs + NAME STATUS MESSAGE ERROR + scheduler Healthy ok + controller-manager Healthy ok + etcd-0 Healthy {"health": "true"} + etcd-2 Healthy {"health": "true"} + etcd-1 Healthy {"health": "true"} + ``` + +1. Check the `networkPolicy` for all clusters by running the following command. + + kubectl --kubeconfig kube_config_rancher-cluster.yml get cluster -o=custom-columns=ID:.metadata.name,NAME:.spec.displayName,NETWORKPOLICY:.spec.enableNetworkPolicy + + ID NAME NETWORKPOLICY + c-59ptz custom + local local + + +1. Disable the `networkPolicy` for all clusters, still pointing toward your `kube_config_rancher-cluster.yml`. + + kubectl --kubeconfig kube_config_rancher-cluster.yml get cluster -o jsonpath='{range .items[*]}{@.metadata.name}{"\n"}{end}' | xargs -I {} kubectl --kubeconfig kube_config_rancher-cluster.yml patch cluster {} --type merge -p '{"spec": {"enableNetworkPolicy": false}}' + + >**Tip:** If you want to keep `networkPolicy` enabled for all created clusters, you can run the following command to disable `networkPolicy` for `local` cluster (i.e., your Rancher Server nodes): + > + >``` + kubectl --kubeconfig kube_config_rancher-cluster.yml patch cluster local --type merge -p '{"spec": {"enableNetworkPolicy": false}}' + ``` + +1. Check the `networkPolicy` for all clusters again to make sure the policies have a status of `false `. + + kubectl --kubeconfig kube_config_rancher-cluster.yml get cluster -o=custom-columns=ID:.metadata.name,NAME:.spec.displayName,NETWORKPOLICY:.spec.enableNetworkPolicy + + ID NAME NETWORKPOLICY + c-59ptz custom false + local local false + +1. Now remove all `networkpolicies` from system namespaces. Run this command for each cluster, using the kubeconfig generated by RKE. + + ``` + for namespace in kube-system kube-public cattle-system cattle-alerting cattle-logging cattle-pipeline ingress-nginx; do + kubectl --kubeconfig kube_config_rancher-cluster.yml -n $namespace delete networkpolicy --all; + done + ``` + +1. Wait a few minutes and then log into the Rancher UI. + + - If you can access Rancher, you're done, so you can skip the rest of the steps. + - If you still can't access Rancher, complete the steps below. + +1. Force your pods to recreate themselves by entering the following command. + + ``` + kubectl --kubeconfig kube_config_rancher-cluster.yml delete pods -n cattle-system --all + ``` + +1. Log into the Rancher UI and view your clusters. Created clusters will show errors from attempting to contact Rancher while it was unavailable. However, these errors should resolve automatically. + +{{% /tab %}} +{{% tab "Rancher Launched Kubernetes" %}} +
+If you can access Rancher, but one or more of the clusters that you launched using Rancher has no networking, you can repair them by moving the + +- From the cluster's [embedded kubectl shell]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-shell). +- By [downloading the cluster kubeconfig file and running it]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-and-a-kubeconfig-file) from your workstation. + + ``` + for namespace in kube-system kube-public cattle-system cattle-alerting cattle-logging cattle-pipeline ingress-nginx; do + kubectl --kubeconfig kube_config_rancher-cluster.yml -n $namespace delete networkpolicy --all; + done + ``` + +{{% /tab %}} +{{% /tabs %}} + + diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade/_index.md index 90033c3444a..726f9de0ad5 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade/_index.md @@ -6,6 +6,9 @@ aliases: --- To upgrade an air gapped Rancher Server, update your private registry with the latest Docker images, and then run the upgrade command. +## Prerequisites +**Upgrades to v2.0.7+ only:** Starting in v2.0.7, Rancher introduced the `system` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). + ## Upgrading An Air Gapped Rancher Server 1. Follow the directions in Air Gap Installation to [pull the Docker images]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/#release-files) required for the new version of Rancher. @@ -16,3 +19,12 @@ To upgrade an air gapped Rancher Server, update your private registry with the l > While completing [Single Node Upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/single-node-upgrade/), prepend your private registry URL to the image when running the `docker run` command. > > Example: `/rancher/rancher:latest` + +**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. + +>**Having Network Issues Following Upgrade?** +> +> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). + +## Rolling Back +If your upgrade does not complete successfully, you can roll Rancher Server and its data back to its last healthy state. For more information, see [Single Node Rollback]({{< baseurl >}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/). diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md index 6061a7a0dd8..87ae47154a5 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md @@ -27,11 +27,14 @@ Cross reference the image and reference table below to learn how to obtain this | `` | `v2.0.5` | The rancher/rancher image you pulled for initial install. | | `` | `festive_mestorf` | The name of your Rancher container. | | `` | `v2.0.5` | The version of Rancher that you're creating a backup for. | -| `` | `9-27-18` | The date that the data container or backup was created. | +| `` | `9-27-18` | The date that the data container or backup was created. |
You can obtain `` and `` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups. +## Prerequisites +**Upgrades to v2.0.7+ only:** Starting in v2.0.7, Rancher introduced the `system` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). + ## Completing the Upgrade During upgrade, you create a copy of the data from your current Rancher container and a backup in case something goes wrong. Then you deploy the new version of Rancher in a new container using your existing data. @@ -88,7 +91,7 @@ During upgrade, you create a copy of the data from your current Rancher containe docker run -d --volumes-from rancher-data --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher:latest ``` - >**Want records of all transactions with the Rancher API?** + >**Want records of all transactions with the Rancher API?** > >Enable the [API Auditing]({{< baseurl >}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your upgrade command. >``` @@ -98,7 +101,7 @@ During upgrade, you create a copy of the data from your current Rancher containe -e AUDIT_LOG_MAXBACKUP=20 \ -e AUDIT_LOG_MAXSIZE=100 \ ``` - + >**Note:** _Do not_ stop the upgrade after initiating it, even if the upgrade process seems longer than expected. Stopping the upgrade may result in database migration errors during future upgrades. >
>
@@ -112,6 +115,12 @@ During upgrade, you create a copy of the data from your current Rancher containe If you only stop the previous Rancher Server container (and don't remove it), the container may restart after the next server reboot. -**Result:** Rancher Server is upgraded to the latest version. +**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. ->**Note:** If your upgrade does not complete successfully, you can roll Rancher Server and its data back to its last healthy state. For more information, see [Single Node Rollback]({{< baseurl >}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/). +>**Having Network Issues Following Upgrade?** +> +> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). + +## Rolling Back + +If your upgrade does not complete successfully, you can roll Rancher Server and its data back to its last healthy state. For more information, see [Single Node Rollback]({{< baseurl >}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/). diff --git a/src/img/rancher/move-namespaces.png b/src/img/rancher/move-namespaces.png new file mode 100644 index 0000000000000000000000000000000000000000..9e6b7e9f42e9da37b4c38a3139d9436ce3aae8d8 GIT binary patch literal 23180 zcmd43bySq!*EftJAgzEPjihvUiAXm{cXxM#pePd34I*9A-Q6JF4BapcHNXJ#&fxcV z$MZb*TEFLA?;r2AU|qwW(`TR0-urXT;hVCe6eb!G8Ug|Wri}ClRRn~m_Xr42Ql2Bj zBt&viy|5RmleD%g0s=k_{P&5BD)lK$h~g%rAc3-hhK9$9U)0O_=20Y}0f7QR=7ZQruk@o8f3J_1jX#p z3V#OnrDWRSAEYDHCRr(A56))%#do-*hmYnSE}&#r{F`Kekb;H9L0V65S!Nq3dn@q) z_Kabmc6d8GJ3}Xzq6`nijNq~lxxftU=6OVY?S93!ZU1*IEmQfJnU7noqBtcCj6~Gop5ZoCls0mFa3E~x1rmN%0KN$S@&C{ zx$6)OV%^->Xu}BWh8~sX{AV2#P+^vJl!!gR#FzlXKEY$JIn$MFy8t5~87Kj)JcSJ5 z=@S3HJupfCC+F*ezm1{pqyL-foAW=N{LdtFU|kQgRhhBTLw*jh@oYYw$4cEkx2%KS zSpFfMTE1UpZuwKB633_PkDZ19d&*=gEiM3a6T70X-utOx%zXipolh4c2>*pic|Ti%d9aJSq(CD#*)90ZWO%x>#mCvfb5|(0?}%7$#-5$DF@{u%>!t;*D zde@fN=I!3u?iqlZ&7t((5g-|~`O>azqR#QeOkACN{QmN~j(6q2M9<{Vabgp2KOk0D zrqdl)PPP?7OKIDFohF~z{$oE0`{{vp8i;~B4t>FCvsV~W2A?!V-221}Q?hQexfd3{ z0fQs9bS}$Ot&Z&jUqU=~3TVzQi#_f|$}NwDdrNQp@c2EMj0f{}5llgQD_kB$yTcg)^;vnA+Zk{W+ zvB{eoI1F??m+Vn+2DF79#Oz8XO?RA#LNloT>=+7(&bh{abFy6SFT$6Mbt9`E%6Y&X0kD5m56!qMpkH!x#bwcX3v{CaVa zvD;nBcY^-*ez|3*^_1XvoOB+)&3dEdH1&Q3^9+1CRX>8ox_A|slSOsdaP?dC3-lqn z?l{8fn5w$ll+15GwDCaJGOVA;o8FIl@%PDuZr7Yh)oxF6*ZL_zc{zGBEi3xmGpa1n zMUB^Ft`PFBKp;cU+}!7W`E=4ug9nd((-Uo64+Xt>NbN}=gOLA5m(#*wmgh>DW;l2g z8oJQEBqirmtiYb~_z7ubgq+gh^%&$2kbTpqFu(zu91){Ekx-M=eAKmkq6$@cOZ$l+ zXTXcbkb6*Cc_q-W+*B{@6(PZTI#)Qh!5K)boM5h_t~jajh>oStqf%VOQc{1$Ck&Dd z^=CKbAF@;^3lj;jN0-|fw_J`67@8+HXQw)R8L;mi9o>f2jP38G2d;#Qg!gQoe8Apl zaSdAAEdvBj&ndjyJKqCek(JK`3}Wmil!|FTCZ;#qzPPl|4>Ze zwfiSYzm(%!+T<~5G(T-*%C|^6-=a26TmRiWg6lOG0?u-x$PE2rz=M=SzQ5 z_5MsqjLRE1xWAqZ+!jW_*pN;7&gfW@fBOfVEOIAzWp{QOoGaX<5_RNN+?VC ztrJTeYW{Ai*~1yx%B8UfEx_3FjMT`_<%e*)zWCT^c}(@0aXxsDe@@Ao58>Ol z7{lUz+eq?fK%P_ftKYcL)rS+1c*7QC%Ig&NTX7>tw7NXFXo&aYs_(tWw#Nfh6F!-o zV$eh|0$Zpvue_1fXx3Zp=Fcmd3Z}Q)8MU>WEymBAc{Qtn=U9q?7f+R-Ai2JRD0_wL zU)UEXK07oX(4tiRT?L9`!7_ao5?9R4hq|QpF9NHkqGxm68J;>MKEd39ZC}%~FqApw z{o==?F1CXJ)Z4djjsiA?AM&PvR?l}msA|i%}bJ$1FFRvOTn9dH%B17G(b3 zs6>7wU;yvg)E~_s7l?q&fx8kvI|%xSe0$w+^Ffk1ibq;tjEFn`Uwm|5d*s({9$MO5mxE4=oL>2qhUooMJ4hb;lC=`o!@{}jdV z^y(M8#Cf^Qi_({dy6xccD3ZMOa@J}{d6~>r|BNlY_bt*Y|8)LnR#x}<1O-l5Cct9( zyR=Y6Vk5R_f19a2@qE2Ezw38{4ZS%b3xn0++JGgAnBkr&Y&_+f1*z^zKGCfZQAguJ zwF!c@%L7kvWwsI3l7X<7-N`uCT=g;7cYPy!0)2#fN2E4ZeX2&k0Ol{Jd*8OVpaeZj z-^bM=BpJFWX=*G9h|0JrA*bC2k5@fZK9v=@!TANbP|8#vh>fx-4Ko~$DB-CBM$V#m zEy=nuXZviS+Z8T$2`fo}jV)ggUe~iWw?;L}f@Q3H8Z7spm?)2K}AAv8;$~_DUK6W zBEIvqI*rWeT{YVTXjjCv_FwJSbKY3WB?m4G65_muRtq-X*<%xvHN~Zd*kA3pgV#5& z_JKD#VNTmE{ilAObi@J8;VHIM5TF$7TYSx(ucpkt56#gX`=yrMz{GR2!7x~n?PtZ` zN*fABJu33W7|tJ;hpL_%ggmD0vd^b)H8ALoE|IOV9~&GFk31}4!GLU#Qq%1rQ$5sX z$QSM`e=zHK`@ebNHvhyN2*rQDic$QZJ@tRXng9PdNydasyQen;zb+y>ZxTF!k~S1z zjthW}x$pon-F=TnwhAnIEm|V&qmfP<=wjMA`IN=J!INPKGRHlv1z^{bhc*d&SfFhz z>3oMmYlSU()!QY z`Fhi*?|m8H`jrv^)?XmgGUezowb7+*WydVuEL%RYh--SP*DEN!;J?8R-ox6tFN_M8 zk_8=MnizEnb&1^`dz(dZcoMs4vbz_iH9pmKP4<5qXZgFN;94^cMCPPgL-l!aT2Ba} zT9v+EVi1cL>!}z1XdiTHph@S}p=D7H#DTr~Gnl?Jim^WEsM7v{d(DaTRkVaDTS{f5 zV!yv7PVH1lMHy>1cPT-83VeimO52of(^}%k#|s|5;Aq%YnX*5TL;!w&@;(TOqVrob zCGnEc&xH*M$OJc zbWrH!^kn;7W0TDMK;VSMq^dt_OOG`vmUyH`za@rJZY$YT3N=^5BP+gLPcfT4ti^q) zGL@2mh98_1Tl4#Q0g~0}k2w9$G$ldqy&g=U7@Wd0h#bh6ruuLOuB`*wx#PpWPscS? z{mscFcqMQH5aM3-KSN;#7miZJQVw#zYe8L#=9Ga{;RCbdvgV+AG|Q=Bwq}PJPHH9` zCrfID-c5-onaFzz^1_+JN0h99&nuIoNK#UEDR|5KJw(SgWZPZt)}(ESG2^SuuR=oyorGO1!+WgEBq>cm+yJKj=&w@7N zyz_n^#OuRO_BoG@BF0$f4M9)?e3sH{Z-w@Go0>=O9B3Mc#YeQOGir?ARg0bKW9K#R zpS{nfJI`lc>D;K)=So%Wi=rqeoS&%lIG=6X5H6ZbBbEed!q={7tj z>?Aw z`(09+N=Fkjc>z{|94iYD`n@V4afBo3m zg~p_UiOeU-1>P?=-<>=*b_I z#hrd4KK3NpRfqPz^PbE`^trn)Q=(QusgZ9s?(jPlcrz&3cWdPTnuuKB#W=Ay@nKQG zuTMkz2A>p+WGmK_E0aI%d&s}Dazy$ZtxoP6S85*ry%%g2C&Z;%kOg7tuv66xD)B<0 zZ&ni8AzSHeA)iqJNz-Sxb`B8RNbyOx3rCNr>=>}VX())DH1s_sdv1(TxAs~z?5LD0 zb`fhvE80?mJ)!wN6azO=MX?GfO?RP%|BzMp4fF_un;icu3}QS&tQD3Zz5wO;>yfiK z?Su$$%xu7wj5pqLY6MMN(m9-o8_+HT#y!xoZl9kQwP%OEN;}e$4|>@FF$sF{VMr4v zy@9c+5)(NU^Dgi$^==ee_^jooRznDmY7t3WR2BW~Kyr>C->gAl;zrhtQM)73l9Xh) zS;Q9s1~R>OH!U*_QYk(yp&ixyX2Ry?AX8#`SuQcy!s&bOQgukLv)RY~`nkmHz8t+# zFXy0^!o&^PP{9>jZVkrl+8erNG&zkYhvCOs8&r9++u)>)Zdr>0m1)(7AD!vVvz5XV z&ms*NPR0t{<^;lNwR}V#l_dQV1_yMfel#(bD16cL*R_ zJJB)f<6)haFvS1^sB40gE!ppwGIdaXkJ)m4f%3T&xPR~C|b;oGTB(q-qQ`{ zc}E6H;E+wRL4=SE@jRin<=`jjE`PhWE_u7ivTpDCk1v`kLqE}9nR@OqQ|aT4xSF^T zevKTt>n&ra=5xA#`>pBz!C>@}0-fCTyhRN2ndw+1pX#2&5rmxMr0Acuv*pV@qQ{<6rT)c1AY944<`#X)nUjpUFW zo`LMkvdP#MVk=trvYX!cRPldxRHIL@$C=4>Mb6~uUFl4m>fl#uQ#^fi=k%*ded*+qu>psn{BY0*&l!B0@Pg^_5IRE<`LaN| zsSeLhfeXFgYV=Ecf`9Ou@={A__mKhKhphOHU@bEapO(I*wJpy2@p7fgH8!mmp?ivc zsE96b;-f4vraV5%*wSPQ=cL?E^RFO>8ezbf3ttG!G!8P_8C!x&Sqhb?1>k zuKp7HpyoUu23FqFDiaYSSC`nnF362p&i^gq)**MlJ}VUw`GqK){LCnA=SY2FVsPwl z74>c9`=V)FHw$-KZ&p1+UIz`vevp+UED22SaRx%|OLI(Q-n4bU!H`c5Taals<@VO} zJo8v@%Y0<>$87%b&-oDx^B*N21oHkzZhe_B_+c4$=NI5yE-$Lxs6*S-Yrq`W?BSh(6s5ML(JiQkdBgZ2*WLqdX>* zHzla{-z15>^(H%ve`Uw&X0pHQ4R@Tjj+|f?1U}%Dlb*M`ku8yzA4OHfwpmy^Y1wGz zokq0eJKY3nDQfCJb@dlVw`R|B4E1jKR>_bN6-|x%;~Vi5F?Oi8gv77Vk-0{n7_COb z{LNgv@l~U((RwP9TtKGO&Rf?x5ZToa&f)QN%gIw#)_j+Gn7TzC{>|YA z_jGmFxZS9BqsCX+{6|`Q6skbOZ)MAvx;m!Sk>j+E+23;$^SDupAnxpW8AI&n*xlOy`o_xG?h z*YdE-us$oKN2SZSuJCQJ!BHuDXJ4l&kf@{MrW$8b_qIQ+B5FKmtMA1tVjFgW{a01y zsxAebu_K6DM`rjt>t1c?2jcJ4nAKTxf7DYn)+)3hLGXA}@@0h}zI7tI|;$qMZdM#BMR^MtR`#>HY8M%LTbj^s_q7T&L(Xw zYP3=Ucjwz~ga`ds@{2PQGJ+>i6zU5zvcD_OKl6e(V+F?%^zS+Sq$I#`7)^^AAy=(k z&(VrvE<`7aBFbdapD}pP9rCDxo&T4Hs0O3JmwUR^eM1F$=>FP6w*a*n_zL(9vLDtm zeOw#k_6?P#!bI?+oPMBzmX`gzK~eY8bhInHssX~1@wkAc54_fp@WH@IsR|lI-cQ$c zv&z`Xb~5t@7s@LygcnG9>Wkusz`Fg?w}~OQ{vz*3-?{GgFODDj@n_vB*zef$JZ}N^ z0&-G4aJkzD%+DW;YytYcTO#JPz810t*j=gj>RT)&Z~kyt{*h7_V_zk2k|D;zP&8J= z|G2C!JDNQ!heNg1578iRRq*m6Iytl%3^d|wGfLyfn%fj+s{rym&V2A3xEY*G+Mt=Z zuB{?J`%&}_Rg?b~HShN)UkcRX)s!B76~*%qB{N~A*XMCs<|ZZL%?qtY`p!M&pv5=U zTemPRLYG777s#xSN18fB<#|HOIr~y^S&o!+c9Wd-b8nvYGmR~d%acTA!3;B4ys|Jj zCX7%=D6yqoLZ6}UV>hhWUqh*(C0W-04+0$YomLG#nSL-Fc>_mM%i;znJ`&g#B(mPH$i3h)pU*^@dDeqs z{mWNyUD~IDZMo8P(COd1CoUaEw!pLe$ENasi3>hXJsKYuWaYon#8)@j|8Z}+fm2`~ z%%VhNY5NoM<*`7^$|;V0Fp$aed{w!=U(qwWHH{vyPrk?Y2>VQ)|0QrZawE9?i9i0Z z_Acyi`x{|dAH9T_w)5Hm!rIEr13HGnFqX@s#Cp+{%3%$}%zSiP?w0l~T zjaq(6JcHs??zfHOPe*9oks881e^fzwOiw0AM<6ON;v;@zfw-q5)H^ifV(EN<R?*^(Qn8BhsglToB@5%?M zcUZ_P1UY$RUeZ!cIr)pVEmpPWb&#HF782x>d%QyB)!VTSnEOdSWVShDfF>t&P1NbL zVj}AjcUtx~*g~id-_qVr287CTa@WHZdbTSmYmGrua!w9}eS4L)OaF`o8*nAKr~U1APEx{7b5KMcJCFRdrOh31#;y7gbK6YHIKLoWdn0ak>(DdzR<1`3!|b4XN9IJ# zhS)&%8c`2TD+s2h@=}5R2CKMUZLtT8=Wm-}b`Ve43T`7haPF)>*{6LL8kMkIQ?Y4a_{G+Z z_Jmn`WUR0=B_`@n07ZsblZi@A8X}Z+P|q>g_H^EGbZ30(EfH!@L5y&~lSV>!KH9vv zeK!+w2La~?gFe)t-d|Ouk82hej{lOpn5$*fp59;iZR_HAFsyiXnCI?aXNiqju&~c4q05P63kx5MXP~N;8r}B6=ubwXDqs#`}pXMWt_+1(AFusn_4_s#+1Z zkBeR;{c$A>0g*DxP%91QTa5}V$E!68;(Vsh#Qpv0mQoSk;h5FE^IQPWgu-H*$ywIL zOS?h4NQ$;H?rB6?U7R`s;g7r@lz31;_6&Jv_p|J=ZQDNsvZ9qa|195BUY!dVj?o3G zrFo}eJ_Y)Mcs+10nz`))R-z|39880Z;*ea2T~WH#ob+|%j&Zp^#z_th?17>WPLGO3 z9WsJ{qE_>(ZkWncnXc~Uv?+`f;K6qjz7ELjL6`+c|Lu^)x3skP-?9wzP2t{!NTzc9 z)#O$yCR{WHg`+$f8ma+i1%4?ghf12RMD;yoN9UyfUwEF1_dKMrX*9@nJ3pFQP8!fVeBl|Mjd~nwYpGs_7ur$o>k%M ze1B$-lxs$y#_zy=GO?x~GrTj5rp4R4cxWgIpSv+ELmBVrb4!Wb=$a2AJ-RY!v681{ zw*#bi7OZKSVFP}J2y>M@_(y7JPKK5>#DfuszoiA$go4D5r?_*MH);7(PZ6~wo1DhE zRQ5qnkR{_%a^-a5Ow@iMLfAUk*l=Q{iHL+>I(7*xDn?IQ>e3>43RFrKa7VkWH`QPP zf(I;tiD>V66P4L$Vo&RP)Y-;mAnLWm$uOpgPj@zMt>ZF>`rt|mdf$1}asLC|QA|XA z{G;-<3mQ^Ajp>QZ2;4rqXxyTmTr5=>O!w|b-%W2CjeW&cT8PW2Xg_|5a<#dLg!-_e zWbVO`KpJ^(idYfrQ4)s)R?2gT{|@un`P$9D>v2)%|1Su?>H=EJ6XGTqciv2>FwLeq z0{|*a_T5yT{3W44)2{~kK<ZzP%&qi_!@d0TQ36c^&L|&#sj07|usiFl@@1A9 z$RK|7AdjUKgtaW_u_m(Lpjc(9#D!8=Qr6G)+6H``a$bhT!UCVZ55JHDz?sG}^B^+D z@7BX$K<$cKol$F#lD$4QnMq{*54YOyM_n_ex(M6tMfR=p71S|8G-9y>&G)yI%j z!&mhPM&SOXp>jhXd)P)=mje%LVyu}A;-ttH6Tkcac9io!c7I{UfqXty{J;fB z9|2z>DC6rQ=tYK?Zmp}^MO${5en_x_U=N9s=PgQ5WkI|QVZt=F8^xm*Y4E{z$wkwW z`&cX>eZf)h;R-y4-}E<5e178$M8U2sq2! zLCE~%XH!mZa`{o0RR9?zl>FUa^5vmJtw|R}MZu>oNcD64-+jW17(viMJz3&iWf&8n zf&14U+<1n)rFSI>wZzto*y&RYu5TZJYuL;E)`#XP07D@9@Nrn?`X7(5=f)gQpIv3XvbaeKpUhDQc{+Ui=C*|$)wcLXKLVJFtpCiDLkhn(@r?dTe^n+!tSXp(BT{` zUmfgh&2y-c@2S$aY0;16DJs8OA8`U@e+SpDt=vmB?`YJeY04p0zb*WaDuCZyE7z9I zJJ}SSn^@O{m&n$vHT77)uhe!S!7v^lYev-*jTLm(y0IOq{odfxP}z{miee?5s)8 z9j1fp`pAZid$h7cN(S^b#DC`b{ukn8Hc+m!t|WXE)} zjB&5;440a!jC57IGUo5)ErVr`%U08Q~^>p^IyD z<4(!ZvHe`CHl$@=_Vc0*Ll!%X4I!>KTsY@>|Em=#%QTe_nYF2t3wf}398L{bOO$4k z`JZ}u3DAgQt9pSyG7v>dV|e1R(KW1HAM=zC=4^!p44vo4`ci}%bC_nWS@hyzy@ZIt)td#xXaXqlL1aP)>6KH!tt|Dsbq!OoK;bkC{q zazAW|JE*e|#;M6DWb{lQ`4wM%S;SVnpEaqh_n5AUx1jC%biVq9WH~OKoD!YO`6xt zmvb1%%W;)E{ZW;U_2*gHi|khQEdb6w?|!0*4Uta;&*M1qw9S_1@S>dJZK?SxyeuhL z^qFA)y4$ID#2K#TS@H@OIav4=-fEUag%ixjv_SYznz|x2XosTBa(J*^@PkYdx~=A> zXuQ(>wYyy)*W{4ZsVX^k-Qi@#Sb09ru-MR=)p@>vjpu^%SnY;B@3&D@iPEK=4ifBV zhaj>iPHU?wPm2=fXOm!jkAUv@#)aBtL)a1QAj`c0ZnmauN=A~{s1~mTW4)T$Q)oU( zRe-wqnJV3mfnOSY)?GXf+Xe4O#cYzcmEC2Ylo0Uwq~s$1#ZAV1FN)RBOB-IAMyz5@ z^-UD3;=F^;cxU+3QaIK@Ug%f!4jc*zURR#nZNU>}wEMBM!%rXmTcd`!3r3s571Nr! zRW-TMJucNRumnb})A%s%oJodH(yg+ItlygUII5Qqmnw2ZQ_z`6CU;z}8~@m{dF-2i zboA{>`@6>xHoe_f4156$Hwi~fDGlIiGHB-12_{M zwK@qX=AX?z6iQh0u(6Cd1gUGdRbmnt%>jk}w0QyM8cg2&KZ8oFO_ zMuuBgBoUu?J-}S}t8L}HzE5yVc!GirSbML(iz!qcE{a&HI~X z%jet@eKUgJ7AsHRLKT>iJJ!rpX|Lz+=tQ%Hxu+u)sPc|Qg?eCn67p2%s~nlysqaTO zGo=S#1`T#tK`5LJdmj7hf_Cc+CgYUheWeorQ9&^{>>bz3x@eCLKubzfV!Fs)9%Xra zlZXF3@fm#}jT2Ka)=4>Kdym{=3zr>2h+1+S(kssdRo6m=d;fuGaM@KeVl6@L$pXUj*kM*_GXA#9Sz^vv8)Z%{ zMl%Zh?l~gt_{Dzw-SWhuSv>9>9lxE(S}sMqyQ18u&YgbCxOU#J!Kmk7@$jLR!&pKV z>GjP;+VNsG--7+uVOLG;_&@VKk^zePdaxt^*lsTh7y;!4vF8&eb%3<@n&StLw8usL zf8T^vyaAo?I2k0B{&jlCtYmMOzKe*z@G<916ZKqg(xLx*_F>_+F&~O?p}`+_a%F^} zNa<>gdS%dV`q#2w{QB#z#&8DxLv!S+{R>zBZ*D35him))gX59l+BVX$e%8Q?=fq9+ zyur1B$-N2wf;XDLfnmH+gKh#(rcE)+u6I&Y@KrjQEuwgPJOXHlZM2VS(Pqyg*-?oT zE*_l_OJAzT#f}g|r8Y=^E*^FP`IyyuLqfdTnw+wKHGh2qH&t7VQ~ffc$z#Nyibi+O zkrAn#PQ354UI%U?FQq_+yUNWNHal!f{jFbcP97T$`oZhN5&UP*0p_XSDF!Yp>guJeeC@N~EtP>vDnjb!*?CZ*4Hi>+#n&qIul$@87pvxMXCcaS{DMZ!BNSZ?x3 zHFuaS0>Hm!ul~8p6lj7gBwo2Quv5ob68?YsY%4omMTLJPOCL?!+z$UYpUHq4GHFWaHyU{|WMFB=_(;3_);^t{-eh;V{G$nHL5#m3 zhn++39l0bi-xz5uZFT&RtJn$>uDiFvv@CSE{iLtZaaQ*qvO zQ5-N>$=d7E+-CJY-uYY1F7;&b_mrEB*E~X8!5{eWf#$B7Rl5bk_nD7VZO6qX12q(8 zTDYU&{idZ-;_>pi`| zD_sA&M)J_GIR>m(x(=oiu`viCOtHs(;Ay)@bZBac;SRiVC+U+C@gQ$W9t0d-XT4>) zdw4b};uFaWRoZe*0zB@wN|O`*5WJV1Qfc6dK^L_BaSdfpMD&|jCaBJMyvxDS5B3d^? z>(>M45pyqP7KRGANP>EL6iZH*dXSucAY#5l!CvkPyF2!0^DilRAc%tu3rz|fkvkvV z1fR5_JURv}gH@zKty?@tFKGv2s@r?THH{?P7+m4jSBuOR+zkg&YMOx{e7uN*4s?@Ab+j z0mP-ENVcV$#UTM1y$wr3et)W8KB^8A7aQav@V_1RkIDIae_?U>3nZyx>)7#Z?HF*_ zn`X&M3F^?<5xFCQU`g}~Om?)54yWi|;OsW-uvd4ZI4;Ri9A9ZiK$d(gSXKv4+WlXX z9*VEtZ0hW+w&TXxzTs?N@g|7_rXsaBCZ)hG9%P!{QI zi!T>~(OK_lzhMf3T8IeGH&iN^g()>cJ zJ(cZAbCSQ5&ecA7_k}OHg^#Bxjp9$c72cwUWBg35Dw?Ko7=ku`m6N1)9=-#*Lxey4 zbIgA>AK;g>_8Px;333vJq#aZ?dC$UL}RMxJb9Z2SI)USbhYaqGp9lppnX)A zF-&CzXv)#sX7c89s3Y(pC+9a%IJ%uS81;tR?0wMP&u=dztG{_E*f@spN13Rtq)C6@ zD6Xl!dJW=Avb$G#b`rat?$Xs5R2Hva#qS$qJJCecf~KE(BugdR6#tdIXwNGLH59>^ zx&t9jrW-@i0y+@-Y`_t*vwXatA3${zAPN`<-;a`K&iU=!-%CPkA3lvFE-+}_yWUG3 zdd)q9-S@^gIs{B%!#?;S{&{>Gy$cP1{n@eh9CiyHA*l1^?GxBLgz5qj_Cl80LxH_8 zqW-|Mye7#ehrQVN-iyLsMo#~J#^q2D%bJaqjg6|UZOP)&5{=Bn#DuJ@?Bvlxb$=rV zthBX7&X0S*y**`n`?9XCuK4uy(!D(^8C753X2o>A?Ack36^|wR@Q4VKU0GNIgKYbi zkA)#%VA70D!l*@DuSv|HSuE@a_5t?ijLpo$JtQo-H!s{Ac5TQ*xT*JzAwV2O*1Uen zygq5j`4te}z1MPIQ13A@G0{*_RrK`ITMWt%4i7IU3?o__B}KaW5xY zBzEplU0yySH7zZS-}bw~vfi5lXmKJIEW4gMtZs*TT@@9T*xYE*hwJc7VaTsvzqUM@ z!$h4&k?jjzF#VQ+sw=i7>J4o5&6k!BIX*rLjR!25lS?cgb<_)zzLTqGuCPE_(QE8% zGxYpLl)Z=;Yt|RmoPB@evicyg>N+-jA=(AMDQb#qW~X;Q0}YL^)Iv*rW=flw6we*pya zixr8x=6!MX(Q&q^RfJwhci6B*V>?ao>fecw`X=NRq#onKQ?tQnR!%Kt8K;?C9ox7v^#WuTUgVjZjK6S&fQZ3!^{7{27 z(Gvzk0$3T67Ri6eU%t#98Ihlvn=8r55ueIeXudWo@849>)lGwGDhDSg>AEw`GfCJ=%VUL#mrJA@_>vEw!zXmKLT3YErT@H2Tyy#sp0nUKXvq z*cQAL-%srTx-01eZesgm(AvKlZ zdoM?LN{$(;UiMLIiTc!nWx0Q4;_gS=l~tlLU9-6_gDR8!N}l9_UUiw?d~z0;XFFMK z=d3!EORK6gLeN5&tfXJD_8eJu@g-_Q29@H6=O$7rys(;$D*liY5iyj^6klAp<>luO z0l|jL|(i&S_aF4BxoThwx}M%r{YwE&giszLG5 zaD}m1T;gFj!(%muGD71c@QoQ3Ch-D4ELX>CcKJQe=9TbpqNaKp1_oJ&dS5pJR0Wj> z)0@SI*(@K(**(jQJ@ahN`Ek|K@sPe&;fx^3*>y8ExCU*eRG*@G<@Y3FtWHVI?SfRZ z@7-~uj&hCItI<|+YQ2PEGgenU59cI?M5OWdQ1QI0_X#DEhxm&y3vqD930IF%i^9wY z+s<^KoGM$aVS0KEkr_KbMc+w{LOZE%zuwc_q!;^|*Jj@8#|)uy#H(nPaV*qwn}^Nr zB4wfQSx^1iVAgqMn@H`A)l#|}(55l5q%kPso%_n%O2$3K3{XtGs#ktjWa?E7>nYo_ z?$Qe>Ny(v25C;F)Cg?2(hsy;)xPo%HjvH(h&!XASmV_T^xCWzdDV?>x?1tMUK!Y19E8_Z}~TU#%-`qrl_7U1CA2D0Z*?Z?Bc91PJ4%QpqD8*Qo_r_p52bWIqAtE^243T?Y&0;42Q(}Sz78XO>F0i8sGBAUvudjb_ za1gt6tf8hBr^k}?53DtPzt;U&S^K^b>SPJ_xvTkL{t*~wO0Cbot9V#(Oy=J{j(#~R zqn(=Od{f(!bid3pz7Sl1i4JxTd=7VLSWJ`uu*!fyprOIR7?^u7kt3z9t6Q?Tr~?Nz zjS_W!e*W<2X!4t$fGj;Jn~M##&$pZQ#I+^{Y!!6dB~}KJnYz{bk-t~BfPxE@{V`97 zZVU4F`ug;5r=E=WHfH$BsW(-7N*@76)%(Wg)SapM3d$wa$IEATU{@mLCnEXXZ@11f z`K1EB!y3cJ(p>|VR<*J!EY&EPoSK3oX*(d$IZ#V${;S5d?JUa=fBVz0LHeqD{W>zQ zGw`Czpy3ub)A8k`OiIW%P&| zr&(Z)bo40e9Jy~F^-4Ln?NaSkics1AQ_GnLHL>h_97RM?!6%|3n~1<+5d;J!h(QoI zfF#O#K-py9_i#vr0LpR@LD@kdY+(xogoGV}a1>bsVG|?-MTD><3JH;f6z*2p6TiNen0)|s?nmFTNq%^ov#^D!yXo+HO>4oje3M;Wh%bx_*lM{ zp@rMCFE|CSG zQdf6PT2@v81hP#XpPR!9%0dowt%(eKeOXGXw*~lJ6Tpfp76>9BfUbC3*M@1p*j-d} z4i+E*?BZ?l$o;({*^QgH2orps^CMIPTi+KvFT7x5IDlSJ4~Mq~`Orzhj&1hU;;R%< zpu|qTo@aY;aYtjHJ^MvT31VN{M7auVB_$=jJUlKusUPl{X<|CJyl*zhT5w(0`X&Mt zrC_y{k-_%0@6H}x(Q1S$YrSXR0AM+)w)((`9rb_IG@j;iHb+DfZPwr!>xDzS4~44{W)&dawqmg@Bzi5 z_A3&R^p}RIC4<=RsnT5h374i%mT<@KATd|iRZK{~<$ir4GBxZ6Ttr@k^Qbl~FWBFc z)%={v9yhau_qAXgFlnoa!JO)TfpBE%j=1_(&Qv7*un=|{Yk>M%^{9-;+q-m%&$Y=x z<3PUOzbF#_Dkf;YiQhBzobK*{SHu5MRTBSR>9!C&lh&x~s%3muNWO2$f~9wYAl?Bu*MMnIZ%uawxEhE0c=b5kVlYuN%L<317wQ4d4nFRV>fDJqqLj9wkZO zzm-;)Eoqa|tJd1Y!dZD>&aLL$dKh*o^Ga|`edJa(?Fq+p;`b}t?Hkgwh3N&#qPivN zsjrHQ2*_oWTIj0+<$fz&Xe-KRY!_pkj(1Lzw?*{k58GBVd2Ec23D9nC%leWt(W#cK z0gaZX$+hA$S2f#gkZbf;ai3=$DB;de^<#500-oCm_i#i3NQ??}%+A>R^Uu3@JihPo zo0A}HO^qp_-cp1v>O#=k$HG~$U9rK*4Tw?GtwKvJKE?=i&U`OLd?aG}h5}kvlr>Of zhA8Ui&}=PWff=_rZ8p}Cj>iZ#l;ObTo|4;gl?YljP9(I?GB4gTZPT}gkFYj7a+du2 zbMuD+Ev2{tGj;&Yzc3uo$^bjHd&^K0lQ9~(Z7~Ft@p5Ee#1l|^05Jh%Hi$e#D2#H8+Fy>~c-jT$KUa#{jqjuiYpI$S&7g~by7@;W6yxNRax_Xy-d>}Gn z$u3W}*9di19CMO$SxAVvvm!oPl~>LfZ#N6?Mpo4~p-$6(0KM>nLz&K{(--KM1EdY7 zKiJd5JM0gJQqDatsx?_5ZgsweKK>P3;z_#8BYME`?@WW`eVGlD4J{mtAYcCO@CW5Mm*e$+VeqDNYlZR?Q!pFh z);_=$wK@reZn(Ix$@JwhW`m3GPo3lY@QQuOMjtWTyy8v#qA>;Li)r%<4G;OwUEaSp zQ>ndf7i3a@FRy}k={L&&!{RS8$zjo4QKOD%iKwD?#9VX+x2Qt1bE}*Em=`wKt{lG^ zW(xnRlO^6xEEC9_t0DrcKtaNkwnKsCs6lO##e)bE6K-GKzF>WcYhIzSgEuPLZlqJ{_D}~^ zMriq2BSSNY)uEO?9d5uBtZu!|HuUO~(v;s5uzDA7va+$dR;l4zSv^UDN~4!PY&THZ zAxjV0b0`FHn!$*$EjAcp`{w6LFD_Ehrbw`z+SBRnC-Dz65Z<`D70|jCI83)z{NzM# zFF|@hXW))g+SzkE<(xEwnkP+qi1t)#GcTWJt6j&&`UPESqjDIsI&aKs9Ur=EjR4_S zW6o+g74y+^i@G1mvT_(PkO{HL8I~3fQ{s*_vMtCe(^`0{*E(GJO`sRox*fw0GjbBt z4TZwE-h2~j?-yM`XtzY}8tSYxr z#;RQxReh_*FiQ)J0o2Y@dz=v)XVeCTj;{xk5YXJ9G`|#I2$jr^wF0%y{D@U`yA zu5A{KDF``|b*m$|*OIU}>Zw_qKl-^pN$lHCkLQ`-f+B7c{|R?u8I@4Z#&6*D*fy`lV20R6in`zs@(=RS0b=zVR(dnb2kWX5aL1f zzB;3+38~#*qQOeIWB-8HEu@QcdICGcxuTr@>I_&=$IL9c<%T4j`3^Z7{5u;$uqo0p#DN>e{d3i-~IH_cq_Cpc%83d;Mzyv-hedFRgK7U|!rO1Ond zv`f8iC!M3hW_9cvf@wK=?zlw(dS!E8Z5ttCRlS+|YSaGMuacwykpe}zF?A``pBDZf zuAt{M^#x#|ReK(&JFiCBOg#!IsqVf}QGIDI^{oeLC50y?Ol&GspbfXft3eKblkZWi zsAis?e{ttWg1KwG*93XYl^ULK(JpsQ2ODxs%id=fO(%>ey zFYY;nrOM}cj!u^#CoUS9C4G_7RlmV<;t2{xH?D3nZ#W5>nq`GV{#K&A{1GMKMU7vw z+()0)kh~iv6YIV5OsRzv_kH=A&C%Co>+Sq;5YkTiNOW%=6EhcX+qA07&H_W=SQUS{n{7EUMmuo$`R%Y5S~E*!R(NV<+L%gjguW|+NM8xQ!veM zP)@zX)q4s0O%%cK>F6V5ajggLpU54XVz)|+)Xp%zge_ce*iD+NS{FuGIqdir*OQbu zI)NRpZ`pw%Oz*{q@gddTQ7U$kMyaf72VOzNTyRZOhb*nEuV0)x@bdAHF%xAS@f`V5 zMKGPZc3*pl!}UGmH2csKH48BkjUPjUWNt;6onONf?k)7nYkx$ygbj_o4m(Qu40g`c z5E`1`9`);JX(M{=4Li@U(3U(m469nU8*cj_1r>eC6(kL6f*4~Vi#+Em+{=bX`eSX_ zi$K^V$&J{)#I(|{Ic#Q_2p-pd$AoZl@7>&59~{0RCnoacOcvinQk(xc zEnAO0L5L`mRSuz>zQ`{vC!9YoDp)xf+kj(sINP#}pL)eOf9cj`qJrGy)m)QkVq7PO z&mKE+c){)n7o!(f{iNNbS&3&7d}|K)zwi6#J{MbM>Y(E%o#_JL%lo%Xg#?hNu34&Z*9@&SZbsXCdLIJ>RN?ISzo|N;pF}hw`;omq1^G~qIjXSB81a6r$IbD*A zk;+q_gZsq3XhEO*tTU zlu8(+qln-?PqzqzNsL4lflnU`$+=esIVJkDtutu)pv1U=nmNlo81wip&=?~=w?7&a z4o62#xv1`%?(#_6iBq{;qx3fCC;3@MYi_ zAH5AurVPfEj0UHSwR>5gdcDc zc&37Qm{$B4X)Mb#TY?`By_TbU#gy;A&TXzlsxKutRH%I!LH@X#R!L!T4r;uB=l|b@(udr|>N>{!4OAd?ZvX%Q literal 0 HcmV?d00001 From e15cdd17742a4e23c9857901a029eb203e32e203 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 25 Oct 2018 15:10:24 -0700 Subject: [PATCH 2/2] making corrections per Seb --- .../en/upgrades/upgrades/ha-server-upgrade-helm/_index.md | 6 +++--- .../en/upgrades/upgrades/namespace-migration/_index.md | 7 ++++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md index 7dc410bd5e6..0bcb9627e52 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/_index.md @@ -35,7 +35,7 @@ The following instructions will guide you through upgrading a high-availability helm init --upgrade --service-account tiller ``` - **Upgrades to v2.0.7+ only: check system namespace locations** - Starting in v2.0.7, Rancher introduced the `system` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). + Starting in v2.0.7, Rancher introduced the `System` project, which is a project that's automatically created to store important namespaces that Kubernetes needs to operate. During upgrade to v2.0.7+, Rancher expects these namespaces to be unassigned from all projects. Before beginning upgrade, check your system namespaces to make sure that they're unassigned to [prevent cluster networking issues]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#preventing-cluster-networking-issues). ## Upgrade Rancher @@ -78,11 +78,11 @@ The following instructions will guide you through upgrading a high-availability helm upgrade rancher rancher-/rancher --set hostname=rancher.my.org ``` -**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. +**Result:** Rancher is upgraded. Log back into Rancher to confirm that the upgrade succeeded. >**Having Network Issues Following Upgrade?** > -> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). +> See [Restoring Cluster Networking]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking). ## Rolling Back diff --git a/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md index 60b58842f73..b51b4bd695a 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md @@ -72,14 +72,15 @@ Reset the cluster nodes' network policies to restore connectivity. 1. Before repairing networking, run the following two commands to make sure that your nodes have a status of `Ready` and that your cluster components are `Healthy`. ``` - kubectl get nodes + kubectl get nodes --kubeconfig kube_config_rancher-cluster.yml NAME STATUS ROLES AGE VERSION 165.227.114.63 Ready controlplane,etcd,worker 11m v1.10.1 165.227.116.167 Ready controlplane,etcd,worker 11m v1.10.1 165.227.127.226 Ready controlplane,etcd,worker 11m v1.10.1 - kubectl get cs + kubectl get cs --kubeconfig kube_config_rancher-cluster.yml + NAME STATUS MESSAGE ERROR scheduler Healthy ok controller-manager Healthy ok @@ -115,7 +116,7 @@ Reset the cluster nodes' network policies to restore connectivity. c-59ptz custom false local local false -1. Now remove all `networkpolicies` from system namespaces. Run this command for each cluster, using the kubeconfig generated by RKE. +1. Now remove all network policies from system namespaces. Run this command for each cluster, using the kubeconfig generated by RKE. ``` for namespace in kube-system kube-public cattle-system cattle-alerting cattle-logging cattle-pipeline ingress-nginx; do