From 9467f187f1d343ac33de43de5d581fc5d6b9ae24 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Mon, 12 Oct 2020 15:27:37 -0700 Subject: [PATCH 01/27] Document K3s backups with external datastore --- .../k3s/latest/en/backup-restore/_index.md | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/content/k3s/latest/en/backup-restore/_index.md b/content/k3s/latest/en/backup-restore/_index.md index cbc502dacd0..a913b68eb2a 100644 --- a/content/k3s/latest/en/backup-restore/_index.md +++ b/content/k3s/latest/en/backup-restore/_index.md @@ -1,15 +1,31 @@ --- -title: Backup and Restore Embedded etcd Datastore (Experimental) -shortTitle: Backup and Restore +title: Backup and Restore weight: 26 --- +The way K3s is backed up and restored depends on which type of datastore is used. + +- [Backup and Restore with External Datastore](#backup-and-restore-with-external-datastore) +- [Backup and Restore with Embedded etcd Datastore (Experimental)](#backup-and-restore-with-embedded-etcd-datastore-experimental) + +# Backup and Restore with External Datastore + +When an external datastore is used, backup and restore operations are handled outside of K3s. The database administrator will need to back up the external database, or restore it from a snapshot or dump. + +We recommend configuring the database to take recurring snapshots. + +For details on taking database snapshots and restoring your database from them, refer to the official database documentation: + +- [Official MySQL documentation](https://dev.mysql.com/doc/refman/8.0/en/replication-snapshot-method.html) +- [Official PostgreSQL documentation](https://www.postgresql.org/docs/8.3/backup-dump.html) +- [Official etcd documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/recovery.md) + +# Backup and Restore with Embedded etcd Datastore (Experimental) + _Available as of v1.19.1+k3s1_ In this section, you'll learn how to create backups of the K3s cluster data and to restore the cluster from backup. -> This is an experimental feature available for K3s clusters with an embedded etcd datastore. If you installed K3s with an external datastore, refer to the upstream documentation for the database for information on backing up the cluster data. - ### Creating Snapshots Snapshots are enabled by default. From 15a46fb7da0abf5858125e531823182bd97c74bf Mon Sep 17 00:00:00 2001 From: catherineluse Date: Tue, 13 Oct 2020 16:28:09 -0700 Subject: [PATCH 02/27] Fix formatting in Istio doc --- .../setup/enable-istio-in-cluster/_index.md | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md index 59df49bae16..9bee04ac7ab 100644 --- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md @@ -3,8 +3,10 @@ title: 1. Enable Istio in the Cluster weight: 1 aliases: - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster + - /rancher/v2.x/en/istio/setup/enable-istio-in-cluster --- + Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. - `cluster-admin` @@ -22,21 +24,23 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/ Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed. ->**Note:** In clusters where: -> -> - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. -> - The Project Network Isolation option is enabled. -> - You install the Istio Ingress module -> ->The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options: -> 1. You add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: -> ``` -> ... -> - podSelector: -> matchLabels: -> app: istio-ingressgateway ->``` -> 2. You move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation +**Note:** In clusters where: + + - The [Canal network plug-in]({{}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use. + - The Project Network Isolation option is enabled. + - You install the Istio Ingress module + +The Istio Ingress Gateway pod won't be able to redirect ingress traffic to the workloads by default. This is because all the namespaces will be innacessible from the namespace where Istio is installed. You have two options. + + +The first option is to add a new Network Policy in each of the namespaces where you intend to have ingress controlled by Istio. Your policy should include the following lines: + +``` +- podSelector: + matchLabels: + app: istio-ingressgateway +``` +The second option is to move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation ## Additonal Config Options From cf20a06e9e779f65d787f3f4ea3dfe684d588d11 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 16:46:49 -0700 Subject: [PATCH 03/27] Remove unsupported installation method from CIS scan tool docs --- .../rancher/v2.x/en/cis-scans/v2.5/_index.md | 32 ------------------- .../en/monitoring-alerting/v2.5/_index.md | 1 - 2 files changed, 33 deletions(-) diff --git a/content/rancher/v2.x/en/cis-scans/v2.5/_index.md b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md index ced269fa5c6..d878f359f5b 100644 --- a/content/rancher/v2.x/en/cis-scans/v2.5/_index.md +++ b/content/rancher/v2.x/en/cis-scans/v2.5/_index.md @@ -61,10 +61,6 @@ The official Benchmark documents are available through the CIS website. The sign # Installing rancher-cis-benchmark -The application can be installed with the Rancher UI or with Helm. - -### Installing with the Rancher UI - 1. In the Rancher UI, go to the **Cluster Explorer.** 1. Click **Apps.** 1. Click `rancher-cis-benchmark`. @@ -72,27 +68,8 @@ The application can be installed with the Rancher UI or with Helm. **Result:** The CIS scan application is deployed on the Kubernetes cluster. -### Installing with Helm - -There are two Helm charts for the application: - -- `rancher-cis-benchmark-crds`, the custom resource definition chart -- `rancher-cis-benchmark`, the chart deploying rancher/cis-operator - -To install the charts, run the following commands: -``` -helm repo add rancherchart https://charts.rancher.io -helm repo update -helm install rancher-cis-benchmark-crd --kubeconfig <> rancherchart/rancher-cis-benchmark-crd --create-namespace -n cis-operator-system -helm install rancher-cis-benchmark --kubeconfig <> rancherchart/rancher-cis-benchmark -n cis-operator-system -``` - # Uninstalling rancher-cis-benchmark -The application can be uninstalled with the Rancher UI or with Helm. - -### Uninstalling with the Rancher UI - 1. From the **Cluster Explorer,** go to the top left dropdown menu and click **Apps & Marketplace.** 1. Click **Installed Apps.** 1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`. @@ -100,15 +77,6 @@ The application can be uninstalled with the Rancher UI or with Helm. **Result:** The `rancher-cis-benchmark` application is uninstalled. -### Uninstalling with Helm - -Run the following commands: - -``` -helm uninstall rancher-cis-benchmark -n cis-operator-system -helm uninstall rancher-cis-benchmark-crd -n cis-operator-system -``` - # Running a Scan When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile. diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md index d1f2a5c1558..e44a8fb83be 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -4,7 +4,6 @@ shortTitle: Rancher v2.5 weight: 1 --- - Using Rancher, you can quickly deploy leading open-source monitoring & alerting solutions such as [Prometheus](https://prometheus.io/), [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/), and [Grafana](https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/) onto your cluster. Rancher's solution (powered by [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator)) allows users to: From 0cd589aaded69c33e2542197c80a91a298337b1e Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 18:15:27 -0700 Subject: [PATCH 04/27] Add screenshot and diagram to Longhorn page based on feedback --- content/rancher/v2.x/en/longhorn/_index.md | 18 ++++++++++++++++-- static/img/rancher/longhorn-architecture.svg | 1 + static/img/rancher/longhorn-screenshot.png | Bin 0 -> 96349 bytes 3 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 static/img/rancher/longhorn-architecture.svg create mode 100644 static/img/rancher/longhorn-screenshot.png diff --git a/content/rancher/v2.x/en/longhorn/_index.md b/content/rancher/v2.x/en/longhorn/_index.md index 14a4cf19f1e..23759df8a4e 100644 --- a/content/rancher/v2.x/en/longhorn/_index.md +++ b/content/rancher/v2.x/en/longhorn/_index.md @@ -6,7 +6,7 @@ weight: 19 [Longhorn](https://longhorn.io/) is a lightweight, reliable and easy-to-use distributed block storage system for Kubernetes. -Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI. +Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI. You can learn more about its architecture [here.](https://longhorn.io/docs/1.0.2/concepts/) With Longhorn, you can: @@ -19,6 +19,9 @@ With Longhorn, you can: - Restore volumes from backup - Upgrade Longhorn without disrupting persistent volumes +
Longhorn Dashboard
+![Longhorn Dashboard]({{}}/img/rancher/longhorn-screenshot.png) + ### New in Rancher v2.5 Prior to Rancher v2.5, Longhorn could be installed as a Rancher catalog app. In Rancher v2.5, the catalog system was replaced by the **Apps & Marketplace,** and it became possible to install Longhorn as an app from that page. @@ -59,4 +62,15 @@ The Longhorn project is available [here.](https://github.com/longhorn/longhorn) ### Documentation -The Longhorn documentation is [here.](https://longhorn.io/docs/) \ No newline at end of file +The Longhorn documentation is [here.](https://longhorn.io/docs/) + +### Architecture + +Longhorn creates a dedicated storage controller for each volume and synchronously replicates the volume across multiple replicas stored on multiple nodes. + +The storage controller and replicas are themselves orchestrated using Kubernetes. + +You can learn more about its architecture [here.](https://longhorn.io/docs/1.0.2/concepts/) + +
Longhorn Architecture
+![Longhorn Architecture]({{}}/img/rancher/longhorn-architecture.svg) \ No newline at end of file diff --git a/static/img/rancher/longhorn-architecture.svg b/static/img/rancher/longhorn-architecture.svg new file mode 100644 index 00000000000..1be35b984cf --- /dev/null +++ b/static/img/rancher/longhorn-architecture.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/static/img/rancher/longhorn-screenshot.png b/static/img/rancher/longhorn-screenshot.png new file mode 100644 index 0000000000000000000000000000000000000000..6f076636b666a50ce9b9ee6a5694b85b32e598b0 GIT binary patch literal 96349 zcmZ^J1zeQP_Ao67h=6no5(-O7w}5~WA}9?KOYhRTEC?uFlG5E>OP9pbAl)GyOV_f* z$9wr=2p>~FMngj*R8o}th=ztOjE06Wfs6A{ z!rf~ShK5GzU?nU2K}lAY@q?qCxs@#t4Nd!doX#WhIK*<>LG?)GNaf{{nb^e=WaOJE z9Y@3`_8+n8S#M(B@o~hxVPPW74Wo~K5v~4GQ}gZ8e8K&x5165`mEhiFfZ&|Ial%%t8a$NILk2z(tlyl6}4 zMn@~H8`+ow-ZtI)0J^@mQ$9wE5(>M;G+`&^X~jo-6;2`_ij8JUFfLDGl0D^s8>VAb z;mf0H2=7R~+7`W7?%JRcAC7p-1I9p8INVae$N5@`nTOw_;b$xocDN#GVumI_Vt$Km zYVa<|2n|i#?5BbtlgXB707uj}WcHU7Ow+3SWiy<6A>^IUItqz>-;wMMdX~Z~!1`*z z?(&}h^}Sm#ZX~KymbUEd`D-V*%l#_llK@1GF8quqE%>aiRxeT@%;y89;Mx;3zo#S? z2UUHME4f{i9moD#w2aR%Zo*2x4C0%P_uA|20UCXtPEKI-99hfkXZ7d`+l5O!qcr_f z!*cozl%Kt5M=QtAH$x4Xjf7>orM5A14R(KdfA>W(quUO-Od^}I_(d5FO(`h9aqibo z;+_&-W7W^e;)<(XPnqYJ#cPD&E+~0p=emk{zM#?f~vr&{61~6SJEOJ|R4>u34^mL`GENOU#4g z$M~e|?h6|(_Jjq0IR8=k5WU9ABTGg~EQ|&~{~UQ z_n)oTfsM#mOc|P%V;bgP?JvTZzmnkw`oKY9Avf7WWX=9BCw#2(+hGBnE-i=4uQ7j` zw8#ge09sKyLTo))reVDBpC&mU7T679$@{6jcRN4f$-lL_fn7-5Y%4i)UjrH$BtpC! z{FC0I0s(?wp2gcWZdBecOS}#4M!r z=3Gs6{kfUM$@410*P4}|dv}n@MCulcgK9F2qg`GrpaAp?>u3^%(B+)WDF(}{*I)eH zo>8nkVv;7gP{b=h2V@W_e`Tq_9B#+FYIk_zJIzn{;;UKIV?Jp?;m4|9P3&<}9(`IN zsmGy~;kU#jY9}4Vyzby|zg7Mk`Q-_x9}w5C;wh$_Up*tbB0;ooEF)hIexmeL6!SVd z@=eEw7tbEC$f7cB*%@9149iT8e%fZ8z;SugGWy<^5-8~;=hOTv$=Bk-w$t!xxA z4lc(xeiJb!O5$)uxg6#Q#*nALpwJ*3IhsFsSq!`(S3%m+7%%9e>0W+|m5u)KR#7a6 zjSp8z_CVhJIerwdcc54ANLflDg2^IEN}ci<9!pTP|8#{&KeoJ#eD+0_Aje)CzX)L_ri(S@l>TV&vml5Nv$qmIBy(%dFIl&)b|Z|Ro8>3@Du zCSiT#M6D6n5W3SHW=dY6%}MbYr`W%?^V-<7l4>SqCUoYrErTlt3R5AFwEg9(vO`+E zqCRyQnwGy!$N6fW{eZi9Go>M^T_92WVb9i|f#bTP#VfoUKHu+*GNaFhN#EcVeq;It z{005Rv&un7m&%ihlZr_f2WBuJULOR% z;)T*TGr6p&id!jTV6?2!R>J5KxvQVXy&NDxxIEZ+}Bw+Le-nttplGOY3O3<1^y!IiGxq}o+r_C z1BMXosqF^+&~!*ZV4Ol|;IEi&r*MlPiVlvUz24+5NLpQ}n{Q;frO7Rw{2- zZ|L2JyR{p@%^|iTMk9u%?;1ua1_RbC79mzAb|{t@*48)o?}Oj}d>h7-Ak`(0f9guC zN?Jzh4S4hPc_>yeErk_DA}QI^T4ELQQZhP{&d?v-Z@M0L(}zGQ5}vw|O0h4oO9DDx z8bANRuFk>B*~eJOMg`DeMJ7CZ8^TG(>Y`huK>fV*6&;fS(;~n>NgBZ8a)Is&CZ#udi$iz9{lH8(%Fdj$20lHZaYp zOmv7p<|oYx4ppk`3o5Lzs<0~ENl7fyiJmoZs%ePxNJHY|OX7#f*LJ7mHg3=lJmK)< zU@JB$uA3U0dcCJ7h)eT6*;KF-W&-;G3wLcF{&nzk(FTHtvP8{4p?m}hBnebfkcXSW z165z-)2Rxmh7Jb|Hw>5SzcBctKWC7r-(pZ~(AGrNw9ypaXy>%NcGu-U@4x$dJ^0-D zyyQs#i0@c*RbaJrH+5B_!oUPohDeoMkX)5?bLBxC&8r`VUbvi=9vd82pK_e)9n~F4 zZAdBbWNM5>hYDD`=3RqD(KrWRR|MDvWEnorA%!NU*O5?yEO-V&QTN&fCRhHVK&ZkbLp8Y%NH(S=0<>#6ZN_KOIvIZx| z&B+oO8V<`PMI!vM}6>jZ#Jff zr^hEGCo&kh2Dgn6prsH`bGexhrehPu*L*zujO6j!V};O?&?ME6G;vSIT;ZJhwyuht zgJ*|@gBr_fk5UdeCb?U@0uGfg5_793s{OYHhXrDT6Ub8FDUniAItRLUM;ORAF4%7J zuHDu^vkl8Q(@zSuo-Qtgb}C>%mSEY%t^8rAL_!$1fI)ndS6M_07wU06iQ7i!r{!YI z>5{VA>6krkBZ?;PU7Ve_pD`yYnvBbMa~x{=vI{TsHij z7zQCpb;#Ig?wre7;qExi$V8febFrJyx#iiy?&JYzXME2F0=~KFFe3Mn*r`Jt(%Dl{ zdad4?IP-k5zXo0nATzHrH?&XzzdLox6OAasjv``Pet2pK6$yG;47!)>m5$GAt;HTk z9-1tbD(9&2DU&PXDSuMqP!Vbqf-awS>~(g*3nB;jsnWG2Q?EIZ$m^0j+vyb4LYFwm z8}WWvtE@b3S+lj4dxkrV^DQTr&&YMhdG;kksCat>iKJ~Q?U0gz%=QUd0PCEWaJft9|MQ< zQ?sW`k4fcc3ZX4Hj76D|Yr*9EC4!ina@r3UmteqErNw z1ypLoY6zWcTm;TF&o&6V2$5mh;dnhZtVSwqLxxFiI(EuJR^rvV)bUqpxkTBo zJD9lkG%y-G7y2gFk9pX)-@O57G#FN}4lF4D%1|do^Zl7L!3*rlN2lL#HGr~{oywgC z%mqLC#7?vOvq#24OioOk{_w3;lSJ&lnlp%-i9WL?n&C*UGF|SQ&_aD5ccZry3lez| zT^I}eiHIe27Cu%q1W*2M@{mR1!*x`9$+XFF$PiLGx?a^ehZ9ZX_!bow4Z}(aR_S#d zmu*k=95Sjhii)nyht}pYLm9YkOF9i!>tA`OlrOD$o`nwvjEB3ZlnRO2xhx-8c{}E} zY*^d$Eylv=5J{Iom#kvorE(AZUE_;vgVei7Kw7UGuj`O_%l*Eln`WdjccEMJ;oRv& z8|`&B&IimxBWJ>?mO+LP=!U4W_t32;&}?00e*1gnV4WD;V981?=vT3=!*2P`-XXqJ zju%0CrdO6%MAA@N6R#BN)BSvd{McnyI^X+|&mX<5%1UoRcX3hU1zt5|0feX2dXWPi zk4VFIa&{88wJ7r_A0^@>E>|=&dow|S24;FdqfPCNo9^2Fmfq7iw|Ki~AMFgaqt;QC z)yF?b{wDR9dyPq&YK=nI;sG`?9{PuwA^7C)uLw|FnW@uV2ICnR`jYqNi{ zA4BU$o0>w9LT2zyUkR*T$8s4---qC^+kR^m9+*yh(C?9S%UO;3qULF5y_~jn z>?419NE_ryEcWy4q%o2g$rjat5TJ!THT@rOSt}vOHqXtO# z8L}FJ`!w8~FJf$EOAa=k*8o z5%zD{@-JMdWPbepK3JyklgK-H#auN36%{3rvP43O>|Ks}mQ`j$hKu363@Smjv@DSR z^I?Ew_g72%X`X(?(E_;ekX*M}f6dI`6Ys-%5HaYbDRQ`IVs1QOakBx`nwl-q=iR=V zlN}jTF#c$(m@Bx96|4-FJs_j!O$#tQGsIl7fCXN$BRLQ250kgH5ZoJWiaWT%&wgrtSd}8$kMK_*Gri=*+8gpxN*K2NsIEr_{8{W z+ras3{r1m>#!3F|d$kk~FV|e<9j`AQ$KMa$X~wy_yiqYgz~7H0$nIH}4H{|`FT1rA z`xf&y7p}#(BVsq}08^zypb!LwnAw35)bh%5`?!qDH(z2g5R#f6dg<>Q>HnaxW*ob& z9@nsG<*a;CDL=Ihr`U4O(DigK4*9*)HstcMXGa0L{U1iOz56ZU&zMn8#Av~bX!h+5 z`4X6D!_;Wc&2TclyQ1mr-ZV%t3Ln2fBU!;5`${mldc#LM{1RV=ZX0Xu3)!Dlr_URA#o%b9&1)-DbTWK-3)F0diPDeGsh&&7+FC) z^O+V;p}Tgq;n?9y(vL4Qs^X18CgfeYj8S)cUsPw%7iE*1;b-ug-jrU9N;Bfw;Efl2 zg@FRGgafX=i{GHpYftkDEQqu?g(%$c)zG-<4h1CDykFe2pmPf|Z5W~%(H!S ziGQN^b=RlLmx3^&IQ-yiWGsb#&!_99|>#P+@BJIOEoUjxkKu1N}UZ%2A8 z;pXu07X|yGjS$H`0J6g{H8x(exaRn5kRVl-v04b#zpBxI^w@+)!4E0c$*{?3QlkN6 zk{qA&K7#d#4L*H5T_-8fXtUNkbYRZmMQ#SqPamAsa=}jBeo6&FoiC27%O=4MONf!k zvt_y$gz5p@;e%nv5ix9M`OlX5z1?}8)=y!xFppDiy5(5%5Q+qE;hW})*KJu1Nhf;; zJ;+LtdpY;J+^?cM*kHzI``B<9z&0B5$|E_yXN-F6B%+TeWx0vbo?}}et%8b!>g?(5 z!j%xJ@h-iQ z6!WI_X=<00k$oOEs-5JA2Md~dM*?pk#&(%*(;p7tW z+$BreYO{m$T=Q$RGjuE|uTwz!82Xp>WKGLwlqdS<k1wWi$cvzP!z5Ddabnf6*7?8b`XXb#Ukj8=F(yzol->xS%`Eh7_8yTqT@L-7ur$jM}B3MN1PJq8~6~ z(4twigLtqGeT;iaLj3zP(Xr@$Q7$17inL?s9ymyBU~rM#+V9tAG-3SB^PtLG;l~GT ztzR=_erAX%m8(e&Ms>0G&h*8$a}J3QI|gj4MKeJypuL~_)4Eo>3rAQwhx%mUp(_Tf zdVh?FvEFE35yq-%8Y(L+s55ChrcWsC(AY0Yu#GgUD0Qeflz(h+tn05zifw!(Vw9~G z`e|M^U*GMs5qza$mBthpV>{041Pa9%;GVh=OxWK>bkfm_DT!G$dD&MxmmhaQ)LR&? zgARpP#8&O(3UTFdu(6i2LjujesVHbGOvzWuA7+L3P{R#WR~BmBF5xfS+|!G4HS-*E z>68@c6o;=Id-+eTr*tDuSNoaYE2N%qF)-8Sr@4P%*NAm;gmob%Qa>K^dmPO&*thQa zeU=B3y>~GgT9?m%KjiX9%dwnm3Z?He$~f&_V|5VUi5PIh1;~^FKwTH@5W-7!qJ4&V zacUpV^KWyXj-5-Ao8Xz3(#z*tb|^f|$K14!thgfyKD9LpE!=xLn%xccQ=XBFMR)`z zqLIFjNzZ$mm)>f3{o&$xRC%2(d4#WeW>&~a;y;JS<`=5-!-0(fjEFmm3i7ME|Ct5UHNwi`Q8=C>3jZN{^ zs+lR}*QV9vT~;`GYh1ezI-c*+ z@0bLL`9loiGf-Q}Ttx-#)k7W^4L#5b4eKF?{*b625*iw2bO73;hcC%PlFPvO7Zh7K z1M^>bjETQ0%4o3GwAeTGH z{x1|Xad**&EC}dq%;*lX1v`nlOECSThUi27uVQW{#(z|Cwvk}cR{6jvYv%}L6ySQz z#ls}|n30iD+|kTj^rPI{f1*G9NibPDJKKwLbGx~@ak=qx**RKp^NNUwaP#nS^YH;5 zY5<%(z|O|*0I(DD|1|QicI1FgrjAzj&Q^9{#=qJ%HnDSYmSAG~i_pKH|KStpZuP&E zz)t@Z>p?*7zaZSaTs++WZu`=bBp{OXuLM#5??XQ$Qf!@HNybRWmo ze)rqQeT?fD5|YJ!rGbSk=Dc>gFD&3>!o>(-V(*WT#_yf_*htZMh-!Ud6`y!B;xR6i zm^k<%#>~*16>0c$xEaxklC-Nz6}dDt@+Z$^{3;#z_=>BcSat;7C+gdN)RDTvRF8%A zR2mKaKVBa>c#J#P|P# z&;FEvWMy9(tomOn6h1pb;@anp#Wemu%>DB>gBhC|*WUGo(AJy(i}!!k_SJkG)sgs4 zW%s{;pO7*7SIahtQ2iGHK77@g&HF}C zwh;3_75gvd(6PoCS4N(8Kri?mvB!oumryTnS9rjjL{o$i-&pDafHc!}6J8;LkMGa&c7 zG7&|g{>1;ceg2aZMiq<>>0Qhex8|G7g|bLxF0o?kjbo9$6!;$XH|Ta1UgCoOT)^L} z_ZaKrqWtY_cQU_ZJ=NaPQHj7wsRemgnK{+pbIfOuk@>u~xB#J#D&$Zkt<-}DM z2bhIqw8kk^i2WDq)MD(WO4(_l9FF*V@eEYj56`jF1*__APOISq)2h@v=Y>h7_c02D z(M{a++;z%yi~HWTe{a6Nw#1fE`rOH$8@#gXl^m?1`SsgD=zJNFA6{F??}ll7;Ki-5 z9X2(6ftSq)zsg(SiJir_1P|Z8XJwXs#ew3S{|SOF*KuG%Hn)b6+uA^ZbH;;t08bXu zpHY?7`>FZu-J49C%4ww&gYq&>p#sfmhx69A9YQG zYz2atF))kzUXtESUE9ac<;(0eb+&Oyb8iFvZp5iZ>ms$G$ZJv9jKllSWf8iI#m&kA zg!GiP!{qTL+5prmj@0v978X9wb)GGkeW|H{a6OnvWG^UpF{Bd|tbf?5+QVoFVWStB zDrMRgiDOkK+j}G9-D>#WuJA+g3`u!7tb8$WCc4CG-+`0)|DP;z-Ptp$3+e#<31-Pt z2SwIZ7Hwm1W_3Ps=v_{~o{irn%f)Ws%d>Oa882ll+Jy?7S2@qO7P$0rb>UocGRE6} z9ghf?kUVKFo&t>`@PQ}avXik`0AHveCD`)i`w+vJuiMda#lK|U+Zfq?t^SNzJieUx z(zUf7_?}(SdMnxSSEUMucO@do;%RxyF-D4Ao0P()PYoxS-xg@2Lh{K>=6zFqFNCZ- zJYq+_R7l0yaOy81KxFl|gS?K(lF@+w8DT{4Ht}b!*2l}m8oC1<)%0HU7tr+(Z9jLq z+d8vPj=0+>=5t$1JL2R1U$br|QI!2U?wwhOw)JZW0z8g~Ue9nah>oDl)|Pe!jS8{( z*$7@GFkibRbY92yQ$lA>zaFSm3t5yeFK(XJoVV}Tjo3!}Qk8QJ?AEMg$IY~x?cc!; zZzAL0HMbk@xBeKozZ-F$Z7l|34%pvZ`k42!jY#l=am>t8K^}v! zgRJPQy{2>4)H(`{hRfcw$9$%%o{5!~(8i>ws?)OOOD9J}OL;%X>2y!&X$~*uI=7Iw za)8%Pq(fc4&BhQzI=e+U!z&Ft$SVUC%Sn&)`d#52x>NKIPGq*@M0s4$vzAR)rFmGe z|GL_^ozLnkgi|pLok6qFc?MegA-pP+vDvUL`jdNAdjZ%xgt@JDDJnrSG_|B#U zUjEOvF)uG$XZKz5QE7tH^%f5S2g%Xp+}8WCKbx+5j`Oz7NDu1K=3}GNjcE${m#~x& zGz(*JgtA0V-LuW>jg4GAV4L>`HJN`8qagC5*Zxi}DFmuw(7z^Bpd9xW@hmOA=kT-< z!4_yNP*QKj32~68lL6*&`jx>)B~_t}nYftp#k}rjoy+1!T0V2Ai(Lf55UdlaK<`>W zYCB)o*55bm+!Uub&)G}G&Cds0j8~aW0-wNqZ0-500AjC?tWa{U={|e64UQc(<0fj0 zWgBM7OKB2pMRa{XyCr!*YN>Y?6jN4 zD;Hb*x(RH*Di^i5n=6LHfko~?C#^b^hkN<~Uxme=Oor=(gx(dyT!f@r5eKDM{hJ=5 zPm;xKAzNAul7j=_;~uL#Oxk6 zZnGn=m6&rcK_mSa{d27IrdkBk<AA1@lgQIkxYBS(ddtOGnRlBwVo4|`Px5D#Ud4)@MXz45 zYi~k&QcRU-A@09cux&-(btXTM?e9H~x`8E3m$82Uf{1<+`gBp7;$a?|IHSZrit`jxHev?q62|2nx*J zme@36A2Nkv3vvGxWNGeibllq72&`5F`2(f$8oT&|Z3An5zu;@PlId@gx^#3G|Ja1H zce3>HD}Qpeum&{UWbZUs?e1!hso{R(`^V288Q~GT92OA_Ol_!NRwt$S5kD%0Bwu|p zi|?ueo>c*HSxKd(jX3eYF9SL zC8$3jq)J65)b7#!+aDPGWFuPHo*x*#i$O+L9z(0!u(siz7@1j4wzo5uG`OoRhV+r1f!yirKq9Q!ZDg=gC-bK3-;cc1_8M8Ab{$ zeUeI~)vP%*Bz30uqLT58ZDrXpSO_@-D%4grBhhmckD1&f4WprkRB$C%s{DMm$6ztd zTFi+ypENkbN@jKxvg2mRRL(ueSa)9v@{ul?%z#4%1jV$j#ufxlI@v7xiDh4z4Re=8 zd9*cue1hCf=eydq(iO#u2hSgxIq23+6>uC==hMw;NlLvGZMQ;K4vtwbaTojCv6=rLwW^K65@j;q>|($B0FpwFf1H=WStMmmV9Zmv=v zg$YTT|LTD`cHYf-<~N~kR3NER1Y0(BZhLp&J+Z2;0q-!O(}vowCW*#~l=FS0j5iirBg0<&pE{44-~S#yBNJvgSMX^ee@2;NGYhfX^@i?5~D+4m$N z8!)fc*;tIWH7{xMVU^V5IgMy**+SN*;7=b!G2B4&795brAIlit?T--&1z1v?Sb$rk zpU`M?d5DNqnHtsVpN(5=lt#W;j0KhSv$c9eI8Q(4xUk8)97#_DxZSllc)^2{=&q}a z)uNXcLv!C9u4x^nbNM6@OOUT3Nfmk-+B^d^W670jy+QYDEgO!L2Hf(CA)&0{vCBRl zMH*@?-s5`B;QW-^&V1l_**lB2_&H?8lvI6|rlUa9x)~kHY3c;Phn!+d$vEI&ZjcT* z<8tZoN-30Cc6qsbN9BT^`laJ;^nNKcbOXK>7B|pC6x}vtkbYG3_I#Ih#ENmEu~zS7 zD;_Fv^73}=?mX!02O&BqWH)yjJAAi3*~7byKemtC{B>%{ei5E*SEFu%RYfN2(Lr)!F zqftj4iq|Q6)BRwvUHd8JG=xXpg%1UAEgKegyoiP`ohK>N>;C?8 z+jbe9y|L{pvEDYta{X;}EzZE!M}`-MMj=28IPY)&{C-0s+;rRtz7 zEDO)Ny{bnahP|ANTeztGT0nE9e8FcZCY*<8lXUYlmu`*Y!Q}gWDT>l8H*mBeb*LTMdrm)%Y7Q zE7M;_k%GhE^-DXHr`KjuA7766*}1UOB3C}@M(4Vf`Z822Wk5fR!G5vi{07-?dhTsE zjhcU54++Q7LqL9$`K0B>e9beb{B9OLOZ3mRP&D}Kg~>@xsOO9E=I|zg(HY@NmDamA zwjIOFsLRnW`Kpg|(A6OHx=Yu*&94M1j2A1(EqTV%7N_+t8G>xz=o%{EJTFDhWeHz1 z=@u-|^6=PyMQGA<$n`84VP#Mbu(vcABz@SOnmBbx3biK|l=Yqq606(1D^YSn1Z~Cj zcFnEeu-oieclWG>5$>`+-kz(>bP~W3ju{H8HRW$f5p<18aqY?wv;eU>L47=&f=O4J zrTrtwgPJ$~1gm~InvcBEy15RVxRi8A5idp`IVnDLDnjkurvQ@OwEFV}7(Ea*%w4QX zp6lmC!1Jk5%7*E5Xsr0zoQa3=ur(4n$u_V!t!hQGas#g$iGwd)DW-Y&#ChG+|2Wyv zcoIWT&C{|1&jkNu5c4d!Io&*6?>raVpdo6>T=R5|5tDN9clVN2lZj{m_^@Jdy25l?c9%C*rXx(IBsl_^o&g$HqooQj;NdUS{4(Z zt~;eB=hma&n+0Jq6rFchM$Y3@s(E8V_Yy`I))c#9wKj+|?sO*jO_77(pYNidQ?Tp3 z1)+t_<)o=zpYHAN!*TeS2fimE&wBG&LtMIB4-ub+87{Qw`Q@z7)8-j=W;Hpb$37-{ z8?aZ5jd}l=2ZilTiWQ%=5`;dspA-HOZ)|DG$qG?p+N-Vn0QgFxQz8^Fxev^atP8m;zSwtDQ!bBcMD8>w^lGGw7)GFm&g>*J*qvhC2+I5Fp;sP?A2pHE&R7yyGRW@bJNuOTL%XmG_sk?@Sm=;G%KFFc&MjSf^{3`$e5ZZVl`e#*0UdC zBsFB9d_CJETqPC7S2@!q_@lc~neEjv9}7T_*Kl+U!{xz24%_vjX^X9?5aDG~~V=`wGir?`nBdto?KMssMuXftVQ+Q*Lc7J@}D3Y;t z^@~bDk()5hc3BT_>4S8h&5}v!v~!=3kV{K$c}KqJ5_fYL7t`%m4yYZkk}Oqj-f_@z z;kmNz(7~Uhcf3tcIi0yscwNx6Rk^p%!s6SmljK`-BW7V8uo>)lvRE!Oy9Y+Rv7t(o z^*-^7X|NI#Ke^MLMYU}Wq`%hon7D6wMPc(f7W&i`Y0BT}V=0wuP`ccBr?S5Mxj*1g|l?t)CbWJdiF(`;x)vg@m9@wm=bT@UaPziRb|-kdSETPe(DrLN9bgZ;9X?&x zC-hvpoqE@xz|RQ~_Uu(NeCz{|l(c}x@H&ICUg3l1Bp~L;d7rK3%tT!8w=7qNLa+s< zy)SK%aZ4k%xc0iq0RD04vd#w)S4R~+*!ja?xwXBYiZ2$}TWIyU-QKTsT%Gywxd2$Q ze728~UliXut%HW#EDRJ)jJue77ZIT@;GwO?R=;1Ocr>C{?ADu*MxY{EBj;a4K3W4t zUUURuvz!C|cu5?LKF=tbnO-krNMWdhCD*pZxa^O>%YL$3+_YATH3Q}$E9QuP)qgwf zb6lgoR4IM0$L=U=9mGr@P1hZV_Pcy_`mt#cK{drq;12GKAxg*5-kekJ!{j z9R9d_9G}-l)x!1DRkymM+_TR#f7mcvjOcqgAaqEcTye=c)Eh=%zjVFTbJ>P) zZ*qk{ocrvo;S4M<>Au3`Xza5~k4#%!jHo-<$)}YZEo{nlol`}8f#PVMfR z^t~Mqv@Kv;9JP=F7p=O3rGt`-zJ(ZAfMYWT}$l7`~R*sQY^3vpLU;s?8-iobK3AC`1=k)P*i(le4TI6h9+pKvoJFP3Yk=*?%LW3%D~M9KCcvo5T*EpYoINokv7x@H zS^}?uIf>gSNyi&I^B_?EzatGG3Pn>Ki{`h7#f35Q*ZAjF*ZBHom1@l(KWvWU9wxoK zwKu@`R$SWT$+MQz6Z$>*K!=_Pnue8Zph}}I1Vn1bN8d!g_lK^0eM{jH=<<{GTXR2> zk>ZB15%)=g?P;;Xl{`8dnGeZUl2taS8={1s;&>Nc45?<5su;r8J}QY6Lv{YhU))VAqSarw=52vga+mi;RZ*xK>s_74#hfc zXeEEuLE&TUo|5E7vb}h!@&Wg7S6|Kv-sO^-3DtQxpDOeFAFhk@5FS$&#}@22)uq~> zO%=##LdP5RBr^=ur5+}Iw6NMtMgNuKo{u%gikwj>dbQc_ z_J5EbONJD(GE>Zt-HOlRSL!4Jep)T+gE)Iko&7Q)%T_7vFA^anhx(7~wA^D{xFZ2m zwE|VzJo9wSV^j0fb)`;i2c>{Y-lqeaHOD#$ymz1%z?kU^->)wBu;*y|=aJ6h3x~>d zr8-rp_2+b?4z=Ffrin3NCFkWu#D%Sq)07JGB>Ry7o;|D6eJPEzZDmFs)MHMf4wBy2 z-81pJdW0@T7+ysU+H@Xpta(mvi;F#PzE?T}3*<^(sc$fKg(oJEu?~u}=D#6Nn8B#QcS5 z{Q18ENYd39h9g-^`+X1H#Yu?D<*AxMyR@lEjwGX5W`}W(ISBFBcA3-kL`YH19`u&| zKDhS#`6Z)i2?`7A?B(SFajN1A_i#)}%+qC$!4z5}>U^s9IN2%Z&*%9VNU?=YRsLYR zE;_+!?5ag#xP7iavaO9Z7Bx)?l5c&LghoGcRGk`}QPgOPSfy4TzTh)e{}XI52LZVm zI2G|Hjv9;%5o!TDhL$Czw7^$ud&7+!s`PYA=G^;{ISdj410E@bruwaCw~+%tHu_yG zSr9}P-)CWtq2mW?o;N+wv0h>)=N(Oo1-@{akg>bwwAUWBlp?>_vSHQWY<{k*s95(+ zwQ}_!YxwT;dZax~F~432&`9SPy2qd-)UZlH5lUxaY6;8N{^E43GXB?@k=!R!gPh25 zuCU4u!hr=h{=R)8I%H@Z~70zhkKyt>G#dd|F-G zT_vm*N)P1X7ech9xhV4 zSiEfbT5{o=+@(abf2+I2(37oBi-BHP`N69!8&Py2C~ z3dVAvh;AJS0`h&Y2dk8qDq9<#7af?Z2`r5yU}|!yIrB;(Tz*E3=IkHx=*(Y~qtCnC zNs8Ta$Ey!qcUXRbYHX=1dIIZ?kT5zlcIxhdO6asPh&!A+sKW9A8vlwb_-f*QyMB?I zmG^AY*dWU!l;)^LN)?gN+gqhkU9kC9+3;BdfYcC7$fwU^)z@es%9kvC45pL%cK@FHf@;vbGE+oNx1bX3ZGmaAXN7SQ9U@*YvQ|R z`%-W?Z(d?C4Nzef+3SL!3U$&>KXCkGjJf_xNwjicOD$&d(tz1W%B^`&r&a|lPC59x z_-llLhvGe7U}^c?bJRR{%4Rccwl|V??)@u<`=SNsRV=orA9H<1bt?z^r(y%!T=Rx) z=^snZpWZ_^%_ZHWtZq99T&3sh34Vxq=Tahr2H`%kyh z_2{ARLj)L)`Vka1tdiF%C8>o=!eFfcsq935YJcyy=eq=nsXOa}ORuPj{u6 z=<||ieDy+Fqu9wz>ov3&W9-6xyDB&>WsWZuAt9v{2(4FTTh;a0gQtXv?UCDd^SOca zRcY)dF^sqi3l|xLG_K>fC`66?1$*+KfH`k9Yw3RT(+JM^AD}g^IpuAssge&IeM>%K z2}28rC-0s2cCu41-!<#Nm`4&{mOsqj46S-So3GAmE%5dAK8&}jB4*>6>*nuD`<7~E zHW~oq!SADtRjR-m6?Pl*NPZ64R^;Y zAEtpj1Zgn&_{5xAU6~_OhnirpGNqoi3Yk72p)UE>?m5jbs?f@}2ae6{SuSm9d>+wF zp{KSWomy|xiAGH>=Wl&Ks8?#rHo@fiz~DJY+ZF!bE-E6%(KpDQEfUc1%z2%GYsvyE zoMll`Xgl!?y>ZP#;Qbi==Mwy#DTz-f-yw!S9vOu{VVcL1UT!?1EQI{Ap)NQXAhqLm z;p0L*gkkg;K(Ripb#J^qCzXaf?;&Vr-f#G7k@xROU45%go;22}EcVCPEYL{vhost~Tcy90$@^7gG>shdWq`f*eiZyt=p3 zd#R^-T30*x(*x?AS^T4^;Z#?VK$AP9f33PHb>#0A7qg3{E}0GW`TJZdMM2UA#k2Z6 zfI%7|_fx$Ry+64MgpPNVu1zT;Q&hh}Z}5|eTTb8#svn)XW^*CVpkpT(+un-Y!4-7BRQe7uHd2Qz~aYrc^`k?9dWXg5*gWX+@|wmxj^&^z=~(iHIzmu7+1_ zKE@+?n|jDTtkr09hjaTg=Zq~?S-SiB;?YczAbA!xN3jpBqkg4n8>xL2*VbqAGD4ks zEY*YQENEL@M!env+ZgSzu)Rw)$GVV8XW)H5?=u8iy27)xWU2-4M<8XGYbg0_S<4*~j1=rn)oeAtOO_)>f z+}XmGr$@Y30QvK`{MWZLt&#Kf{en1Knou7ht$ipT3oB_;!|m+9FK^VauZ$3MKQi%!9{s=U8F0txj&50u;(NDKqd!F9p}+ zhz0XUEmA%|PJ@c1DL6@w{j4;873a4}R4Xx__wokz*Z&R-a=BfqcPZ9Ta{>hm1c5?R zIbkiZ;VRihla3zPPp^{&{!X1zKq~X^+9%uN^LRXPdIkvHU%_`yN;*9g71KJl>iwqm zGBa13NlC$m4>s>1d?GO-TJlzz!(N8ZtK;p+>%>y@y(0 zoNa4F2=0et`=@RM!!x%4S*t$W#6u60y@nAx6(ETmOUcRtE5 zc~!g}TpWRKp;`<36LHn)tXU2o14!j7#ao%_A-3eDhTc{&>Svi8Mk@IabT=-%RSo!I zd9SQ%CljtAfVm%$Kmo@i4%98;eGZUh`*6`{9xjhlAPdPkST;LQ+Mg|Xk4zziWcj66 zqH2J%d?U6cZOUn86%Bh;jCTS_F5>U~VPMy)rnc}o5DaCH4Jq#%5aFIx*WoDVnx~#*S*W$zfuyRGnVS|jc0y+y;^o`qt3?q0 zewt*-GedJ?>w(-kMelb1?Rx7zt5_D3t+uVHw}B(R=-^cH7dH7SB>VEg2FImR#&m4G z;Bws<#^k*82Mdr{u*Adw^L^-R7LEbBA5Q3PODsHJrolq&wQvmvW1X zq?76U*RZ6T382);O>mhDYS=)9&yqRP$w*E71b6Ftk@JHaG*1#jS7JNhayS~+AS9){ z(6Y?ucZV`YReeVgnGE29%CyaAm4_OYHFd2mves;&>m>(6hy<(ozpfl8+kDi7MC0kt zj)cbd7}i_{iZQ!S;8mG*c;BUx^OAZw4Z$Av^ehif2;^?lZ=@0hGoS6*8{RZYj1r{J z3peu6eWZ4_(WvubudUd%J`^u~-f?-cKf2*w(Az@LC%kdmdPJ3V>t%MApO>o-NQ4Zy z5z%koW1e-bdu?bj{3FI)N1`$Ym!(K->DsAA@A~rWRt#}>9{``LHO{eZUW9Lzgu3DG z{cGEXeu%~A5dFMq&YizdF96t#mLHCnK)7L=pY|d?H*ruqf_x#R#J6|qS+b7T!yT7Y zr`K*N2n(vzA2CN=^UIBv3a-VGb!w1lV2D!I9uEh8m#!=4U)S5VEzt*V-pOBRDbyvO zvao$I2t~;3h+|y*AHv=`uF0r<9F{QrajX)#VE)66HpTmcsaCQBcKT3 zwtBccHR?t4C8{S?=1C4MmOe95dvyA* zS<`Ly=03%py{yGLi2SZk zBOz8ru=l+0ZSz6aVa@rGCg@A{ZWDEr=ZyXG3ZYfBf#|%eeA=KfVuG@f)5UlvU{Byg zc$~$t<

*=1l3!u0^A~l{X0N>LfFo#VNNmSXBG%enV#;tlW(?u8uDlPrq;XRRt7)Ri5V2{U5qRBH##`;L()p z!tC39re$Jv-`P*0gt2Kw>L26if~&vFS7HK`aJ-&kgGll%lk6!Jf8K*kt4PoOZ!w-T z7R$!3y#UV#acK@aX{qUkQ}%HZQx%4eK6$79DWyS?|0M5!*N4T-1CnRt=CuRSIes`< zqiUI$RRu&C7CnWZs^gBKU*(=I_S7l(Vk>e@WZRsf$>~<9!oR9p{<9nqT!&||^$>jw zYQUsTc}MzROZs0@_m6GZ6r5jv$c^pq+mfm``qIff6mssU|+J_qR0PMD*pumIEvWXTG1isu;x>X zNY*r)WY=lvNs_cBP)LhV`TdO~@?u+3N7H=rzN8UcjIXImsEg=P+_}V?nxy`*$p0qh zKWolRaB@U~M`wPG)Ux&lC#lAutEzm4SL4TpHJWl3y$&8F2h8`N3;AC4Zsjumb9?%~ zsk-q9BmEb3joa9!5D@_99nddn4hsuVN_tPC!Tr2i@PF$Ojit=KWE_k|bxdRRH$1y} z%I9%&;_jnk=Zwcz`z8&pc=kI{WsaDkq){Aq8Snb-aI{z zR6Bwa0HJcGw+8$#iT;5}jWol(hwanY0)#h9C|HH~cfqsO7yk@`|HA!Wj2@!EK%*E= z-Sw|D-G4nNC69wHc)nW?mjBDRA+USN{_n4|;5-TUVVT34`5)5$^REN>e*KYDl+p)Mk#MnU`eX8wW&;8@qMl;}w_Cav<;etsS z{!JtW!#RhD(e!FWKG6&P7YY6e3mS1LRtmG&Of^5(M!p-RPNXTw%K1zHIW= z;pC{M*8fnpj{gKb5t^Ckmv&fKg_QnGx7xUU5rNV-3Vhd*v$WK5pcUSXr~>5@(Uk;Dd-_nW^I^kS3)v%Y+S%Z#N^sLy&S9(J9& zQyj4vk7e6RelAR|=z>*Or+qt>oR-S>4HEElhLbsl_duKmG*Kp$O{27MnlbkN7t<|M`oKlbBGcjwfTYj@RvF1BGYp>gu^g6Iq%RlWO9p#H6oc1f(M z3r4qol-W<(FcL-WhTU)EJgDVf=Gbyv;z6_5L}MdI*Z&a>?@?u!ko6l~ITMER8$pv| zIK+ZHFmA&4+Q~nmZ*Z4QVuqU&Q0Ev_v_~UxSGwTb` zFV)x@LI-SaH!_oLMmYZHn1gHVjLv@o-Kai@H{Jo%?4Qsw;I~;HCWLI^jhnmPsij?V zQ(wat;pZw+g6=-L%`KBo*cw(?{PY%eW2SL_M9GKAf0N)pe+_YgS>CklhwX=ZjMF2{ z2-IyqmbJNKz@1C?yizmC`p0hHClcU+l|EHP7hX~R=bQf)%ONE!YV(w*9bbYcXNS<` zGsiA%k(#sz*;whA7dbooc~!=2i2C(LY+N)s)z|QEz>N2H?#cFU%-5i1qsSC4m7u@ zrlWqtLUqT|)%Ho%?k40Z!5u8ouMSbuTUNfXV%)bd60w^~@gvYTdDZ~uwNs*M{g#ZYJmk@SozF|8LU^yl@?w^UB*9bu-obRo5&xdALGR?-ST zIY9xc+1t(E@!<^=6dP`W)&?MjqhDnubKH1{0oTDDvGbaAfA7INo0DyA@rjA@4u>wU zCi*?spx0M=owO3VVPRn@;t5#N>0TGyJa0xGQt^2yR-ap)b>^r0$=taUzB)7wwMW%STq>^5UY$mMb9yRj)2ZlEv*3#jd8zd7OvvPk*?ZCd|zpcR4}h_R&t~P5w)b zAwztE&Gh&rYTj1_O&idmhd%M-`^{5_{19VM0lYE`y0!QwAQ(r@NXW!2_^>_#bvY#*&;MD*5 zfwF`V2mftbi;ap`E;~QF`eHJ_emQU827rCM{m<;GP}xM5*H@P#f$dVl+dHmqKeE&I zxLyqUp6reHd|Zep?@LlLHg1V~V@p*a8$uX4GiW?j#loR7Q+vchYla zcSXGM#Fb?A^%qDzpB0fFnMS0s(sP+S#B=+R2NkXBODemDx#^LzyYdS)dkr&AH^0e_ zKjQFYA$JMI!by+0S;ytPU=S4SI==;~nmlPoA`|X1$@h-gfLMGLzg%JyQggh2|Gvs` zcV=JW`~(?yeZHxlQg@CF(=h41%gv747KeGNE>oYs=1PO&O*789Ms|i%TMw^ue53C#i|oGN z^_=7mV3D35EUT@n(_Oc2sRj+i7lKscMhC^%ZLbBbRFaa?0@XOIMeTp#tX1M$8^Y-S>N-`nJTJBCrfhf+>Qsq);Fvm+!D$i~iJJo46a9+uE+qotlC zOGvj16x#K|Q-W6o$PjjD^iAFhTCv>{o0TXbldtM zR$gm~h@yMZ(XWqeVZA=GOYgafNt)KU#K4B%{?$3; zQXztxT%hvSb|1GGH#vFBD&C|&GeqA;AEJJ-Hdy7g4DdcYqH;mQ1o4S&k(d=$XEm)l zM(am-a)iy){<0d~aWvHRs3^e&^^|mVCB2ysG7a;cH%zRj7{rnhpHiHGGGoj4myx3=-}q*nxzrPPFpJ(_gAMs(Pivli!m@7~j!0o!fZDBN1vR9eg(D0J0>Bs2uQl3LS{xEy_ zRY~=BF}I+>1>!p;#9hyS&lNpXTG76dt7o)nQP4TV?Cb9_uiHuQAMp%ZkaOvLQP9Mb zN0=!%wXR%s%k7BYv?7V@MuW;D!*CBD@lq%fUPHTuDig%JtVvkbN(`-*pqu>(xiX zE*DjV6VgkYf{XXgOTu0s-M`)t|B-_xRzWO0!niYYA~E1@8Z#Gm19i4J@`dRKCOlY zYfHeqO(=u`pD;>y&A1|+J>DvM4AKe+C~)*_>qcZ{y~d@*zoSrw_!~B6Prswz?zU>^ zfFFb0ZB;*!`yTsjCvvK_kMOXmLq+)g($I@$8z@-bx_$_cSlSDTrr`E44M`_h#~G-r z30394-kWvm2_F<^=QZ)w;hK2EmfhR2xA0<{grmf`T4awxv@2?NHaAPJeBZ;j#bKKQ zaq+WCLeTLga%cPgXv#KT`or}^)aLBq^eVa<6uE?Fhe+g1buSr_s7!r%V#OwU3#}LP zP4jz;0zDcQ-iXp`k#NWIi)+_lA{AKa}zzj|BqOsp*nNIeY5H=NHo)j0U46 z?5Q=NW%DS`6*r@A_`3>Gk~8`zTYcPey35UV86~PO`CP^xESIhJn3%@(GU~1(5Pj{^ z!4Qv`Uj>!l-!@OE-MP`s(>*YI(>}x`B2Z`t9W_+nqTmrqwX-US?KCrg^z5F~g&H2V zny`6_$|oDO_n+p+Bm*5DwNo{gHCE5m$>C90PaX{2OFFMLthb~!z|O&1EGa(0qBMTE z5=Bj~GtezdnBZg6#o@v}vytXU2NG2FVi4TNaA_kIIENtPUKRF#n?$da> zEMJ^z=FZngf54HF*GXG_YndQ%yf6F5k1@A45JWY)N(^l$BO^Mzi{J-nZl26dS3{FW zc4zGIhm7caU8hH)As&XtNk%@&O-&Dd{g*LGnt!dX>2;R}{_dx7aw5!I6RlZqTbqLS z3##?cUI3?iqE)Y_tAGlX)Hh~Dj`8?9sYxxAJ0V|?PL<(4{dWhrIx;mb8grw>9W0wAqb5H^a+RW zjB}N_ddLNrmHJlB!1F`%gU*Oe_}Amg>4i4b`1V?Pv^cddPT!5Tu;zKj)0{*zog>k^6%4G|AWo$ z-R@y@ULv2cF5e^S=A-i%Kryn42b{RhJ~%4l|MU9){au0vsfwV_ONyG>-lzy}VGv>2 zQ@8^l_W@cr>o*)PcB!CILsQ$EQ|cJeKx%60?j=-rqU~QoBXf-OLG_?fbMvCVPT?of zxrF-g*BR{4*~}Az&u4%6fEES|)j@nx?_Y-5e-A%T^!dxMD+c=8kk6zyg%S)wL3)4y z$vAv(OXZfoP`FZxftVOQ#l7UMzkGq_9|WK=u>A`kk-z&>_(bnEEa+a^A+}a~dvl7VkaGW=Dwy}EXzaty570eaGRKD##;)_-jAYDf@Y$IU0Kz7a zD{_N$qxH`Q19)zZ7675M7_hk+3x@9iuvE+~P?%~V;Y|t)11O@%z#6I)BJv?+^k!yA z6=9*1O{;mZk?ylQhle>i6&il6-L-$oAcE~Ft*wa*#hj%G$0n4F9ZG2nW{_gD?rUoZ z8<;5o+_-f_UYJU;&7=1uy#DGRBqp9!o^YqB` z%{APD8(~4ixBnd7{6aBkl-+3SMq$q=#`)Ga6;aPMem@|P5Cg8At$9=O0WGF(5kaa} z&nS&z=3c`lUd3^H|8&ZGP zZZ&3$F!_yc2u_YhyOnKzxX&Hw!aFzd2QAiW=>9OG@D$#gqItB2xec&z_6d5Pa5Iui zEw|9>$LX)Sf$6vU!uhM}^u=gPR|;v?TgU&)^dHgc%Z$QZ-J+1}X7I%*_fIc?LgISs zz`soKNeUA~E!v`x;x7}RcV8YvgA4E9JlsrbZOsroDr)>U3#E>A5rD>#?DO9gyz=h` zG(J7b^M8R4D&_Alj-iJ1D*Q{wmS(c*9I+alWIubEM*K!kwMW5s-FLcsbBnmn0jjJx3SwV=C#9b z0S0h@?uHeuCV-9%AZEu%ujr*sosYVV}<(1y^hyKm@)BVJZrmJ83kPqChpcsTpX7K zZ>=NNlwV1=l95vgb&S-dM=<@v2oDjh5S9=Z>T?p*Zs%k=21__4hMbi$y3gi5s8BXV zjzf>Pv!4fIPizb}`dC&+|D1W@*LcQT`to6Z=&u8xP4l2%cS1gvJIDVD?+j~Oee`Kg zVpj+w^v{;In>%>^NatXr?)2ceESD#6(V!52OelIwsuYdAl4^yC?a_-x;-OHM+^KAW z!2Z)Cq(IvscO#rh;o!1SGb36iFpX?&Rar?5d?-}q_CbY9QX9VIpA)~fH7JFSrD~qH zzvgXqXgaB5T^-rM^*wsz;2}zLx0?byGb2Lq+LocZPIt>~f96a|Y6q`?KypQ7FP8t7 zEmdZtuyAZrzT~q*&R_Zrr>EX@li2V-dpa?vfLa>n3WQ~(R%`Z~UaS#~YWbD;*&~pV z19ttq#L{U0X9$UZyd7~(^sgq>SV&qrap0yB)tqC>pQ62?Pk_Ud(zrSMW#uUNVz zFCR2c;OVRoCw{Q}9^1y@p;<2e(ie5Ghq=}K$1Mry5`HC*r>#ft3`pj8cUNN=g~b@^ zT7lRT(Wi2kIrsHrk`O?N@UT0gvz9L6e-z1GKu7O1$(*S1+l1X57BY9va_~F=|uD~#C|XUOWZ@Pq@5F z<}&N(YdJp_HSXW$%b?nM2kxI(z-${G5LXWi56h`Bd^$g8h}V6EhF2;C2S~&b*FJIk zVL@^-!5K`tDF)C|Eio3i7f3NA zb6E}+#!Th;R-J3?y@t9GRX$K@EVHetT9{3xPqbDu;q%I$mU{mK(-i)6RZP|Du{ z7E?Son+;CMJPpITDDtQkRDW^V}>`qdbXIK@Ir2FZY$oH6iQpjN^bg&^K>&-k+u7BdXhzM+!g zk3sgg4C(q3e^dq$&_arXPboI~cjx)Oj`E2ABhgz(i8E0W+n%_HKByU?k#raYH&XkF zzOu#TgffaE@Vljjr%%4h0Gj(jOi%o~LJzt-1y|>d`z&j*`5Y)*!|DM7!RPx~3ob^} zj~Z>;dw6nRN1%Cs%=G{bP`+xJN>H_O^MD9a&Va%7WZ_a%$Cwiw1h-XFDwc|h@_n`9 zndpvO?@vpd=yY~L%L~IS)|Th<`A&Kz=gGE*US_!_1d@mmcV+*^wI4_cIhS*Pt!gpW z{9-ByCEC<)@S%_6#hk8?U&kWq;0clZO(FyCmfP>~A3aKPJ&#C2Ml=uM`dMwe5AC7u z5HG2eOM(V9!N$JFBJ+dWTU*trJ0gMA4k5>}KN#7N!!3uV9D2W_mmC#_NABCmm?bzX ze?emoDcm`YrvRn1+V`pPRIfKrLNX5T>?qNwP14_Cx&QaNNW}GXnqFK(rY^);ii~<| zY`7%Z)T`&)e3EqwIaWWGR10wKX5}sQu3`O(HA1!2KfKu0z0|)ih%;bEHr3Ro*_5Fd zrb_Yb@CX91xKt>p-I!hSorbYS1f)*mV)e4a?^LW0-~bn`5U z#dP+SCZdEvLNU2A8W;IGzEqFA7YtAgHCRFZ&ra8^RbWvOQTM{-xqDWI0rYO7`mb26 zzPT3r*en^k@@n6D$C-qdC$2Ql`_K{%CL}IcbcqJmNj@gfaZNsI#%$K|ywm2#=~*|X ztfrmtUF3MQJN7l}khga9NPz>#@1VXRa)|p#GkSuFHW=Sw8`=&ReK6lh*|Dres%y6kOBc^IwBbEP!(0x zVPL>J-gCV#?&4|*!4@7wPAZ&Htosh#Df-=sjz`_>s@47AFk!H}ZSWvw?htZbq2<$h}tCEZswLF`E?o zX_-~iz3Kxqn)2#UH5Kim`KjM)PYOhaV}Bht=5&^eR#+Qr!%PoSkw06o0uxWcZ0z$9_(&LyDQcDD&pv>#QCI2NF>Q8;CIS{1e( z{5z<3!v@0$BxBm^Zs%lLIe;2y%cQYd6GiitPEZzRXB)(vT0ST7)#t}*R-VVdD@u4w zmg?J$+G59KcDU(kMXY^zi9{q2EYy$T?SM1EOs#hI&-)0TWooUlIeEq zg`_ywUBm1MT&2ijbob0b_y8Hdn0bte6$q3}v8F>tv{80dOO&lgzw)#5+ zi^&9ZV6x{1>E@*x zVz_zhpa%M5dq%v4%jy_)EFd39mo%KqjAo`OHU&jpy-3t=_ga(7c~l|rlca-}Y~A>t zviH39R3nxTBB>XIoyI6Bxf2HW&oqKE{npb1S!zLXf>{W_tmj^0?_&b{E&LfW;0)8! z$$8E*R=bVy>JssBXO7>rAptM#fpQ#oInjCu5_?wguo`O}VajrXeVq=9tdT-2rwpG? zXJY2)Nl-!4q_v&`a2|3xUuK1_ai=aM8oMVb(SMD?`9}I^ko^<;nR?=4;lh}osJf6g-c{K0d{D(zD!+>;C z=e7&~LzQX0L1%V4hsEhZy%fWT={tf-_h~&HKy71O-u`I+61slrJSAxxsfju&n3# z<|Eww6b-_NT#IW<(ntV*Lc(~J>)?GWIrVesh7Uo7{-p2m#sg+%Ib-CH#@A>wNDMyX zY>PW1xMnACPZeGDgFLJTuCM#c1T5}f*6=+ZL?q#^&9C*L&t0rtK+rL`NL%~L48dh0 zb6{NU_^jylcbE56%ujL(k}fPzmIrLRt!h01f5a5^)r?1|`dU2xm>mZ@xXSXJP}n&` zVAmlN!`LvR;)&_maS^d(GMDjrWcxT%j0_kppt+9Y?j$8Csb35VAI}1>G=9DF(+GTN zkZK$s#{@drWu`}J{l0&;_Nr%J z@A2qHjFbo_#KQT2%f9~B{P3)*A{HA(#;i}6bRi*_i$kLc#fZBTkeEE&wC~%_C0*4N}jgWtw^;6X4ir(g>&Bz|v$4HhmjEUZ;K71VIH8evdmo)nU%?s{Gkg z8%l$TK;Bxv7~jeZX~)5W_32*_R-O3mh;2;XB4a*mv{p3@+S}M|QaIL2Rkg~J+{KAv}Ko&(3xSYBB1^50-76Ki-oaJ^B|B{%H8F%>Sd;$@>7BzkPl&QkZR%3*9 zU&jf>rR@4-q-|ej8ogF#o2${&hBlQ)qvx`}?Mlks3{f9H2nlp2FHkx;f@_nzD={)2 z;|%8OSQ)?e{{C7c^9XNwDypA*IKyh2_mp$4vARyvV`4YS_$c9bNawv%S{{q`1uZA` z$g6T(;_OEz6IAxd+~YRt?tlM8j`v&9Ji!L(HY@Ywd~#E$f7Z7lW%c4!CK<&lsGH8# zzVmnRF5w*1j*upSl?t{BdZC*_|HQIQGGzhN1x`j9^UZ#F`?-<2xh5kQo8AArf|6Q& z&ky7qAHNE|GIz|(jw0`o3Zw(>{a=chnTDu|@!Vz|cTI*xcskqdw`zgm@ssIccSAtK)RxIDYq=dEE>L8|tmA z37&(3v|RgeoCSP6r#5ih#`iW7Kk3J$BP=Ye&|!70({Oh?NYw!v_j7tiq{=%GRth?t z&)&uHVj`Y9EE+32YqoMI`?(IJ(ku2rx2t@76>H8T@?n}qfWTz}>G%AtFUXo@!*Af0 zak+kaf@p@SxF!K7Otk7m`8$zD~%diUh% zVJNygmbnKzS7PjI8qpHF_}(qs!lEJyyZ{5wld^r+5m@O7a@}X|;GU<@TjoYwCH+ z`@p2rqvWJz((C84cF~Nf)x!7d9t>Fm^O{e-ay=D=MFvj`wl%3dreRJxk(B1z4)jZE z?7ChMF-)66r8U>u6_$ure5Jast~PCUH%t$h^AtU|wAww&Qr}hDnW%W0m zb^LS$czb8{V@{2exLyK+pR^;%`UXysN~%NErU~Lr7YEH^jqhsK zPhiHR=6rI^e5Z;(s$hE+6~@F)cj29!-~`Tvt?D) zIun^ukL_Q{S6@E;;1-v2@$olES9gRF+5P7GB|Tl>5!>!atAK5~zA$Aky}#rKgCtcv zfv-rmmd`fgse4ooav3dv#j_1=m&q+kC{@d>pE@6OtGpV{ z(OEP|M*6inTOu!_6O8;#=br4CAB2A`>qgC@FRM#J`$WtYXm3Q*sXme0W0Ybyw#+y| zRJmtVf1tFZNX`fYa<-b|ApufjD36?U#pi8f`>JcU> zxnS5^FEK1^o0=_IyE+I*CmwcFa+6ctlVUy+cvOiBUOulDUHr7TCdq+^Y0g`jTxvVo zo+SeUWSNMph@jIGBIWHp$OSe5HFMCTiQS8#*Z>!$MJ1Qn0_BI3i)Yh)qQSC{%QGeJ z#fv6NGOIfzvnjI+dZz5{2)r0e?Fy7k&>kBn{A0`A5+48{yA9sZ&7rL=%qj;&nc6V( zJWDLwFvkGTZsHmuG!x`BnsF5~*8)m^83OY6KaMs_s=~&J0J4C z^y$O8JhwP1oWJt^ zj2Ep@K3m{G#yW0xQ+$5By`bt+%Px{@j%8nh_O(yKv3j8&!$gizg`%k*`p7cl3HFVu zG!ZRZ8HNEsZMgcU_Ey2sxv*pCLXxD0iw}fZ_|l0aaQM}3aYXj)!+kh>p2vSyP5*^{ zu0HqldFaxsGv2+#;jgn6?b2xX*c%||_v^!4%etgKG*YmkA|Fx;E=-k&ux5vyE|q03 zTJ{y!br0%Euyb2y_@Q%!#GF1WEWBgm#mhQ-Pfc#Sb*u|pPCvmte9u9Yq4xd zwi&RLA@D7_4#T78bVQ@RmNPW}@}8-Q(@)Rz$Bq7NW#+bOYQDbKQrSV4?ydE9_4X6# zuG9CnN`@AbuMjbrB1*T#DX5W;%Za-sz&*%0F64#<&-6=<6~`1cV%O}bOrgxK5BAOP z)TY;`eRX@w-SH={H=gNCr`+|EnSO9^j9c&7dmcwXnSjnqr5&#_wE*02A8#x`r_05?Omkq*@m%(%oAintj3znG*@wz8P$uGikYz&6T^WBI zhNV)e%Lz%v%M_X#WuMx5)`JWW8a>{8qDI)O<{S*@jXPop2hXA&S{Iq z#JX0P`KJrTrpmU;Ls@9exhVGg>(cyl=buBQK)z+^=ID@a1-Lcg zC%Ywh4O>zB9L78SPMW!E(?YsFtZipbdrXmz?okCga1e)iWcQE0DYUCbOD-vU?`rs0 zY|jjee3@I|V;n!rVOf`J*ko0avQMkpThMe$o5Y1JETbN=p1=8W`%A#e4+TgGe8%ip zg~!f#qMS}lXOHTD4+ z>;dgBDw+X6r{hMHl8)5&*H=hj@1%A|@R%#M7xi6BB?3QU^9{z%J!m5i#8_dp8i=&Z z%OonDW~g?vKP-|uR%sP%Zg}ZP!&{YH{2F~NhsE3WoccD_>KeQ^b@7aWt&mwz^PK20 zH4A=kV(Ns7sKe{5ZHmhmX|p1FMZq(o+{(SzAf$NvYEe`(a!W{9VT~gbC$^iR3gcB3 z<^Ed??kkhjBXbj9hlzle1^y|MiEUcvc3ktF+79I>(l~M14~dl?J&0dfg@9nbty+;j z8_Ao=o6g&FC`qx`FsDUB9farE#IE59q=;1e&bvwV%S6?Z+O}jXY@rtx-B*k0Iljc2 zI%UEQHc5~V_sbPH3E+8QRU*Yif}&a zt`2UjxC=Cr3&LxI z!ateGavgt+*sf*`h@@CkuYBL)Au!T^3-pAz9o=L-&^xvk8s0iKA*lHc8~l*_w!pXw z0Pg=`oe%)w$t-S~rC3xaY}SiUVBpRdZB5z8RmFMcQLaDYgM*+ZA)WY>pOQHg zlhF3|H1!t+%Z{$`tcBw%J&dNOwPc?i97N-G2t9a%f{X#szHwyL;2`vsRP+M?8caGs zo5+4iujemcYVB+NTJkg3jYKNMXdt|8rikSW*8uS9^0I9NdY-OXOyR?4r=~iO7&|$J z%L(Rr5Fe|B1tnvsr9b}&W|UPTh`aRo!SJHEXx(NlvDn34S0`S7`q`8fBN!IKq7%_Q z<86H4Qe9X@yZDN9J+{ffx@ZGncvCYYy3NE9f7SX&#O zj7oMOc~F3baYFKIqAYZCTa>2JaW+ET`HLY6e;2j`t|j|tBO8W^f3Z`e9p&C z8WXUwOAK=!h_Wlj6+PyV!M6$uI>be_zK{uiwOyvRZ!wV9j=E+s-9&d=#Ya6c2ei%k z#s~=1>mRc?hxy#|@5=I~Iw1u}-2%ok?Vs+RjHsVniZ?=4r?x*g_qZW`&}=qWF|$~Q zJ{P^~m1l!DUv)%;GMT*Fm*Q{ROf8yyBA%MY*7=!(`pm;0efsTJ7VDzdl zV?idu5NBs&BWsafNTqfwGmYF(|B0gHOIUkYUIz=YGZ}bWr*%M*&U-x8{|7+E^mA>B zW2$d1^KS5q3FiGsW1`{cld@X-2U%F&aT_hXtxm>40@eNfxAN7$rxGvKOjBBkxkitT zYnd*#do_JNMqfbPYxq7FeG9B-*bkU|t$oXEO5cQkk;VjyEe`UQ`tla~TEz-`XD#NE z6LQn%9j8S4QB?ReJP487wiXfpHSE=cI9$k`1# zL+E92G6p=zhd7*hOW@jNS4TLtWI}^(-j?Zyy>E$uga3pZP#AhSAd7S(u6XS{N(zzb zNN#)R)WeM4Z43>^eK&^Ld>s(Ty}MO4VXp=hHonMxHc7y|WPFaRV?JXLr_EJn6t%Sx z62p) zbR?)*AmGA(1xXipT{2eU5n%9sCLPJckPuf5sG*YEJ};*_BsoJM+%cWH@m*V53h@1f=fRq0HHx zA_I`W&Oy1IMD#;D3PE~z&9U<@J2`ECE(F`I=e@uG>vY_0sVL0lP7x&4n!yYkd<7;R z=jYRWWC1m*p>=}_69@|r{F0E$Z^3=Z*|3SLt!Z{fG*;zyu~d5^*w;ECcziOd?y;L6 zEIz?j6PgS;zLe;2am59uHG^e>Cr(>LMDt_s>z~RQXg(P*dNQVbQ{RbsLC)Bi82#vm9hA%qaR1P#mya8Ilt<9Jpz_YV0Wtdqq8Nl_ zhbJ*@(YiJenk2lSOzy;>;KXj>(=CF zH)okYo>)S^<&dW}vAA9)UGc`rTjyzF!L0QyqVcieAcGLQ_aV%iy7#cAp4`VM=F}e? z?8`*EQa@EXK@3Z_fEK63VY7m168z@It``%U+srNXK-zn+r~r#PSRd-#UuFY16N?Sk z?J#6Ho-ch)a?GVO=1;63R371civQ#_EkM_>>gr=p{xE&?<&F@=O7=Yr-lT$aZ9=te z3y$c!9gFXPwp-L3q;ub5QSW5mMN%-C)iQ5Gjm5{tMy#Gbe{vgGBAwwh3g`n0`ddyi zG}uIzW0iakYEME8X5kg}jz@bRhVT4Tfe$*!EN9||;L|t7x7*OPzDizVNz7?NDO*=N z8anixrAIYCPhSiuA9w^CG)gbZ+B-kEKHu8aL^pbb$CB(mZaj)q9UGkm`J|gGkMt>r ztJY&-2T4@{4-Q?j$tTXw&f>(M*|$mPJbY_N=$C!Z9H)*Re6@?v$k|rKySJCwUW3#$ z>x||w!&A8hUd7?y?ez`J3_DS(wmFwZ_RQ&6{t%_&!&Ly39>}_pwkE6KE-{(Cb zP#zf#3X$cIYk#ghfxcDi?H4~`gd^Mj6Kr7TgC`Y;YmI{C`jwqb1XFam)Y^<+O7kh} z<_jE72D2w%6Zg^m(%q&_=kn9jORloAjKI&D4$edm2!T5aONkDF8R@%$y>4Ig5%Hrb z3H4bqF`G;nm?O;X$`jl^E52?O^=!s>L+Cswf23~kjt=sxq>TcT8=uXWTRFe}2z%f5 z!ePs%nfz@kID5R%yN8<^XDUI;zDMNt_JE`6K295X=8Rx z>0V5iJE(W|wAUb{8Jyj27VLmK#{JjVrapN4e~(@+dSBQH7D=xT-}(PsXty-NwKL(AE%PW0GXWCH8nL+HTXZk==A?cBgQ0?TwF&4NQc1mq9QAkI-}LqfTTI^Wn?V zjBsxrA3q660Hh~qq($AqACsWy*{)UH#f4E((IehbAbJtJ0B9AlvndZ~2vp0Bc?aZ_ zEvS%Y&;V;lH~bCP)@f*m$^=bbO;nYxrlWFysd^Crq8OdOuRcCoMX}{g=pnVdrQ0$O z-e!S=QgI;XXLMs!0)mu#s#=3N3c5e25qU`H?Ah6bjpq;>^P$SFN1qfWv}R9Ir52+% zlyu*x@|nNTUA*QMGX)`g$M+RKviyo3$ziGB`O%rZeFE;W4RMJolCZN{Ii!P{}*N$E%s^vR68J(8^hP50ojLJ5ZURn?E ztS(J0*nb_q{$q)S8mHl7d&C?q%y*6Cz`GyM<-UgZT40S`TWUpiIoHE|eH||g^V$1a zzE`7if+K;P4Kvy_8MHt*60d`IN5*~&ho{k25*X2s8$R61KV2cN4GO>G z?>ftD5UGV)`=1sfa*>5MV|8h?_HS>MbZ5sV)S|~3nZxxjGW8N~>1kgbbs#JfR2VLo$**PV`-KAE zw(LK}5sGdvPxK3G_3W?B^N1J>)YcVr$I0rweVYl#IYknm{-xRRPAS_sd3;iwIXP_w zCR%JBJ?_u9jXQ*=?B1@C4VBR&#u>ke`4SoUw6+|_F(r(?ms4g*ua8oz?xQqZA$n}I zb?<)oP!JV^87)}d>6G*Rcx0{q?tm6DqpvthP+1)HHfR&*2t9gXP<>#kS{*zXc#LVi zPO|UgkA^@LNNlasbMVOo~ATBqYIJ@!3+*|L+oL4WkhhnKDHNbJLQL55st#< z{1(b>pP2lX8gH)huDC=BlNfTIek( z{CS1{r%me`HW0fpEoc$JOn8<$E=13Ij>Sjp3;?(8B8JTx=4;B(R+QT3QQZ@;Y57Zg z1N6xP5mXEGoI~Yy9$4xCDA9IlVz3C~J;lUdhzk~G28#vf%FyCWCAF{ako?GK(~rEw zK+ouklMx0Jo(ruxMxiu)L5LyWd2TOZuG_9d=l~&v^#5b)FT24$j5s>bZZV>5`9zf~t?(Xh^eR2D|?>@fxJ=d%_yVr82Xn_r9afPAL zBNPSX%D`!VEULLUFr~ByG+X3n1$`vPTTV^=tfjp)yC{xJSyYAiG6@Z2Lg1dgLV0`h zP|&p~eobHy(bq=74VdvOV7~1k3-W%;eUfR>%w$P~5jLmavNgQib$H2|!||9uj~zce zefI~r(icJ>K2mOU#v%6N7 zt9)#C`hmYm;W`Q${Z}9uHQU0G8T^X!w2NgLIgx; zZtG=vCdYZyrgNK8kZ(NxAZtBcx|0$3v{#|OsC4kb4-N)2Su_kb_zE!YR9-&=Lk_OP z{RTciyN37XZ z!hY|IZ@#vkYtrZ$W^dvMz<#~|ThhKS>};pFii7K~^CiJP$ME^HV|O8n<#nFXw~yy8 zo$Nn=$Uxx$01RDS@t>tkb(k#E=%55zwYQp5H#hb9(;W|A;V1w+{KRsdkOFpnO+$(v zeh$UdZA)l4OERNPr@g`JXjTZBhIY ze|#`C7$Kyz&O!peK-Y{*P%9<%u$thZ*@e6iM4bTw0)7wr8ER9%5&d&ta&)HDeFbdn z^n1i<0ssTg{dVeSoY&5oJ8E}4&p0t~b|kQcN%4RCjBzk?KOa<6*bU;~NR{7HX%W6a zasUHiw>a2Qg3k~3k`GyFD0i5b2bM=a6wo^c&hk4HvVEWmOG-8KM`c1&kv<3ESLhg8Y6%8l6C30=zt>;k z^ge=n&t6E-qUA~~?@v9%THfku@c)VOCfQKUs#D=AqpPM(gW}$2YKLht+m;m$iqba@R%DTz&JM4V$hoh09 z=|qd=UcAQOd5Cl!6Ke75HBis_?>rjl^L!?6*fi@4T!I1*^U<`y%+-ri|; z-4Y8C4GL`oUuPj^7&fGk`bfD^XAPx;Z?7Jz-Uww+xkqMvRa}}VCYTk2A%k1q_!4XV zDA!x@>u_Pu3}v539ij*Xdqjf&OVs;#(skn&B^>g${8ogu~JAh`8~}L4I;W#266KUkil38w2YZ_ofG)S$N=iiOk`n zf|Sonw9Szx-+60XhHpO$bvyN4_3y&1caL(Hs5}iClj{Z=V-g6J#!5*r#9?gz?&xOX z+wOy`9Egxm*k@14P*YkF%r{ds*cqQ5ig|%*;C%V4K@5fgz7`tO*G>Dshwu}A%((oy z)3O@M%!x_FT*CQK-ZlePVPej%>Q$_9J8kjrE-t1NAY^!PjBEFpe>SsPozKS=bN+0L9bI_(4f+%w4>Ccv5c0w1b%4@#!OgI6cQ(K2vrRQ6Z!l z<*FTiBjRV@LCrLJGkYyadS3)FqeUhGCO~R_2V%L;Lt){T#9P1S=PN{rXBP7lem*)5 zAwHYI!vOW*bLNx}@24twDzT+W1K$oyLWdy0kXT+qikO^m(o{$5oER4pu=t|#3Sxje z-gAE_=?$ODUE=G8hyiv$Yi;l8eK|VWd~5WurspC-iUvg(vBBI@YuRk~w5zSvFlk*( zc6x4w_nk4bkp^uG$?MYw$(l0E3J(Dh8+_d~mKLc|=Q{!&!Dm51jrP~Drs-#5{nnK7 zu>-x0hLatU>(n88dHA>FSKI(}EQ;S+M8uO zPS^Z}!(ZZ+HumZG5y+hp>1T#uc$@xbY(b%fPahp_@8=Hu+{PnA+kRmrV@$igFwWmT zj10;_Pl}EtKn{|L^ndm~%6|+kg#Obu`_nz>Q4s9JVJ|=pXTUw8Yv4zQGXBx* zHiSZL%!ERl@;0}bX#Z)_g&V$lsV(myD*|%=5*ivQF#y@?3xs5H-;wN%Nr6%$xw^K-KDVu;8+g`c$)|`gIYJN@0s^Ak#ukQbB%u>rL=}_dn8SAJ?naAa1i;$)BnJ!gN^O9v1b(;w9gdE*53jCF z-_qK#_@}o%2=`_p1Gi!Zk!U3{)?}y)3LA_W#W8gw`Z=I)v)}tQrL5tgihvOh!2R7_ zMRP~nU&%yGxE^Y9AMBq?2V!j$HpuF=F z(*rw`5KAl$R0pD?`a$^+0l25Vv;Xd&yatb@5X%?}B~6t9ZGNS0_%XHja_}k$1&E3( zgS>oBJ$@GNoQpQxf`upP@C44WZBRVC{>Ig8oBj`lJfMs;p0s-^RZCRU@+-`6Hd2ak zNpYi(pjN^2_CJE8)v^{e8GK9BWPlXsK|j9f*(xf{AA9V+>fs_>USFNN=O8|Q5d&X< zHJmSa_r-E+NlH2?Ixjnus%sV=eH)u#+(tw!csA^jej4Bp2Z&G(Pv`DZn)~@^JnB%+ zXWIv8cgo8VqHZvdyn%{oxkdre6dtj+j&z>w#gdT|7BH6E~X<)g9a`nOG7lx*<<9eb_^4qt`^yk+k1_S$Zd;xP=w1Zda6 ziLh({*g7c)83kS~yOsj*s8SK}NFKBg6KcwaJA(dX!Y@}*ZbH~;4F3Xy?=lepGT;J1 zlrog!b=&&C<=UTecz_ni>!GKlcql+8m|nFqNq!wg+CCn!}0;c#~{@e3COl2XYd!Up+@`w0q7 z`S))C?bJKF1m{VL%Pl`HI%0Bv;=CgyPerUNm-(1Y37(BvH2LPG@vw+0i_W?^d5kkC;&CqZe2ZH z>3daK``Ej+vzuqj{mw=y@8`zP-wRhknhkKZ;&aN?@=XHQ#Kj_~?0WjpBHdvQ~3 z{)bhCElEFT-Ee}Z)HG93(Ki%c|CD7J$;MOwt^gS2TWlGv0%Ujemx|^)&zA3OgwJfo zs)mSVU7TOGoWydrlp_QLy!b7_fVNGOd3HasljvOTk8_50zjCa&#&V=BO8-y~fBs{_ zkyMz_K*m@>bnBPzsc%>@CiPc<8WUkR@f)*Y9jq!gg_LFH*;c912rZmeHPNdym|!t6 zdc?G?GL_ccXIaErS$=q+)Z{2z3#$S-zL?%?e$D1WDd?(CeMg!8G5GA{O z+7quCAD{P^vwwB`>&%IQ?c5Cl&kK+6KElq|9h~OkHUkG?Ra{=vD6W|a)J>gL6MQ!U{HH9>&Oj@0 zZ}2a~as>G$fILUQZrME3l^xs2a6XqVh!EE*qEs9od$9;OoW{VT@lH;a%#81cG)}l3 zmN^0Q_XXOqNB>q;MCU^=oRADHS8^Hk%hYgm%cL_-I8~K!s_a%Bg{qnB2PHe4K{D-# zvh}xG+S}I-S8YMSW|NHNO~0dvEfosB>84ITis;O=AMJa@S-$z*nKxP&$`YA#)|-&) zh<1sLh*wU7C=z+&H90aZT9F~47!D=j;?qDPZmlbwQKw>O)%0tZIN3iT1Me$Ahs;FE zT)6dp6l4uEB{}?_BCU7<`a(Dq}J|=huBqe7Jq~GJb6+c;(D~zUji@ zAS&TAM$XW&d_#Q9BzP!%$h;zZI72eBq)983oe2>Uc%~M%#g#E7@Pl16FNdSSS&Hsi z|FROQ>lazZ0Erc69OauNI%U;%4PGo%C<0opve=ZzfKLdV2mlNaML|u^@fHp*qIk2? zGIW_Z+`FmeY%_IJ9mIfra8%snvCU%u{AoHvENe-%Abv-__)itzk)WoDulcs$JCNH? zRCiR*lpw$54LCm%+TWMP0(A%Z!f=G|vGWfC7|} z`dWIx{=`cC!Ba7XSXgb90wg+9_fFBQ*B|*j6Ag5}4M9i?(&>*xrHuz*lf zTQbXbL@B#X6$I1KNrMOX4j}01Z_v`S6f=j)C4g-{p$Qp0@-{EM6s6x?OlR@T+tuz# z`sNLgrnTI1btOLAJIEF8aHCB(qy)JZDQ@0-8+mp?zbuatqNJNAjT;AmXPYr|@BXvz zUmr|1eh|}}IEn(}FEurLx`#buR*H%tfjgb#fEBp~SivbnPQclgfU|8!y*ys?R_$fs zWAV0hW%hQxm95_XiVu7T2bZc7O*naru!TGtm{}`ev&l#XGlN^|%)*JA|2}-UZF@as z@sBZX0U z!b!-`l%$OG_wEP|K6Y*;umiz*A~xF0Jt4E!zYmx;A3)=u9>25nSJ>61kc|JX=uW~>Uw&i4{EHHlQ$Xk`F~GL?Gmb{X;ly_w)xqeQA-8|R z0uM&U<{O&u#p!%%PY{BkpeS+}2N8*XAx=`}yHSEy^MG^W^R1Dw@ zKz3sYcnKqq{Ep+&#C(lFEIRAt2J5c6Swqz!3wSia*b`tVG1v{*Iqj<9KIu%h-$VHR z@=%tWb)H_J%9)nPQla;-NnIjR4CVvIfcxm_M3wzL=BdF3xHTA#cE1Ya(hGYq-*8x; zib@byG|L17!4e6OSIe148Ni<=0=IN|Nc?;nG;?!|8Hr)k_KArJxkf~;0DSF1h$2Tk zO7^srKK=3!orD$1!C1X1YCS2Jg1Wtn-d9? ztDWEpi~vJ+nL}lVVKoF0F`#pWGag5kgQ#N<{j0soewzBf+?7|e)fP=cp+A)`a;mKA z4lVGJ4?}YWoN0i`(}#R_I(@?6q+~#Y({)b^V-edpL96`w#c6hOb)|Xjci_!CKt8kk zS+LaI13`2Lq&vE2o((PXz`3SFVH^|t0})YPA?cBEY+0w7>8VwhWQaPLph1ATo(>WY ze}2bRU4d?|zzgQ<+T=QyH%knJLOrYX-+k@fksLk&fj`L5cs^Jqt!DqtsJGtVUtCzC z_Ec9SX?b&p&*u3AMwlm<{TIvB$MIriwkK$Nqs=>AzjQExQ*prEN3j1HoUk8&|86Eq zv*3KqwId?e+l7DeV(0P-_eH(gZR5r#e?6db_LMeT+}z}glW zW=B1``TR`ee#Gc2XlrF~cNR=zfoPVUL5zvS8oFu^WNvCiW3e3QyXPa0?;aN|mN*u( zxHNrs>g%=s|L)$Gh|8sTC8pz}_+AjZw@jrVyIo=>T}%j|@Co$oW2F6|=`!Fj1ix*z z{0XVza8W<#x`3d7K>eKx`}yWZ=*-w9`pdR`NuPYq-D}We#hGuBD1JyY(cPV$6FWgH zb{jzdmo%9jxaFcIt$_(i2%qg4Hs4rVY1erfyva~ieP}kO?06EDeb1JKQulFz+qV99 z+d$Zl+q&>)+!1lmF4;%#{;sYWBezg$sIegYV_O()+8=iM@rI7orP*6^Y03_l zru=OfY%v{WcIKsMingr7v)6KX04|J}5Gfy^aI!l{^$57hfEtvVQ{nYHucrB|1M;;D z1M?I)Pm&whG7W9}6t&?#C2hKKU~-Al%Rn(vR1hxoKSH_%m!=5>dr{4Vc&6&^p6Jcr z>psrWSgq8#iDsWx^lp*fwfAG13W9b3_}0>9c2Jianmqm=_~I|jF3`6MEtDnfezK5j z5K)1gJOg$NKr0tDYJH+R$c~7Z&u4JD#cWJ6^hHD|8u9Rj#=Dmli~y_Q*(3RRX{p%( zlR(|Imu&X%rVx=Q8Ork?C>@Xria?&PLO+M@`GEkGeZe#Gh53j#>>S&TdPhYKy&`^-P1$W0kTE`R(yp>>Ej0{zvJh=!k?bdXI#9Ae8)}#Ec`?rboL6# zUJ;d(eu%S+Bc>dj<&&JCA&5-@y*FE654qy-Zpd2aE!rHQ2tFu?1pz6EP9Gc_KEzgP z#ql75;4f1%3zSzXho%m+2?c#40iW>784>k;vZ@p#Gpe?j_~v%+EGI*?6D~ZOobQ@^ z?Rn+SaR8^!6l9i=_;&b}XxHil!wrIVZ(0|k9@_m$ci*a~(0Z0{ns>!-DkcO#o{%73 zV(wGt&Na&##Jn>WybPE<%H+3WbC2PCj1bWnZZD+c_eQe)&XcA-C94&Mf};Cg%P4oIK3-VM*svp5I? zf|16E1N4+Ak*mXIJM~d%z?JE{x@khQk3i-j#E86zHl90kbi|5976%p^q|59O&5UWN zYT+t6|7zvpZ!r_- z59pdyRk0x7=^%yOoEEugw9obtU)#w&?{3ZQ)mnB99Mr`n;L~UzU?YKhq(=Vr73U?l z5(s{Fr_T(Cg1?1k;msQ8s!ci)Kurvty^kp=^0(rmpmAwiD_OI*mqv_Rc<%M4s2AT% zwF~Vr63PbZ`}v252>{BGL@)O>5~ZE-q(?gc75FtP1|T0cMg8`V*l!vezWl8LgM3ac zyG36tK6^p|9xV(=$$WF(+dYhahj>Fwf4m?Z8S=iG&o|^Z&VM+9_%V|u6xo?u)<9n9 zWW4c1wK7z_Nz%kk%FtHc5LeQak0-xGMXbX!dW88%G%RRWiR%RntbZw&5+3<}QACZ^d4%C&{t*x;XER=fr5R+>R ze`SeM;C!bu5j@I5Lk)=kO+btUU$7m`rN&fj%F-Ew`3Ptaa0Bpdcx_WyermndG*1;ZU<7b5Uu@hw=dMXzKt!`cR>VU(M#$B?kBqytD6T9lJ*Z)zmzMdj~rm`w4%})9Nm?uAc036IlT5>YJ& zuLjsZ(IE3o0oV zel;r26=0p@(T8b%eh?22&v|Ud{kQg&m3qfS4nvhGpwYrnVsv`%pl&Ju?x@u_X>m+N zFr2+rsGja^r10hQ=JU6n@xr1f!K%X*T~sN76DHK{_vs#+q_gG5NWjGMh~~8sRlaGD zd55kM{;gC3><y*I+iC?GI~6NXu4@sK-szq{}op*EtRA=q#` zV)K`^rBxSv@Fq!jsm_WlP@-kJYd-kmSgJ#Cl~S?F2)$j@`c01y0X8dcbgFwPaIq$1iKUL)5G!(BH{DAiW^cr0ck}}BQh5#I(M}~`Xm-|qGM5>{d_=ej0bh%b2>N+vLTv>$ zjIoyC*zpX<;jS#*Ip*o?BEZ>oeZzj4uXHh{(b*>8h%zk(V-eXy3HbRUCHBXneA!iB zmdiRp5Dh+G&n-P9xE{=I*y3$__kx|*SH@RRH4gc3IKROZ2aZVT%vfoqeP(8~O?F&% zU0eKC^L83$HwRL%eYX>sU>+Os+6)tUe?v(aYnI#vPh!rc6z^`H560J9PO$uVZGxhl zA(DoHfsyUO&rfpM;(eFxA+VOXcJ^R+ze*yD%-7e~XYn_L=zQ`$H8CXljVVS#K_rCJ z#EVxL@_wMT=-K{mjDEY2%v8B9lAoKvCnu#dx3kgScrs5A(K`m{9p9_Sh#H$U zq14Cg!J%;?l|wSd1Jn}bYot9jX<^$q6qM0E0wTtb^NFdVxC0B|-Mzh?Ezw7hYCOM2 z`OK>w{HVbW<^$BR14u+)Dr}HF*(>~Y-{zK9m%(ZoA~@aqQg_uV(0NU4mq1nM8C#1< zb!jxBN*N1XhqyFlIOe1EQj2gF3r@O$+k#8ZsRc0!3Blu}lz9Bq zn=l=rV^rk_wx>3uQA!N?ImnVt)+UrX>NCvV5lEUUE6c*FQy;DM2^q=tMg^t<%twf-F&9D#vk;6c)AO6$W#*~m;tFpl8GxQ4|-gG;c8g5_K{ zNYW3Qz9jyEHVyOfg{8KkH&2>l@1MRum6es-f#kNCu_^+=7?_wvfC7pBon>QcYU;e1 zY=+a^6?%@Q^p4AP4jB_WKvS&sJ<(p@-(3H5lv*w~RADQuoS7fKDQKH|{|BbG=Je(824JFf|V#SL;B3@|%ACAaU zQ%>sRU>G?3CF-apg$J5hI@-RT9Ku})`@t;o1~xN3E+u+968XJ2PsWGqG(k6+nZLCs;hcIv0-KQR=Z-X#t9hj2P<@Ce z+^5jEx~5=_Hho0Sh7tG5p_cqjAL*}-$a2vS?>Idt3O9_hBIDhmv1 zn2v}+(T}m`ZR!?Kp3_9}B3?2!g=zh)5M_*emw#;{~WV6whZn>)%`zg=|!G_H}ufO4{1mT5I(B;!>+n z^k+cq40eG%BRs}=!$?!D?zRZwP7Edjp3e9tk%NRPb0IcMO=ilt{z7$G z&Ccmmu%KeAfBposJePLVC8+6qRFV4)U)K$FBD=ojdt&-fEama&i@m8atFmU|5*-m! z1yAv_+S)$>G7PHeLZ!FVkJnv*Y4)dx;`gyyc2nLOMpqE?GbZ$FX{6K=BsBYcZW`Wc zk1yJ*sN^!qBIrcp;S%WlG|Qf#eN|U<6``ohAlK(&zjD-b2o*T{VBKw)KdG($^X-km zh!(zd2e{!z2&6^N3Xkkm51@os22l{^zx3r_g#0!)H`Nu#Jd)39rVPkiQw|Imf3yMP z*7$-p_1zYvy;-zm1WF1D%*KsBa5IaF`i@^-W3#cbo!E7G4P0jR;1?1OPRugjrx+&S zO zGLR;in82zlF;<|;SSr=mcjDn8K!W7C5r*Iudk zCXypPuTe2#*Y$UbArP4@Tyj{mIUY9$O<< zfTT2*_H0@6n|ELg8jX)EQ6(h?GPlpAq41sqL27P=c_#jS+!+qyJJYhf9K!dX z{HOLLaR$>3>XX$f946Io`0_D*pFB8au^>_7)}+LgHR~w$9eoYof`;V8FCkmBxLU}e zA0)=6ZBHw=Tj2+GIo}-9Wf=(>KUABK6t;xV!;s@duIh(IAb~h%JRGr3e8{`ER3pXOK+c{KSa#8Rlsi z9x^Ed!S$Dp##Q3&LNC@u^#6h+U?48}4Zg|~t5PfFJHYwzJja&n7pJEbz=$xmf?#4eZVktC^?-l!buy-g8)xaqIT)(Fmc!!-ck@K}-M2Z#{$c{I}2;526 zq43qi^7f9DZc#rWr50x5Fg_K&a3k(0?2h`3m{UbTc>RyuqeoNUJKPRouA%uJ?cI0c(;rU`KC}8HL@fl`5AS7pxF0#^cgs9vq@^Z0a{?V8khcsM1{a1CkOUs81^{ zvpEXAqw05$S21lJ-iajVziTfV zzUu=kQ^<(TmdV{ozrvN(A;Nd|jyU+fjQ^bKUW!P#`LoI$O$s4r2kpuFK&fzj?mX8NZSN zIKZnLmld_22gn+(S3^zgg5V2{ZbyY1JJx2>(tpe0G2R+lTGD-q90hetK3~RZeQ(Dy z%+EFl&QBtJg^XRU)KQK6nZY5TO2k1G7nMwYe=$`6%+u??KAJ%#H~=uSO8x_LA5_T* zt!!Exs=)^g%+%zA&G;h}@FTs-tbx#_sMZW;yfWgE0;JjRWN5Wv^kwKfYC$lcsfPW} zPghjMzNkjjz*PpGNOfgPgg3{=&Z+U6SzR2;={|OM)}-hY$UQszU{+RE1n;n@Yn)KX z-SamA{maYxyl?fe`O3g^HJH(SvB_g(`6Y+(mM=ZID6IZ+)=Jh^Wyf1Z1!uvrkL^6| z$Sde~_Gb6w+?=AS$jy5Bz%Ph8`>?U#N;olyNLO54SeQkYPRoubTk+!IOoBMZwu!VXn8YZ)fQd zzGTt%64D=4PQt!~xHsnfIF$3M|z&zv#U zUV>XKIfT9T2vBVWfGf=&-_f~{h?ED&cdiBJF=f)N`A>IYXiX7ToFZZPNpWc}6+Y6? z-OU+}yQ5Ld&~P&WX#EqZh0y_B!v-vbPQXG4sW$9?4$VZ!7>cAw9Tj!(+C_c+l=g=m zQKzxdjnoFOFFU#Yk4Y(WK7||Lpe@~Np|Vdb zSfe#?%(O1oHdk}ywY5ONJ+VIK;avD5HPt6IrvxEH(fRt1Y!je-fzMJq2gZhH8C*Hu z8+?M3XEdYYMEZ3l4OHc;zLvqu1p<;#F$%=%QoiTz{0xXou^E})mj}GMWPN0B9`;{f ztRXp}b3-5+s;anJ+S-g*gFBTG{v{vIgAxnts;lv~x>?!TBZ#Sf2zgZM7&-lVa9B>n zqyPeJZ)Ig=Qdg-AvCR9I-ev~Uve4h&8wt@IH?ZuBT7<}p4!fg%+4(KlHht}G# zR9-hce_1`un_y%0=Jpf}VLs8oLt< z|37F!Nx{q11DUqJ1`p+0D?qYx8lhq`)@|Ow1vTkPLei5u4x^M7dt=c~D zsa$0ZT@J`KUPg8jyp~zb^yJ(LABn_K#bA{H@rG9WR{IujJ^z*Ek238~N(Y?C>Uy{nroz<V$!T}w|B|~Fk8}sr*a60woTb^o zc?+(wUa~H69q(bN19|?LVi* zec|?<4#tA4-h_t(DrKNKFwBMLxS$Sg03LBW%S^7Bj{Gdn46xkf|9-345$I@G6)QED zZRciUp?4jD8W^2&(PKlljjt7`g^}$Joc@Ed*lerZooq2q`d%oO1OD5d!1to^ z4N=&j!~d<-D66V^6bc7)UU%lcq=azXQ!O+s9IOUR=E*T2?j|^pGUsIdx5>QX|5l4g zl`XN43qRJa*^)gtMMve6k1vu1Qc4Jj&;H>jM9gp49rUst;)`bAIoA19LNEAiTQ-_j z5L;W~ecxAP^g8mI*WZHNWwO3e0QGv${$ZVBgtD*6#Tz=d7aM*=*JP1=Bmk5gbv=u^ zm#hYkFXigu^# zTS6KDoa~@|(`wZ%f2yxchnD+3yNW#h_Mt3GNdU$y6gqu@goZ$~{1Ie)O+pgsGo}(P{tcBrx-hRq`JpP0e<366-I0=hauvk{V7g>jxmIKmRcL-cS!YO7pMhuC-i&f0fm3Dw4(cdW8`^z&wcHZ&l@L(h1h~{Rm*ZXfR^gGEc;W?6~j$ zmqBJ+&003Kp*5Z(ws8p0UgaNQ2Fk#J73Ia|%h2wm>2<{>ufa`JJ#BF~;$ce=FASjM zLC7nzC#2ft}Gvg8IpBlKQ8XF|#O475FGJabYsQhIYN=1N?jPPLE$ zI`I7{;-H_(vqoA%fLxowKLVaqUiE3Waj-yS1kiv}Q;mqI@+t$V92;!?zjMErs4E%~ zSxFI1`RMn=PQ(nuZ#Zcz)2OHT)LR4s?u13uUD#;*mkE)vR%n(bfFPVSpxC{;IsG*R z+%Q3@??j)Bqv?nzjsM0j=fG%g-e`xK9|#i7rQ-Di#8^(|$GbwBiU{T_;a#_wBOqkY zpAr~OtF__7dy*sg038EH@oV*rUzONgd=qkVkDb9%<==-`4Be*@K`ONWEOd>|HXL~O zC5qI5SFue-q1O|c+f(~pM(yKYux9LSx$$i(#s?r2m~`S(A_7_LC>(nQ!1RwCd-AD& zA{1EH^6w`uvRPS7as$*g2j8$TA`BJlesrT=jEHw+OCdUY}Y0bnA(vlskLF5?wR3)!dut$eTA&@gjvTytucwH2mVqJ%Jax z%rA6{%@tho!ad)#6mhgZFxYteLOhxm&BdjCI2~6V6fJI6O*%!@yn!gStXCD|2;cTB zP{B-LtLz%CQqsU)aB9Su46l#$8jw{?6LV^{j?SuNof)Srx_T~~t4K4H7=M^0Pgz&t z;`a8=nDGwZeL1+GsG>fAo&V^U`qVb>1@x37Qb=6e&FwDApo{|6&OsOWs13lD_Cu) zb^FW8I(sdVjjEQ??*EfT{Q^8g2<_PI?HUTB4T#hq>wX^jHG;qeaHU!)mefn&=0Gdn0^opcnL? zW8K4`F(Z@(yHFhWN1RCswdaf3;ahQ!MPL79rr{x9(U3gH(;H*Mvfa~nn!uU_+2yiE zKxF=hWCaJm`4MmgTheRK9KZK^C=FO~n^@{R7ueh;z3b-ov0wg(_lFJ|(BwaB`{u?F{lW%fqKqj#P} zD!*i$xQ;n4N(LuTa77yEv_=aEG#1i`+I7bPSJBlq$hS2T)j2#ryu8{eVVfHdOY_@~ z`GZ_#HfqtuLG83d&S94Uu|hdv9npDzwy!wy62Gg+)aPFFWD%7*PeYr%U}|YbDQ#gv zGb&M0`-8i|IlL5(%9O3L-edW0c(+Q0`f@zlY|K8Q9Fa#WrFE+yqx|b;e-g2Ve=9Fw zLTF##eci+YF%l0EAIP~)w}=ZcbDIABTYa^>vK<3SZzEmeZK?^rZhKybIwhiP5D95G zXH!M~5CO~rIolN&D{^#mgq7>*zZY@rEK+|QxN|D)(>Cx`)aTe7?R2Y?ii8&wb42!j zk!;?AGILZJaND_#FP*)fzs^5MPJ|3+&Fa;B5W&~~?6z8=m<@5vXxgpJ+9TM)^tR|A zA77XwZ}wqJ6@0J%CE`x3`}?D|cHBs*H)?i+?vl>I0o$C#*d^tN6`diYHoLx(;=~2_ zM?^6oYF2wl2RWi)23P^SMse<{fU449b}@uD$c(F<4_WQ3`Nq61M%a zQ08+dS3Bc@X0LEM!F)F!b8|ihcdWNP|?MAr!hw8iBH6@SYkbDD%>%2pRcw<=^4OPs_U7E+Fe_jfdQR-J}4=SZXykA-jA ziz_5$;5IgP+K{~Fj@q-@()9Fg-j<$?BU}=0okCkW4goWwlhaRws8w4qT7j+cSo6}# z12tvJgZVE;a)VZuH*4>AJ7er#3~7@re7*Pbyxq9?1936GWXSBu*gg)uq(Z*aG29-~ zBJr%(WX%$v5&PyX=WD(*Q;=Rr#p@A#<|$mh$-KHTU%~6P>AV`GJ)c0yCHkW(#>~Ca z&gXoGgo%SO=v{`lK#70@@&p7@{E=T(ZQcBY%3yZz24DZBMZEp60^$i zO=i(rj=50H5MsWChPk}7Y_jz8uj6RGM1h~Qb!AVH`y>%BT?_o_I^&5(N^~+C{BA(c zFZ%gc^J(XM=hG0AoT;M2^u_J1ilLZ_ovfN6tc&onMxevq8Q~;+!}TZm=yj)$^Dols zR4x~~eAYd<@LiEXULn7>e$bE>m-Y=G)ltPd!&rtp`NHiF|CEZOJTTH_U;z4Qk>d7O zB@YmZCM$vVsX`ylQ(=?{B98UD!sJxd=HKi;6d0nVz0&SN8`zx=kXt4*d^asdP-Ad^ zT0Jw&Fkwr!A}B?Ft#^1^{2wCTQSziyY}WjAXxLvxh*@qntR|;N(rLH_CQ3eAKI#c8 zik-k7Xrav#dKGY1ef&$V1#tsPH{{O0mb;e2#mUdH#d5)I-`Y?S)|y3*AJrb3yu0bL zF)BThqLQB0PNHLg0hB0j6=JduJztqgoxlF$V>X8qzhonSzQkHH6i<>)uCH=EI~Q#C zPJfg(RxRltEQ+Ivhfq{P9;&ctf zI#H2x9q!C-@wR|nhLHExmm*u3p6Uas>!e|chW0AsL)2Vm#QN|N%xv7>ywu+1#IGJ) zI^|#G++=zLq8s{)xD3RPSYfwrCEp5>J3nU8t5e<|7uVOMiTwQPn=0wKoBMN{RnkC$ zdWla>S6^L)q>%JGkO!Y(qTpV*Ukt*%SiRbsN;Qe2u0)>bS28fRA9@tY4%z0BatqZD z;#=;WlA8Q-i{2M(mP$-Qj1?>(jSQ(T^GXx2xOpq^;l1ejj1=!l%ZEQ^HJ-;^-fQ>y z)>mQ7v4Nj*&py)SzfSh~`>>W+8ZkTAid3pzCcIk*LX{<`3BHZpeh#snTi_9TZo}=5 z@OUWegyr|~0&nOjdLa4QdhA`-v4kuzwxW3D+IXU>%vSCL}u8HOq zp2QDwZDKT@lw1BW&Acl=qVOu#APRQ`mqGg^3-cdZrP5F{>^41;%QRz4-C0c`>o|<| z``O4Nra||AY#gwyC8L!=(1@nZ&)^|dab1hmU8zg;;z~4u3pJ+@)(Mlgqtnd zuaS4^tZjU4dJ#jubX>vqE4CQaNoHrYcWu9^WG(nG8w#x!6}KNVSPJ^|i|ukNYW?l0 z+w9dCx^z|S>%TmA_Q#>rjwh|nmbGvVOB7)ag2(N8vlpL+^FQ;PN)}yr?x;;KQNL>u zdYFClWp?~}AzK9K8*#6v(2m^Ks3NFGpn`}bAQjRV*Krs+Dmh!YDB+dKEn9&(<|23u zlwnmeH`IM{cSlu08<~rluNLiZzZSbu z?#oY+);GAl{Swvk>@HKeTvClMrjoc^kgBypi;I(dXl^aX;kkL<)k$Vu^JmT|N}Gkx z;-{!9>R~4Jot&^)*7D=>F7;JHin$e=!di@vg!6rzf(w%+Ag^W2$q2|&hso&c zpxfP5A2sQ$#7rJ86Jy0W6v>p}70FVWF3!(*S{c-BUH<-mR6wtG4_xt*iC)* zB-&C!R&4C0EJtmLAe&cig!+YX5YcS}!QzY8TwH}2Je!*Z^_Vy+s6>pB7t29;p7vHh7t}+0(QNI=jYXDSKpkMf^0?>R+c2 zN>X!}s>6}Jf6GUJ|7aURnsQuzqMqe+z=hDSIWuDx%)r2|x>`vO*h2ALWp!n1h#u#OBliqjM$po34SMdAgq{H8T6y_gzWu=%^X8j3Oyzgo@p*_zfS46Q^(KOiEBDR) z&Z+t`&%v%V12OXMN+L(vvEIsmVF4Ua>IGgU^qT3^9uM~3;t-+D(2UZQn;i_A{UJLs z7;1d$h`R3h%*MvcCeBsYt4(NfGGZfbBkS&Pe+Ij00&VtqD=|2(JN%Pal3&2{@wmxR*z==okvw;fPZq1eMTe?4)uXaOhHVcF?wVRR)Zh)POLb7b9>G*b~$_vqur-3s* zW#=fcZwl%aN?BTN8)MgwC9xBRqHqeKjea4}i=L#9KWVu#{nI2rgXhVpemp%|?W}mk z?W<92>}4xNV%>EMz^GGkLDudnW5@#yc9X3MlZ|+`UGPXBrJm9B(P!GdhR36EA+2zK;6T z-*f!l=`lSaUH{!|$H1A}gk=VYq7N4FYPD4nLn-OUMa4c2we@OI2Rx`lKVFDS5F=@- zE-PP7Y3)b4VR5ntKRac{9P-t1wBzwV*Cb&jRzoEo$=;{22$>!yRhNcNVax5FbN`qQ z7+vf6kK4Iv#T}%YZo|SmE?;xft7P|LKhz;jOl9r!9|=M6=siM0kTTjB>94>gYLp zGad>&hd4>x69286uJ`Y@4#OF=s>*x+bE0jwNuBqWF4c+mC$=f;cT17w?WO zW6M64bruJE8W3nv2nY|>+C-HFm!uCyIfYKfjefZ84403g-`ybO_xvrNO+A`wxW;9d znzNIzHAILPln^w)&nOsY^!|_c)toN4(Lyl&WbWJi$jJVwfLP7%rV(8Q{USOzZ-t&q zjn(T1!(!k73POv@`s!maDdKnwLkF#51ss2w>D>{O43d*HHi%?&`iPaV2D{^BtJ{)} z1noB_ip!dWF>Oa~_4HD8VeycSz5;W7@2zn9XeNfhVNicfB|jcBRd!{;4>&Wv-jgMq zBD$(@B)r!9?%r;Iui95RDgWMD%$E&~Vu)&O`rGRJl=S%AE_+_u8_Pl~1NeQ{2~IUJ zLFwPMq3Z){zN=b^HPoJ4{mwZVsh7#7kB-H`$M-Vb+328l?2>N65T(ZEsa?ZMSydMq zYu5YV{oU%85%>Vm&TZI+49Knd%?`@Ix=nPk=iZ>AopVVoUdIQf_}%BlFR>LJVVh6m zOPeJUd<*eC-Kz0r{1%`*PMwEWK*vB$Y7fLQfC{9Uh|t2qJ1+ z1o~Ez5~`k0^UMcOzrX;pIz`x9>2+{No`H*T+A25%?EwFV!y=rDWihj6qbYFbVYit; z=}^k3#d^zQMF)2b66y7~*>cs8oSJJi$6YGKX3MKCQIX*QKh;TofmrD!nu<@O*EbzA zP*bh*-Z1r!94W^ZSUe$>Jf(L<()a%epSv<}ylQjxaxIEzbu%h=+XN8V-Q{fqas@uZ zMmq-fu);khUiT(?rnV!Pry)5Nc>*^WXs3NE!xR! zfKTqHf9^;B7Q7T5tsX@62Lmo_HLR(b1^R_UfB2{39{>sfU*$Dz@zr?DWtY=G#n)^v z8yD)O8x4Try3(>Lw~7Y5{Q@Yvyjiqm(ikZKzXzl;k&`9+D9t=(jhehRcmtHWP*yTm;~s@WAkv&a=I zN+LKIrbu)mCF%9S!2xkPuFX@Z4*(O?d39p5VQ3O&0~V;_|7SD5T%JTo#r?O25=L<( zmFfBL+w9dxMQ#h_y~#vrMztWKdxd?X|5Q(DfFJTfNhAC1Cq^R-mgJ-=W8x@ELd|<4 zFH`~ZVVa4ubQKUvD;RvE?4+@+s{Wm&2y`M#V_Ov^>*qrs7Q!;Yb2g zpp&E21s0rdYbQ{iba~?FO?na~%ZI_Sn8~UxAyl%*D!aB^c^wPh_~QE#jCRpmY`ubV zOZyWiewZzHOfpSaXBEl+ba;Q?Y#2_J8MLFRya4CKQ$v}!^L=;=0|3Ra^z{d< zBM*s}9Nh$TFa-qczQ;k>AG1%0BAGCbB)7 zytJ3$-9=`TvjNc7h&M+E1$QF8eh*}G2>t#HR7~DFFpBWP2w8UMcac5nP%zK8*GVrC zw|hkb`I26?8UQIl5Mj_fKR*!btb0exI4fcI-RKi2R<#(X<^ZU7!}-r-ksYa9@rz1a z&@b?z(&r|sXH9S8IW)fkE&MVw_uD zZwEK%k0Vo+j&S2PT+H98LA@68=yJw=Z83 zW!Wk}Fk1wGw;Eo49e^b^FzqqU!Hi4Lk?QiE_PwYM?~v;VcmNg?A|}_HBp)TCNm?8N ztXF)<-*kQo`k$x>@bp#ZG^7as2>ON8`&6p<3@BCfXfQgx*tqhmEYz=mZb~=`57Z2P zF&Jji`U+KBsjTc1EF;PEcq(hx#|9}1k~i2#+Oe7< z3G(Jd%_<$Bn|_J|{gGZLJq(%tB3N79G{EMA5rjFsOk4i`szKf7Xc7=vieq^#xeKwU z>c16lQ;Ds+Ojawzaq%IqM_0ZxWiOpY!mr@*t6$dty9P=*fokWKpOM!W0fwdLKwRy` zFdwR5zzgNBUc?yA(08CG*8Z(%9T@oiZ$)csojXwLy_v`pnXiSyI0)oXNc?COS_U%N zU}d84^qT(j`*KSL;wRPgDKd(QR#jB=U&Y+m8=VF+rNOKDGp| z8^(FfS=&!PjZv=2^ws_;;jK%uye8arCVoyk%g$U`ypLVEa$kHIj#1vI% zr=S|M7bSRLM2DmLxE7nH`Gu|!m^g`;XSeVd=p#&wbcdV2Zl7ImV_tRs93AC->z@fI zx-91T6S~=xSx{P{^+5jkZKeGO@X`S_SdJluabc7{pXa3bfam`z!j6(&yH9c?4UHMP z90rQ8h29Htx`fJy&d<#(m=!`KfEgUH^2AgDt)f~HGP;R(WgofE5pa@ za0u;JATw~#8wxM|NpRo6)=fE}M%U5S`4Jq?HPH<&PHmK$yAgWz>u}#q`(FT!sgQr! z*bnG4ktirl_SE$cd$vi?(e1YFDd5J({|c)x;*aQ4U41D4HSknde`2F~hMd+{NDV*Q z`JP|li&VwR_jCZvMod3BV0~LicsLW_()sUc+60tw zAnz?s4W*;fVxVRA4%<>tF060#!mK|zrQ62c+}w(rc0XkV)nNS}1^>QxgNWM7cG||E zNUj@*4L1LHEq5?~88R?uM2LI4JLxkE0>{N9YG2p4fmKqxlo@?8S^K5w_nGl5Nl28h z8xW7L|33i1HRzj0_$Ml4c70k#y zAWE+>N^t7->wmNe0or4}+l6{ghgwiD06?@rt6qAl=&W+7Kpk(7n`yIDAOgU^WC2bQ z_9mxV(!*#l6t`_KmR|ohGDTJ+Km)JYJh-#-^^xr0=mILDp5TiHU>l&~jxpW8A2yx? zB6%zIx@OblK#eP~-|PwLYl+9!rbp*1n5N&LMr>Gvv?aZCb*s3(<|I}J?fU);k1)K9 zK2=iYBO)#H3=Y<*9Z`ZGK+Ukyyno;Hi`e}3A=#^v9QP@jRcimJ?4{JJyElqNWnBj+Aj)1Cd`K~e{k_|o9r0g)YKF`n`~kvfL>zD$Tq|_V(X1g;09Ci1ckd5Eazf;g;eu4VF-9nZV=w_ZkG?k(bi4?nFn2{TTeqn6yAiU zHJR6`->_^h#*96YpYw`#w$6&m0(d-I0km*T%8L#rPD&c`gMp7XRhHs}W;fn9Pf!qX zZj%;yb!`Fz-TQqfPfo66W-Y8Z+rB zXmVLHfe_c;JoURKT(3HL9XebOx&P*_XQKd}X=6Y;hv~{g<@*fO1#qR?<1^gW<@RQa4@~SMN+k?$lHIGr>jHE9 zlN6)XXs98#TLHZ4`ZLA1V0B^Kt?=yPnU?3>(ta{oBfCXol%oU~4*X4gspHyOvub~? z#^l&Afr*|0icMVQe$x|*UYN4rDq3|oO#t@889pvvT@bZ(B60W;n>Jz^$}bZJ#&xUf znk^FvQ&D{}l$FftaFJxcN-2m)HvG*u+=cj32qC$}k%W@$yUbFWccMnb&Qc(YI+o5S zTG?8*X__NKU|{L3$%}HqRhBQkud=LFRH_v(t&Qj;Vou0QT~bktivAZW3UJQ+(5Uff#n-HV`X%?xHwEY zG&tf-o&_DS+9nIW8+n*MSnhSX!&^++P98Q6f?JiS6v?ZfH9()%pagC&I}wqk>2K=( z`#o#IP~KQ~kV#3s%U&$j-LEoaqL`VX9yUCayhq(BZ}7;=Ew0I9631aT=}i`4cQ|83 zd7ClIVCVh(qWb#$X%nF)jY?NL1x0KYKz)OOiPqj^N^U_!{Dn0rtvPlW%gKTJrPlFaG~6wE>Q7w(mrH zKcxBLCB?t(Vi_$eNbC#9C{xvOcBzCd_;`RfT4B4}NGM-c)_?>)n#vnw_QHKFCco9}U&U0ZG zdB(4#>k^3;Oy=wB0jJhe15@L%!DPkG%}s+hG5+{c+G%$s7uQ5&Yy(yzEs^{*e>)(a z;>@zuSzs|V+yB5Hv8A-#1C|sOyMbFW@#S%m+z16G7{ivY`mRaw2OF3SIEnYOCgQxmeZN5w(76Phhk(}e$OhNWNthKA)(55MW{?7U!^(H`8tN)k#^d4!9Xj&Y+F^it{;ctgi z+h&KtP+rrtM7u8`(@9nXau9ypfU#P$bC3O+A(I-rH(}2}qAW{0wG(bqn~cI6puvok zI+YOW21n=7btSepk8d5EL(Z;EG@??K{F2j)`H?Lo z-o1|96FgE(a$m?NcoZo=1afWeSr8ckQl#VlOSGYPYI(#j; zNe=>9Vb&V&|Cz`t&t@txZh{GJdYb#(F7Fpk8o+}w=$N7M_;1RGUZ3;rsB4%7qB^rt zI@{4#yuZfaav4w6e7u-H#Z;N$N=Z3}HgS1)&aA5g{C(4c^pu60;0tZiCg&hdzkJ)L z;H=9O<2=n{exY4|R5bp z6|luGfzZ7<$LA{N*=HMb68rP~GRxthFJB*;Hg22l<#HLd&qLS01pT{W42XxGR!me# zW39}WcU%r*2Y-qRL|<2}XqRQAybQFT(<=;zki)Z=eGfMPhDM#7iio&IVLQOnqbd7~ zCzg&?_p+c%aH>o1;r;5m1_r=}^itQ<5n~kbxk7I62g|eXa9!}N6F-w$Z30M5n`Y~_ zw@;=s@-7lfNEo>(ISAmusz_T`<92%#TaCX?vB^E45??jOD%7OaGo^FFU#5aDt6_>Y zsY~{dLBy|Wt?S3TCyh7@{F)EkCBc;yI_8s3F@G$Yy(-ilf# zo^8dfXf+FyIY2XCSSMb$b2DFWN)D|NJTCwYfON1nNelCkwEqbT!+bzMZXMwV*4)=P zLXG?lE^OmC4Ty@eTls0oVgHM{RfT7v7eLcxsfDiyd;?XxKBCzGKu7ZnSu&J?K6n>J|#`dz`U-JPZ9u&8U$6`dWwpc4RB z=e_}>?bPH|c!ug-HQhh#(k5kz3j;<12OMz@kM5HQ$e%H(Ft2+` zB~GtqSmoodFV8?$IJRy{J9n9<7;sQBFp2h~;qFGRe@OKsG|y&g*Krm3vlv2z7*={cqr=lc6vFl@YzCbz-ZuA|WQiEmMVYp$)RR}RbaJ=KApc8A z8`Oio&^G;IyeFlV+K^n-@XAc=JFPToxXAl${aoV}^bLGCF+0P+ z`xLzfa$4{%}dGY}M5e`9t#47GfZwf#!zBkAxaBd2DiW)Q`=jd*j{N-bB$g0$fWXeqxioo285#2Y4||n z4^_LDNiD!5q}Ibli!Gm1-z2TD%VGfp0ZRc)1Mhn_GSz>~fOM?~eIda5>+1WZN z23Gv_-RhTVq{c9FFSur*XK*(#q= z*%DNri)rtG0g&Fi`9sLT+7S(Td^>!Zr>Jmnv7msRTgi551 z-*qlIN5PF$+4;F6oTwH9m{&b%FrqyUlQ)?Vz|Sj~(W$vFs?ii8or{T@G> zoDrpt43t5mnLQ_nsOYj@dJYERK2c=t=oD_-A2F?jBEgni)w=fpl3D$(NkWGzE8_ZD z5c2MM!_Va2UR_kS`!nLa$+i-1KE@k?GCayMf}rXwOZW#?qxvS^5}4TogF)0LF{k7A zC#InjU~PG>U;BVsOkBK3rTnhX9N2_fBUeNkupeqn2P(koxFQ>@Yb42 z7@Y7D=kuH_p!b0OC{ckTEN$~q^S8GhE#e$|={bY_6_zGby^Rzt91~7S#>bt3GfZxj z>K$+a!T~x7>#5u1^^vME^Ne^p5QdMlRtJsrKc_EM?W&CdJC^H4G(FB|VT`bz>-$Pl zZKEHK7>K~VgppXUScDu#S$rzto<(mv+WQVK*on!B5FnYwVdgKnv=<>*LydYcQ2Pbp z92uL8@jJFLYC(4O+o^=l2e(2OsZSc>_X>RaEQK^@Mo;p@fWlAt7YH|D2S6{Y_ zh?CeVW^*^RqLd+oI$Ye^q%nU;({0TUBfBu^u=RS8t4GN`u>pmLU*1MhCSgXvWYHy z1WI`9_OjACx@OqHaliZ)rnFIwpSoG*xNU!%{tUlJw25ts3tWyd9G56MX#Mt@Z zuh7_tCQ1b+Tuc->Z2DO)t^hu+jXiF7$;1zsbVg9ZvQ^{bNF(?@KNvob4F(1sJT%$8 z$Uq!zuAVH>eQ}I)uk)n~9+efAXxdNsot@qNua~qqRLDe5hvu^r^~t{q$q1?clw(Z2 zQ|(UXu&nW0TMs5Y>>^p4SN~oqi39zJ$F=umcb}9^kWK>cKLhjC7@Oy+k;pQMuvQ&y z)(IKX@hr9dgO$kdlJaEuLd!AY-kYQ_eIw@dN92*;@)Uxk{RAIqUz${F_6WdFuMyF< zm~MJK=nIX|D1xOFA@d{hw@0IXmhL6a`+Gmf1O6Rt5lF4jEzWA*;DeUhkXh4h_QQbO z_1ZzwioOxJohl7s5naxsf=pw=O?VU8Pa2A(X=CKks&zLE8w?O$Dn9qN9*5uRrY#VZ^XzB7y*d79Xpo3$%W$Mq zXfkw--CQb`lUFQLSf0@?N5GN$j6RAAREONyd|gs#bKB16+k7y)xu3y8`kNoS(-#tt ztPR|Xvk?{nt_8RFglrjGsYI-sw0=!Am_+yigF=nx^ns3#Gg+3&dIBCWM)-}MaCBl? z_?NF-lr|ASAZmuRoQchn3qTZ23>J>3F86ErNRa};6o3mBeD zq1H_hb28Eob~B3a_)y*n{&X?}Ig3@6+a0^xQ_i6^YSIsW5N;%G?rpQ%`$>5mDvMVk zx|;}o9?)-79ZKCxj)x0BKL?_{pQwVY+L==t52e~5<1<;$km!;D-d{Lke233H;^}@c zWFA34r;MPBD1yTmI~77g@U!lX&d<176%hWQ3&P=^dQ}x%Ud-7*NH@sF+OF)}dXjo|{j`eA zNV}OTIA;#*xSzAy;WX?9*?cbi34U%eAD5#=G|}B^=s>O}tY0=~j!M-JER=OjTNqsB^-7 zk`VwFGh6>Wuc=x^usNi%n7iWsMDv3c!&ak@yU+lE*KC~JC`}9x!<4?%W-)C4Ya4In z9fhwv-6{w|-CvFaG|OAn+k^vHBKT5K`oQ#2ZMP_`XZ4qT1w1b)+4qmFq5v5WO`GgF zR8Nf;AkGqpLaRTNQ)T_N$BbV{ku+=>mNFtMJe;C+8Ygz-PDMW>*5cKET61P(tsiRZxS4jYLDBlvBI`|_o5JD%xXQ@?LFK#C16u?EqQ4#N;2<+ciqL2=Ji&j+;&y%L=c@-fecE<$X#GCfAP?ma$7cx^g*(m9N*PqK)R6B zNW0eu-mql~>{qz9N6HJhbg{pQq@|Oahqh_FzRj3cMF|R%SH>&=HuN-mw$y}9Trnsa z1NZq)$sS%f=-ZckP@3v@T@s6BJ#=yGJNPH=c9@x zMbRA^_Xon*0g_KTU_ZjB3N01!+sTcVfSMriR)+2eUP^DJ{LdBA7e)IxlYyQGdj$Fk-D>*6WL!g57o=t)#g0{LRQSj)r!7&NmgHx-K)^v z?-!{>%rzV<))AhiP&|~rTq}sIs5U_#wUdL8g@RhNy;2)xcsj%M2z>b0xFrDiar=Xr znu+SrFedq@1`T7y7L!F@j)et=)t*hh1aWN(6zgtk7L>%Z8Ipl=Xk1k1r`*oILoWd)f-&oCT zSlX{n8uO@rAj^UjMh zx4v7*d92myV|H7tKc=arAquR$*W`zJgtd+=Zu0aC2F?mx12=Fvwkbe(k~z7^V{an@ z*w2l9f}K`p%O-g=lx$aH-xD&DeUFA{F>refUKW!`wbUb;S3;SGWbLR%*zQJSm zN|Mb=!Q_&8Is;O+Vw4gJLm_o98*8_(pY)#%hR5kms8mJ<;(lqU)yG{ag3w_5d)!_s zDjJiH6YgAfD(6s)&?JPF*?0~syUl93zzpv7OO;$kal#BhBHSd(n7tBt?XBm>Q7 za!7NN`+qmuV!s3tA{%P<HrC`Jct5yP)4}I6NNmD1x z3VM3-$gswO7X+Uko11{Jz&T-T-W&=>YA&V(`S;?;3Y`Xq-N_sdQ4~-AXP{KeQ(B^r zqXjC6)_0m&%gDgRL_)1EFMfoDD8BiGW;l$>9{f#vNiXqnX5xUabiC+Ss6})D3kISx znGW@)d_77PK4%lzuocFQYdXu5p;Pb>X)4xdV)_e>tA z3f<8=Bt{JbqG?r9uykVc{VzojZRk04Z%;gYo34=ad26I!pVm}`nvh!Z#xiCSoobjcJHpq)~%@G^u0wL+1B-+l); zSS;Mo!|Ij^cjZSe=o=&LzI|biTA8P=JXBq(ZNzkRvg??JELBv+fZZa$!CAjWKvhxk zld^Tp4vAsIfJ$r0+SoC7sotUeZ<=divbRuyGQ6b6xjl-4U}YjsZ|FPhcOWaQBVZq7 zq;OWW6i&~d`oahJQVeO+>~eS&x{U(6M-aI%fCjwE)fF`cJ@o07;EX@HDuYR!E$?!F z7w=D$Cu%5|`M+DBmX3|5VI~KnTgNYLJ@FO=K7~k0FHOgjPFpukG8TmyTVNsvw_er5 zSIbQ@llL)Ae;|7V4GrB)Ip^tcK4M~1KE*7Lg!iuI;#VtV!z(r>tIV1_3zcy#+9csk z1gL@mpDP9gaEbr759oI!oNB))$pGP-3d&hTGGL|t-yc7lA?!1)1W8#fM16qI@Gni4 zadHa_GyK?+8d9_=|I!1Q!VTz$1U&Bly9+%IxN~W=ge^ZzYXFK9TQhac}XAbUqx(059o(comL;tU%&o@kqb-# zfis)ihrjWd_WIvUlmWY*NZP-$&`zfCPkIP}GyDJA1qEh(ZtSWzwftYD^i?>`Ta=%P zOQbBPkLs_3G@?_$3|45<2)K=YL;kmo1_KESV2(5VKfAyHeDQ<_D&;_A>wgXdA^~jA zfE+~tInw;)`)42{+9x^INcRCjp}(l(C#^9nIE$+C2h+A~N4+S5zmh>*lTFL;W8QJ=prZKebO4Xf0OPc7l0^NRJ^|skHyC{m zo*x4LCIsMbT$saDBFeTr=`=vR`)`|BZ_P6U+YPOsSAYE$(i#t;YNrx`l}aN1FZ3CQ z0WfR)^SekaqQ7%kixJ40C@ma;eY(;rU)3r@}JkWS%(I5C4duw*+FaxBUlj#WkK<)i5XLt_`x-6qG4; zS4nl?12YF%0Mo6Wh{daX_-UtMSN0a*YnbM#&wh(vvQnbuk($=|_7&M)ybPQnhN-25 zK;+*W zs&?}tM@C_0*2pig0Yq+QL6-y=I1qS~{MW$2hfMr+RX>Bazx+VqsK}BeK>t@ReIat7bH*LBw)iMA#{Z>78yGNf3K-OP zs1uG_HoeR)W!&aBkfL^017-Ey@Zz`xOj zc)>p75_MBWi?fIADuIUkTebbb^;4@70iw=F-M)dBf^(V&=N|nip;{IAv@2fTd{@s|E z$FX#0XD76b)MM{mK|w)<(3clRjdIz@0>_=$93B^zM0~EcVg+>QH4E+qR%KmygiIx@ zmtmX>r9UXev$b{Iv`h7&r~qE;y1i#Gg!^TodRcq(?E$Y=rRfi~Y|+n5Z;^1dQ(cgw zhdxV8R=qa@^#0x5!So9-68+LjV}tATiJws!14rNYhK3bCBR0X8hZh&?7juOXBVx{@ zYq6Fe3yn4_5|a|0r#s=5)2Es|TzGeKGqGCALzwG(tLN;cX8~AfEzijqbVrAa>&?_0 z?ei#kfiiz&{A}$27GO~|J;4)yj^H~9inV2bRRzG4PoN3j*0+7$_NDjcVqIB z65kmFRM{*p#4u?YcLbnT05JT0_0IbV696b?OJy2^K=Z?mg^kCEb>}0Vg6N=0s#nbR zN;a$7Y$`K2zQ@t*)awdN;=V<$+#S11L&z-P`nmdR3w_uNeIdRehSB1>jaNi(^?j28aCf+DoZ?(3Vj*~w z7q{B-cdU7HXPG1Anw#A}4DKRWZ+7*jsI_XFn+2wO+-_w!%>gvpn)3-Q78^S(ARBc} z4}$xyo}T}tm(r@BsJgtQ`KG@Zc-Ew(Ycf|c^CXq*T}+d20jnIoJ@A@A#VL$;h{tJX zO~vtHoyF%^)5!Q^o5lsN9|{GK8v@{Oo-=T=Nq$6cw5eSVQ1w906&C_vm-m6EUrh0I zB1rfXnj(BoFJ^6KfeA5Av@8!McA2xADA5zNu(Uj5P$2a>Q&h^@1~h56Xr#_zGrJ#l z#pN0Xp#iqUc)Bta5D-svJ*eB1;deeO)mtYa_jyXEf@XD_D;5k|ewp}FpM|yHzROfH z;GSp6G8+t0hktsILdziRz2$CEP4%~LNJIjjwfmK$au;W#@`2G`JvYgg@rwVxObz;k-{2FjWqbmFcnMU4%-pF#!ubrdx8xmx&G+(s?EC}-6Y-L8x z1Aq2Qw5pCLb{rOx z9NiEBe|)I`Jng&83*@jdrR^?DM$t^OcpoE|SUMzo6O3fSn>J+tUX{yB zZifxm)Ks5`>xH%r!S?`L^?Ckb-C`dv-JA$NuJ^C?MePGGI-F^)!HI zE}H}xosvVcGVu#@6MbK2_7aRpRs@Ug=B+@`?*vca|>Nh`e?1H##K)l zL?W#+>)RF_hWK?|tfS>EimGDN@-pyJkr)n@FJ$80wpqwl15XUO;of;`Z}*Eanrq29yameda*&>M?~0pyue;-(Z9JQN%R8V!By#~0EK53ers1%8*Xg}l z&DoVjM`v_pQuubK0gD~?<2|r@8t*ivStx)&)4(~e*ll#`@ks;h2fRRdH01N(z(N@9 z|Md=!8Iljv!V%71?_fY(-fc%zUXp+k`VQk6wIa(DumLE;+5R*gZ<4aD^4WZ@=_;*XTIG#-C=6SUtIc9QPc_xOcOx)X&wJY3 z+`JJ__mzjLj)s%W6}irIZg5?3?Fv#!S6ub#?;=K=#XQf^RGWA z{tF9WHY;5_(qE=udtGO?fK`oY>`ecoL1gx;0X7})NGs%2^6yd*+*|WwLH9G$Lv^Vt z%k0JLo?q%W;gK61&wtO3OEeqbE#B%#=&)`Bw_l=^9-sx_KF*Lea4|sE+`owq?F+-BCMoVzkDq(Zelu zPK{`tj?d^D52vY*u1v!mz+o`(%Tn1WPcyblUNz&Jm~23#bnmZ0l@R4H!Tgv+B=f#} z!qNAirb@ie3-J0(B2)1gkKsV{;IVQc-0wVi*d>=A3u7({fM;Cn@>QC%S(5Y4%d7hPwh# zmx5Liq+?Pt+xg`x^EYB$42pWL%kYQv4JnKIytRo$pAhw&jtCxR<67FxRbNmG~*|=DnwbgMP$L z3)Q-QHneE-)2c5FL>83BuUsl}g6nN<6 zFLSguMt)oFNO^l>_>1M3t ztLJYuf>?;gqg8jQ0t~lzDEiQ6s+Gy3SUHg48oQ1HKFktVFMmsjYfexPsz{AxnTK)O!Y5n7Yj43J@-qrq@JsmU3XM!OEwU;rqBj%Eqo=I60~WO{=f#5z?3~b_+I*2jL2$i@6>W3_kDK#=1os|_@}VvB@@$q zewvmA=hZYgqr>7n3y6qdatNWx!Z6EEJE6P!AZ#G>7kI>;R9o@aG-D=0b(834=H2X> zH%>&8T;c$ze$(W86{e44{Mu1?xw}97QsTCaKMEB=*fZ;e%T+0Ew3%Ai;ry)6&e#P< zOP2$P-0jR!$`s3(cY(k(qN;ufQ+4V8$JbZKMfGm|3W}73AfTj)NUC&~pwck|5(6UL zImFN?ptJ!lNU59qa?TECBqb}ODbkD z%300kwwHfoB`SnTCcy8_b|fqU_H$Fa(G$Gr?@jY3I>bG{msKveH?zBaLv&R6yhR4$+_H-* zUv5??kfVCZu3WbI^ls7s-_pyUN|oYP@bqQddnB3e?A-U;<@bAGC_Cp~y-Qs&?xPzU8I=TYYZ!KmGtz{(zLr(v) zRIk#`pt`^oIvU~@%;ai8o0-z0wAF7TH+emZ5D(69`ZJWr26UC2{J!I&zAWesI%|1S zOz`(+`c#s{f9$iTN#Z0A&-MhpPR0r&SkBPdxI{;4hdDTJLn*#Fv-L8CsmD zWyPLw+?Hyx+2k9;ExFmgMenaqu)~09>1t=?hDI!3MGvFm7Ad+QgV0o0G{nK|v54z8CQCgh z`Jr;Q-`}GrD;2FCWoqy)BC+IUC7LeMFG1uImu9 zSZG{&CiNpFg|GCmapNpx9{isIBsGAfi)zC8A4upw9{(JE8r^GohMeh3$3^ErIrKBo zTyTMsk`UY_-2Q$EAp2xKWWhUk=JS0(;vABB?1SNM%tWbxV3RT3H&4i%B|tn(BstN2W?jq=SoFeiO-z08LB_B|4V4@yOn3(a^xRaacd;u z7qCkH_pta!5d&?^4_Bd)Gcmu^@e4QSVs2~!55rlPpP{s{!HFXrR;`?XAK7=K&WV{>278C8XFo9l0{yraQsLRAxcF)L)CktGRw#2RfY)la6 zw^d;g|Bwb!n;?~@>8^jSh+At|QogXP zXG3q+8E>ks?-*#gi`18?|JiEF@Qlv?1)Ul-_6_yj(Gt`45O2+qdMW^?w{JwC00^-P zGWvG=PmMuRmq|N5KFCm>>jNEORzb2{d`~m$nYZ`qXuO})Iea6wS#ZJ=g5G5M=MZML z)si4LZ&?LrW}CZb8P@moXzD{dN2E3k4sA2trvhI&Ey4X!{L|AQi?4BMYg^r}r9lVX znJ`_Nr0{lDof`fW&Olv%X3wefm7^s+V)f2`3{vPUGI#Pd=)(N?e!VsFj@ZUhj zmC3rAy_3vXgDrLyT=cjhekyxi50B1t+%y(8A8iSoziOeKqO)PVHdEevm_oF!S6mAP zEtjr|q1R>WSJYA#?Z|&g* zFaSD54;TP+w@Bs*huivib#4i-rHR*TDH1$wQ~eO--}PG@zx%mb_5d(nk3Zf*P-Bmg z%B)Jba53RD>;?K6msNC}?Qc|Z%TT9)%j$41VsCv7wpakZy8__E2pAcNW9G#94N)$Z z73w8GFYw{*7ck7$*7?Ojwsn}Hte8G4yh_lgdjvF%gUMIl<|w?NAL|I3dmG5f+1eIp zt2=>(kND1+LqG?3xN#y7onU<}fk5Q}M(vLw-p zHER_Kl|Ml9Gio}_q-ugdXWsa@eZz5WTj$B~k>^~Tol+1vlNGN0m*!lS)^85g_wvob zINu1YIdk|*y$m=M!j7s^eJ{AEt8)Ac#FSuV(r`;DHf|XmF;7{8<7qc#2gGkm{{C`4 zi}VRBbsc1j6`%*Tz?eS2zt73Rf-UIgCGh;qxea{CN{(nBGOutMe$e~g3GN70R2TOE z{b+sdH|mcHmtJVi-n-}Bl-H&unS<%Xw*J=8J%7i)a{N=?$MVD z6xZr`V+IQzM>5m01nXAhZY_Kx!|5c)Nq2*R)1*T z#aQGvrRsaAxgqV>@C76+_Pz)0hDuW_XiztM-}q#N!?o&hTP0MSJTXrW1{PgH72WH<~0!X6JP|pGE8~ z--P;PwJJVw=>*L39y{A$yrQ(A2YtQ=Nb@S-Lpm)kQkIwapaJ__(ol!RELGKhc-mN{ zz2U}1&FEO<4n+HQxN~}&3QbhV*^(30nhvT7gM@E_sUvmn# z#=sy3v@I+^zn7*M!xGvfrn4C&n=%P)*b_kGc!HviqlVKX$s&D?x!mT8`o;86o1RqZ z$#9Jq9@z|hO}WLrSjTTC2i?AiXd$Fu>nBF*g8WR;7g~~Xw63>PSH#QrwM{d1A?8$e zbr>!C2d72sMrHNP7<~f%%)LWe8`4Ebz2W{Rb zpOw=mXnp6e1uYB>n$qc$b5=EV5ZX3Rh{Qi{e+NkJO8Cn>V||(kcE!Oexf}1DxZWS} zM$d|v&Az0s%W+h)mfk~(*ynuHYAIuXh>5#|O)c^I5p~1$8}VKD*{x**Et)KVLRarS zZ#3*WO?c{qH9ZKGN+Z~D=xwmyu59w{_D_CU2LQ zV#rAd#2<`3e@RwL8;97SvqD)w39^$za=#1%KF%gme7EQ3B=vpq8<6%ZlKX-#2=>Bk z3m>%`KMmcNWwcbs;Ks-R2rmqIUmRp}@yUG4OYwH{m`A-7OBE0L-Ld=op*V*FRSWw- zQ%OLCG;UA*(oiWkg+UE+5>^&ceAl6DRzCwT-;#Gv$bTq37sk#9H_lESif!0$;;Gen z#y_9myautqfRXBvjDCt_gqo(?1q>)_Q7l|>;mv7NZkW?4*;1iCIK~wDVp#Vz_36*6 z@zx&->MgZB$jmFzqM+IvwdUc0MF+nzE!ZPCl}-JEf9RbD{m4wxSb0&gTqpkXBk@3& z&fKXgyDyNqbVp}+{vkRfL>8US9w~wSEnB1^Z|uPtD-!Ay=dVC$tqceWpy|k)y+zYX+JyujzF9MzSm%JCXMNRoe72-*iNI62OU<5s57@`U3AS1augIoQI!_+>rlJ%m*RXS4 z8P+l|oTI4yhCf1kB!mb$EJ+B3Wqqg9|hRRF6!PbxjW2mz}+1 zgzC+`JhF}D#c3wpXUU36AT;^xve6MTC?_RTQvuTgx_e;0r0}f{GD!%OSEDV}Of#8p z=7i=MK5!hh%pPf?GhD@7(wGZj!E!IeGr_nDUC59MVU4LzH$el+_l=Qj?-aQ=Bkp1p zG)VdI@iSRdFS51+71}fnn_9?AeHQ}R zr``v;%#{`10Em33l-Ems--N2j?K@7Vdbpg}lIGT$Z>@u3jl(zm>ih)CXl=)w1h(+U zS*iE~4Lv)tP`oVe72PiTRvJU8{q}=`I_%ydgW-K-U|4gIx^y}|RP_YwQl3w8mnQ1X zjm=V*v5%HwZvU|Iw;LGkr*ny%G;qYyD5J>!eOvu zaLn~D_Wq0wwj%Q`-Ln);KYe5O4O%|Xm$6xRsfa^*iXA}kDgcLRi;=XpF>ZvO9;+5y zKc0@2^BIr(VBPvtbvF(a@EBlYh3*d)`Iz$5?Yu*OmY*1?95G9v4LzE($I>Z`b$enL z5J}vUZ`!w+{bfiTSm^TWyPk%9jcXR_gA;~wAK&cMXl)om9T3s;DhWCv5SgL!1f6At zq>q$SrwPU5G-q4qpgv-1Bp2&`YOH*KNT1it3(O+9aT>4-2mvcyIj+Z;MrCTc zT!v(p=17)}hMj)}NwoLuDT%86nx_Y&E~C^ik*ejNpVs1$2~&@BtEEPnCZgIcIW5bF zG(h7kV$^;0%9{NI-tuR=Q!Abr)*eat*M7Bo@qUddzf|TvNnTDN`iZs;Hvw_#Hfj(F z&23XESJ{>Y8;3@m#44O>YEGL*uwWwWz;T-n4~PIwHAvuKgD}&}?4NHnymw-MMeD7uj$$u@TQou2g{qLH@5K)t|HK*Ybi{TV+t#+j_y>lx!c) z?KysJe;lBiUZ$C|Dvs*BX3>s9SwQyA!#8?6W0H~9VoI<_%uER`Un%H4hD= zKj0beAQ$u8zl=Q8@`Lt#Or*aqD)9*y&c2C!k0yErlY*VN)LQFHPds0iQERCPdVT%hPJSrkG77o= z6ZCWT)1J4em57GN=RBH#L*^~;MZ@bdV_u+UH0iXUVL4%ap3(5-=u}!3tK8feZgxo; zh+S^EIkxBCBpvao=3I#G8!I#IrrAhhWK&*PkZ?I`|Eo-{AKHS&|MR%e`YrKoBCJ=_W}vZ zckq+vNpWHomye=`uPEla+V`|O+(m@!R?jlJF{-?sdHPcz@ukYxnapli?Tg;0^v5R# z+mFwSfJ>oqg4Bzl+G=>IcZ1^x$0?R|3%T>yuRdR8$9&wRiQHk{p03JyN$XT|$*w;y(G%BAfZKF_T9EqDA5ie#`V~DVCftNiwp6 z^c`wF3(w29u{^NqEFs?NZq2e$T4lrzkny-vFz^=__}VVtU14d67gL+tglfa)l0-ic zmScC@oqau`$E?0= zydtEo5)6dMt8Vb?$XZXFd+FflF-i8~Nb#OZ>`;?dbFNZP!|3Sfry8ZX_jcc0ZhgG! zVzcN8*Xw_HKm^W0=}!rfws*-dl+dW%$tpbk`Ld8@P(f!dT=Jqhb`MdoqAq?(yZS>b ze{Ms4(6cQ)gB8R>M;jSmVLBXR0{fNyvERXR4Hed3oSIe(xfj=2Oxe%?!OL;yyOu1e zq=?;Ho=Y8y5;4PSC2vk;dnP@tj#)a6YtvW$@Jrh)OF?geD7?C0OMGz4iXd-0LK06C zDTILm*$y4y)U9cS)WnThvrfYi(&1=RFOk9Gn01IlbLc0Jx)*)JWn998PNj%whW^H1 z^D8*Si=oCeoPWqdK}~gdfN2^h&`BWqp7q+@AE4==VvQ`7!gQ5VO$B%PL+*%>Sb*+I z8C(F`!|jsZJM?d?t=p=oj?+Gm076C(k8WW?M$4hXUR#+CW8=extQv6V{J&6Vg;Ni_ zvm{$O9|NnH=qr6HnP7^6sH)cUMZ7~5TFcxl-;L+9)acLm8fk1P`2!-)aj7Yo>U(Su zJN?maN7(~B)GL&V1whPd`u~Vbb@Xd)pXzNZ+c;QvmSuC3(_hj(|2S`q8K;Z32=xoS z>uWnw=%i1$;xwN3ix_asI)2-QHFYn`|Df@B7j6T&q}~r&Kq9?)oHsl;$CZjVsY$kF zFj;-q?Z1KSbNF+dJ;PVav0?RwT?)VcqBjrGxK5S(DWH^X?-Bzrs-1Ni%ReLt5OSV{ z7K8s|Q}KWD3Dl}TAzt+t*UtVmn+VPxpzA<8VPN#~Ow3*C`Yr#E z5F(nyYfp>M7WflgNs^KyFb3C9`Rg@!K_$QLjyIWSe?{sO0sy=}al4f8mx0Iyzh^6_ zm^z!z0zmZri{_U%7zO?^)EcCZZUXL47nBw{gX;lSDhmR7dis2%MP=a=0h^&j)Xfnp z0h~MR36I)Xsr6ytGkpJ3AQarx1faSGRcaVVW*v0jHZzO^EAgBZ@G#C`$#oRGq@r+UWn>mC8XAMdDySoIK zEpg@$?Z22q*e)QEpp?|5resz?w*Dv22p<1Kn$(|+^Wk`r3D{Ww{UH8oL=Y|DHDYt+ zi~Fn521f<{-6bP`ohm-@9iV{Enp`$sf0E{D&Qfs&*E4@l6#kFa-C|eZ+S#;L#|3td zJU~m8djI_rw>6BQX|1-&4-W^^n|7O5t9LCYZsJOv&{=P|uGth6CfVc}h}&RPn6^Jq z_5L$Z(^`HHy9xwz|4fb0m5;yQjFj?xtlRS+DYN9DUZ0w>`Htyy9UHOvHA*fR^y$yt zZ{1UCNKYo|vXR#2Hgi44}lD3TAJ*W7TDNr|IX4izzRH~wg3@#-Jc1LbWOR6eT*h@NGj_E1F^jF9O|e`b+=c51pvq$#zNemf`T0tyu+y1=T+KDW zTI|I{HrgpblJDhL&&RuVJZO2gw?0v~hsz+96NP#s{)fG>_Al)c^jt~W$;*A`JnB-) z;gjMs^6E}u{h`&-FHk6{_mp5F7_-#hQZZu2FlJY?rqtjF9J1HHcAR@S8K&&?42h6LG=aLRoA7yChl6$nyvqL>-)P2?Bb`tgC&P?O2{M;c-tKW z@M8Giq})GTDOyVlW-hrEDb`mpYQ=H1oL98k#!l8uHk0h#yQfA}Fks~5>4NkWv zoNz^ks!4MgdmqFueSg4(OM`}WtqTUN=H_vn3nIz^=-ECMj1QFjJN=^5;B%Z`T-*zJ zgAB&}iB@}Lh1bTboi$C(*M;u}^$_RGnSp1J2#XmM(W&?~@Sx=6aAgcg^(;`?34n2O z;{kNjaVLnjuK}Qc80K^eAx&_o_$&%ReoBCPXra(?SJ{*S~w)@S~Qzq7vv z$86&Hx7YDa*?xo1jsVKi5+LQ>1zB0F8H_m3MaA>40a|*V%Qb-G9CMxWc4H86v1k*@ zZfcf*%*_MPZUJhy8yW7Ov!%o}Ube1do-_!l&V3DNtI|(g4VtXqVu_we8QZb0#3ZXc z2B`_BY)b@Fo#%b%aM8c`q|qwJ*?gd|Hdt8z>S(iTw?aX^8DU(CvpPBOlJ#QsQ{#V8 zHQevXCtUiKci*RA8zuIq&u_e`V&@qQ7wrF|Z3(yF@qm z;GzS8OCVLTS;;SrSjw&a*+=aGE%7;+i{1Tlo?;kqP<6CfqU%)|Yp9h%pMlBuhrU2h zJLy?|sRu!?sYZt7n(1%3a6yJA)#+!9 zp4}#@vk*8ou6g9NSL>$chE}mVybHwfgMeQ(0`CRAk|N;juzreR4{4yasgU}X0F>^X zJE;Z}L&QWTcT)e+@G}GYOB?e)^jEYY%1pCIXc_3q8_-rdXggG}hEArj4X}@?4VHFs2748V80&tET2k|nc0gtq3A$c9&b(lTr}=KY%I0GZ3s^-M-A=T1(qHyp3o z+jb?g+=cXgR5(4^YpA=s$ezkigvI4mTp8SQB)n!FpK;^~u+muJ$O?3uQs5qqw*E|= z#C8X-E!gE{4S>L#bhSv@oNXBcUYk`IU*2zR^zCvgwI0K!+#No%F;bq|X|4_L)>BHN z+%M^Jp|!@G5=SEQS6r~vppYRBk&A_E+8QIBZh-l7Pw`wAw!cb9Hsb*7AqW~__U}88 zSezrvg)GbI7a)ErHC2S0YP1GqUqWVv^z1S9LsQhMV!b#uKZ2s;81B-soKiTVBD%)6 zp{qf0O_x+8f?uGPIiiKIe09L>Fk1mCnNzY5%;NKVYKzXlgMd#Dp(o3|!ulz9g|D-8 zdM~GcLyzpyfGKS6F+Eyq&m0FJ)s`rzP!5zIyiGzLv8wl@VaiQ)9eR^J1(kp;Z|hTyQ9{g1#IPsl2w>LR+2lJ5}Lf0G^y++$94+w ztJ1S~|Bw*u%>18gbWN=8BWzy=BpJNyjtSTQiAYLSwQbgkkNL@06hW^}xV1DSHw6 z*+S`CW9o_ursL@)1m%pRKAJxbu}Mh@%8zJSPR>WQqn=VhIh3JxY&qJAZLDO}GlX?$ zS>cJ5T=me1q)3UwAFd;&bVYctbq(`mAmT@S)t}f!;VD-nTLOZ3{*WbXg9yz%I}tPf z2rk_8$l|7F_a*&gZvd~*RBdBEN!xyE%zH%1gl-SDB;34*+65YhyvcV$T+MAY%R!78 zFd)b=tj={WuO)eMdM|@r2NGus?@>vA%g5s=Hjo z4&~?A`Pmej!2V(|(0~gcvXmP#U_$r(%@RO`o#3Kr(9d>2v zhMHgR6l-ZMkZgBwNd{^uncrHgzwSc>(}Z;sq4;yPm*mRKxv2*BD7yX!c}7ewk(rwo z{8v5(uuD?2T+hMoyp&9P8=?BA&?yc^T@U_~=PkYVthA2(hx&s_YBa3mp4P)`JRv>h z{I|9I$^^_(`qcN}f%^>I`!2^?#+xa3?27EnW;vdf=X3k;N91g!6-y5yARCxQ!`YUc zFIqi;CCOsQ!EAO(sN;%T`)}H5U!qrPQZ2(D?rFx)jc>G}M~5vsY3IrC9dWGhNMW7= zRRdgWoYmdbzwPGfjNZTAEmt6*CtLabTh}Sg@Zfmp&S=BU8>F!I+|aywMcM&`rtyB0 zVf&JZ3dNxs7LWcDZ2{g6CbrkXbedRQSqdk*0{ZW9Z^1aCYb zBThR?hHB|F9m$*Oc+FDzIx?l49LF-VS}=hn5}>(FznG#6wbtN)ks_)1B=+ZWPU9jp zec2wI@&e{sYUV;!B=JJ(c>W+kE01&psky;25!WBa#%?7`*ZeA?wxc0*!8MoO>VA_JNhik0l znbVOEvPzmM3ZhAu+OGIIiIL?|u|VGb)b?ri?Xt$z!wXSnB7D;lz|JtsAwH`-&^cbz zxFe~}!wAb*5?<^g>r4D4khrRU#cWN(`!YH_bL-${?@x5`Ot zdjh|wt)`P@V6`c2nh}H9Xn>3qS&ITGuzO!)sTI6{*_OUgZciPd3ew%a%OF!2_Rh2h zIcNV>`$6luK)v{;cRoqr?QrYTv}|W{e%v5`do_s`G~VL5I}~?@BpZa#w`;;?p{+UH zAU<4ErrH_MRLz{Y*_5_F>3iyJualV>(gC8>3C|*Y-Is$aFLW$dEVBUrtqY6hGfr)Q zu`j+ar&q4I%;_g}jW}neAmUc1Mc(@=U9r3XwvnjIrXOresG|M_aCh84HUrX(!z{-i z^>4_GodA=Bm@xGO`k%RyawloSEDlYV@7X|o(3?C}qBDVy3+ntXyrBh;rk1BrZlcwc zE~)ka zz5LH8?vj5F)!FMqmrOswsrxhPB4BI?176Q_`BAv7ixi28Ji1X8ht?c)HtN;?Y zs@Nm-;v38^`G9%Q!XeRi!t9E;v}5P9u#PI)Qn%d%00 zu6e}O2Y-B|MfjQpJuYN9v?lTX6B}=MU00v=UyugchKjv7P+c(}C?5+8kXB+}aXvae z-XkE{Tjp9wq5iNAa@O%O?iO2W0-h3@tJf0RpQjAJa*oWl|Io{6RgeKMB|1!6_Ai~{ zkly2qKavt3-k}sZam#NzJ=k9GG>vZKhz_)p^B&SM=ZBiGTSCp2(^5{)$)qe{Kz_31 zoxQgtU1it>2Q_AhU&RTyD`6Ds`Gj)Ss$uq*uTKvCbn|M9v0^wyS-rUR_;;IZ3sem-*95_hjty5d2tkT*4rk8>|Q6}t$1liL=z zpQ@l(9-`$j8~OFxXRdphKYQ|QnQ&hR-)9@S-(xvjxPu`CBxgoro#ksK&gK)?e6?8&eszV8czpB z0(06DH`U~K6?d|A?U?yZ=7ytn9>E4ekw4X8k>p~(zho)Mi(6v*Q%-)7T`U?AA_ndh za=dK8+cVc~`C|(UzUwxZqt5T+1NrXV>BCwEk?E>SqLs{U@WYryt7?yVOGmv{MSwh| zdR@>@bR*UII#P&g1Lc65HlQ@I^v;`-_kH^RvqPv)Q!H-=N^XQz`vRQSz5XqJC1$*c0Pc8;5G|6oK{vi*Q_p>X~m zl&HzhPRlOaOc(u1=8(JHZmB6wy@CY5K1A7mh@1o`Ko{oKgip9O5wltEKJi52)P-s4#eulV+)YJNpw+@BhG)&iE##e?jIFrEXJ! z(lh^`DigR)1$I99e{j_QzD)w^oT8#^0`spsPeFr+v(P;!svIQpQvmN>X{|HsD4p{U zApTR1gY%;V@n5P?sDN@D06eDtYnh6f3plF+txC#=v(e@2=KfE*9#EcLDGZ=olz#xq z*P?I!f^K)=_gb8%NfhRw`pYG*Jo?A15b)zY+nGQxsDnm{>lS7H=;m1vDL9+I5e*dO zfT1*6#8p@MkD)wis5|m|pO=poI_X-^TD2RsL!@0Gu6u;ID=mG2?8oD3jV8)ZuWuU2 zNk4j2t3dtPU;7SQYWla#*ZA}y&)M*DN${3F?M+sUF9_F|JG(yQ6)i30Kk_{IT;n`H zup!KQ(7}7UC;n#`!Rv}!jDqu*sOOQr~Kn@-V|N}1rg_2n?Du|9MJk7V`@<# z;IY>k~h3qd&PaQuO65?0NCQbX7)vH47KnHK0 zUgh%<2s`^>n~2z^ZclSwj50lYai;PT$Bc~|^pkI4}OYDL|P^DmcAx~rxk^JT>2 z(B?0NVnV2L3JO4_v-Ar(f7zoV%BigaL)e)K~<|-all{K)NM6A zJy`oR)|6DX+52{e*!NE(7$O>!h3KE%8#xry$bqunc*vHZ`^|FhygACL|V4Y^MEy-#)8Za60_^WR^b znoYbDC(g0sJ0G|BIaW!Gb6|JFkWyOJP=Z=3Hh=o|c!vw}W6*!!(Dj}q0{JO-*{dG2 zstM#q9DxZ%*q>RS5l2k%S#yUO**qz&tkDYah6h3mh4;vuhsqM$hjOzIt=l~V(b_vC zCpF>;+AOD2$zw(nYdrVuZ7tm`EjK=+SO-rSRz7jnHlR2~nlbQ+qpPBa{Ci`SN5M;^ zhw|pO&FS?s6_q4MK?Pi@ZeFXcQ%frwtKLdeDeG8wxGg)P^V8{AKW%e;VY2?P0}O6{ zYZn9t|8KN)X@}?Eg=RREn*GYTzmV_z?dQ{$R|6q5M&k#DB$(az=?=dfGO=y%@Kq_Q5pySVedWYWlkO5#Gvow`Lx4y%jGz z^3EHb!m4DX_C>2S7x!|>N-=U@iS>$z49ATuD@ALSifZ26(h9a;M+tq1wL47ip(Wh^ z_Dz&Gn7v>O?VtfqMwdj0Gx&!W4Oa%!%@Ue4D zQHw`X9FZ-lu&;9b`y#%=KJ8F)m|XLHbgfdmX@0)4DIfPb2I*$$&VTRg^2w}CE=!86mqJIAE z>RWhHiG`jNJ(j_^>APslTI>VoVaeOXKX`msX7N2{9VhaUTX`<}q5hH7q1d5psJN zIaK)+5g7T_3GQPS_Co8|uB5v~Z#Vn=`w1d7Mp7l>j3F0&WqPzu7sKpiQR?74k<-g% zm!HiuMWyx>`F=f}S=+L(Ke#37Vj)GgP3cX>y~Q7iM@QK@(KCr_G4fx-%*8y9Ox2rU zS$_R2SlGR*gi_R3+9p0xWUfsl3WlpkN1jSPA0EB`G&;$x4$Z?@)6}**=@OiOiU)mI zjeL;e$Ll?LZ_JD$SHxtY)TR-pVy~vQ9+F>2DEKNNxx7+lgw%B%Asu%BOV_lG*fuotNMM;$I2aowMWsU>B5Zq zmG2%qfJ#ijOaPZNZ`re6OEY@h+T{8YQ15q))wOLK7kO(YpbB@>_EC8*#C zshbYfJjah8gN!Xz?Z4NdD+y*}-aUt(-M!zSu4KpKC+xQ#2iaUgimgcm-ku$_ExiTw zJ#7{3-|9BB1qc!w`kz@h_>}rO#I8vo&p9o|UXm2gN;x&mD{O?;t$ah9&i2^$-OBh@ zK-fig9>EWhLNP4=*c$y!95;Dvkl7rxLao2HyN)ceNVZ?A5YoqNNYB(k>(Uj5wq5l{ z2l%l}oz8J6z54Q!nU^)^FH3F|Vhqsjx@b>ikh7qfTe+k*O$m8gWUs`&ShYxnVbP&O z_p1?g_(Y^3)0LP-v4JHqck%bl`5i(VZz3a!B!``)ucjTlYA>xAFPQC!1T4z1Y@+D@E2Xt0N*#a$9Cwawsntyva$h z1V_0kf23abs!aK|sSr+}OLcKkw@QEF$a|LuVdqd*|CA!~5(}h!(yfJuB$9`X0=?{2 zLp3^K-mSi$a&OV;$t-dK2A!xaGPt!#cg`TK1zERc2<`n$(R*=cw&QNF+``;>5@{yn zi6+ca+sfBKzfTk;PoeSbkU#KC^k^0b8_z&}^*3}{ean5Ou_9J4P4tWLrm1bOjXC!4 z@Ui7#@uDx z(%NBv-npu#Ff=l3+{Hc2Yj0DzZnq(i#O0`{*LqOa)=QS=yMeE@VZwUXMw>Cip_gId z%FqmIYQt_QR<)3GQh8%zsuwKhT7Z)sJudZoDVTVAWht9KI@Y>HW&{N4|;rq+B({ukT zGU%xz_-QwXIX;w|wI%=f;MS!YOpF>3EPnLtYc*=Q_gV#La2fNpW4z8M+kfR77YQG%7!fR!k}$Q%lC>_Wdc!arzsSI7i~9S( zV6gznEuSK(_U-0w(cikMU)tKcU>WDs-4sGN4C&-qqE^yd$gi(^G~CqflK!=a!Sif; zFPo9t7U`R6Hze4>m`X89nxSSDQn7Sy^%=oiXBv{EJiEF<@5A8k#qSkpc;yhL{diu^ zzYDgpM~Y?>+Lo9QHPRB2zLD8tJ#IMjk;3!2j%^hplEBCsuHy?6bP@45eC^Qq8hULZ zsSd@Lk6zk-pr0N!FosfGadH2>h~2XA8kA%dyGv5Rs4tl{y}A2xAxOH8CO}g1HdcLR zaN)|;N_axBeY^sEfq7m(9Y;M<$WVA?_5@jp!pDzO4N3k1LChhk~b= z%EU-K?KJP7fb-=W3q>6D$olCQ+8H~7j>5*WBlM{blTZBy_VdfGy#{{ywGVfLgNvhA zGMdZ!}+E&XHT@BH_Wn%gxrngq~MMSd{;v>56>FSdV&xK2~CQI+Rk~HZ$0^Vt&(Oa z^FVN<3Ik1`@ySmUQmEs)pu2MagR&h|t80NL!&Hys!Mw@dB0b#A#4v+yu|58LFn|73 zgwJVl_{$})Zt4CLy3OFqH68^!-v@j7&7Hp zBV2#SGB)^F`&FRt+c_0Fqu)-p-N4NCB{~$GkcsLVvR5IFFV&fmM+fTlRn?ZM7|s_E z$F5bV8OnbOXc#}5LKD6s;@#)M~BBu7m~F(Oew}p2~S)?&Loa zJ-gYZHHg$K9GW?W8O_Zv7b|t9Fz^fwTlPaIT=VSi|3aol*li$RbP8rU97z(GncFw; zkq90S55CQA|2k-A=eDvZ{AR%oXus2D610ruc<=gry5dxg>M+Vm$lKAsvoy!#=Pe^W z-yc59SznuqAUE#wE6Q1l$8nkmg;)L*Bfd!+EoVetBi=Nonz z-`y1d-iPa2iFwtCLA;-W(CP&c1{nEsu$>CH&4z0-zJlHxcPaD!l>?n|BuHNC)lZvq z)O>GymmoO>I$e{8^zlBfqA`x`E-7RT`>t$nFG|2z$u?a31pRwf4PJ z!j%5IJ7b2-VnbC^2HGV|4RdX5YACrP;^0+s*=^hU>aJJK&s&OGL){D*p_xr?#%`4- z+fYje?Vw~Yi`Z4QP6=((ykz?#Nl49Nop^k1-D_>z7E%)ED zrQf~>H?TygWzH;-C~aF-7s6R0H)4E>3w!tLTF{HqBt;L)WxA!a;8#RCX$mCf_kDvC zs&#K1Eq?ADe0@^#OBA&klgBYzI65hBZIEzuNr$cw9m|Ej$Hq8O$+}t))s6NGraHie z8O>;ue2=8BMlKx}7ew4aBeuM|HfFRrhJ7DRO6-!RFi;UpF0~&W4;3|88y09tNeCgW zA|_TPr8lz41t;{weM0QiXd1NadN)-EJr~!ON2Wi=|F3**Lhm}V7E-muK+-9>{@$pi zUy>m(q5SwLI1YWvcBy7NqDOmX{zYJdy@BfiE8$pw?9_!%fy8(2tN~2_{EsT(X(4r% zUv^MK|v==8U#c-|63esQ(}lGc;csP_a7I^9~ZL|!-$0oixn3snLg^8i^(ZCxZ$lpd1&5oDo9S{i zi~dy!FsYN{R@0<2r;UN15-bXk$3p=^D`doFS}f#jv0 zRb8d7vA!uE9*5NB1Uca<4Co6mi~X>w5MG0g<7ES%Xqg$FjWP($)=GxmPPe6j zV8cc1;g2CKL9{Gp0b}|lnC4aA|4XL<@O?yL10SSGLp>Pxnp+SId?0wjw;WX8o*hY% zN8?WJZYIyiY+m6|3KEleUPHsF2%5xJCJ_S`lN1fp5e#zDk?5^`jUi1?=)hc`|C0LQ z^QF!6Oa_PF(_7N8!ykhftlX7aJo)5Pvuh5Q^Rt8GU=|bQsEqH*!AOe5m+QrcpX)Ou z%6!ahzHc(;78BUJ+p1k*J=mv19#wO=iq$72-8s>g^6cXi z!HnF4<6#}x{PB%3JpVji3iPQxa>XQ~d!kcomC|DKFo;Asl5A-mX{bSyyfH3jZu{N+ zjblYpqF^;u@C8qclRP-rzE^c!Dg~xqf>l6^P(W$zV@jcn_)|Qrjw%HyFRfq^mA9%f zWplyR8ktycQ@M>C1O@^VEu44yeYsM|BI0|?Exw`jmNmxgFMSI;sW+^@y^ojdr=(mr zTS=q(xf{jq<}Gm%8G2Yj;wEk*<<$|HW5rk45w_r#Y0voLh<@u(--F(_bs9Ybfu=Wg z7CqI*k3eH;5|Bm{(9^EQU0Atx;qyMISDY?S;AXqvuR@}TSiQ8heeti-=KA~-qv-HR zbGNk({x{Y;9)Wv~na;JH`))TDt{Y@!_|la`@>qsJBPo_b27OF1Ut1>kHEaj%j&!SM zF#bkS0sFkrG*P*k`CIh9=-HLYoV_m;ZHF@9bIa`OzI^qSb0ThmjEZ@#Ld8*2EZx4Y zInCE5_v;rz_LT$|O8WijV|Oi}iT1fXZ}oGT8(0qOhGwn1Z1S~stvdy~O2fyJMO?LK z5Q%-itjlI}eEuC2mvXzD<8Etq^)O*frt^pT*O@F1fvJOK^tS+N)exC3e+tPf&~tS~ z371Sk>DQ(9%3ZPSD={`o4!SilWpnQa6E-!OXE$UI{REX^QL}0feYpQmUFROpg!;$v zgB+EtUO$;~iu`JGCk>NWj!GA|(P3pxxh@%Vnai;0LUk$;p=~ZvE!0N2PK?_5SuSg8 zSgs@4+{xTFx1atwr_PJ#@8|V;p6_${KHum2etllw<;d!4mP*`bvBRlY*3KlAh3kc$ z;FWM(>1}N6w0uH95X6-;OtBt&($}o9=c0ROuyX1RjXla%lNxQE3X$kQar+~{M9eDi zV<8Ivb;MW@EYc>lB(hj%%RSVAx=WTL{U4pn24t5BuWjO^FfIzY*+LPDBl>03GI4n* zf_i^Bbg#exYl4##obB1eV?DoIU#|h$dh<)VzD3xASebA;B7AhVsv`j#-@jw-xa$_b zDIp}HH#<?E#Rz0h>=40X(l_16klqUOAu@-Ihu+5~usje|>I@kH*uA+%h;??Vdfr`#3 z$cw0P^_6~{l4R<1;`tFiTSoe>9vU4cE*pqzvJ}2dYAdSwbANk$(um-8C0;%0*^%?3 zQ=gx6=<`uv;*Ti6Is=#=eM*K(#_szX3<*-af7tA$q^>;IXT0+u!V_KI&dcBmQ@As& z_f$QCPRUJ^j<7954wAgnfjMU`-eRTAOtCZ{AKkoY*wrAc`|H{n1h&^nVDFn>b%`xw z9h!s6tvUyFR7>fX$R{>|MA&fwor!x!W>wgb<$R7DfrldVej``9&i3N0hQ+oJFtPFr z7bPLQL_ITr|F2kXmtdITzL++ga)p+a^eWkxz|**;32^6i=`!%qu}XNrWK4LDlzP>O zu>0uT?0o&5*V>rgs@D;z{EVE)DXU_HIB>-SYK^x|3qVY~($?oas-kbAW40OA^j5f~ zpMZLjBNoPn?0(IOi7QAh=%_medWzl8tL{}4L{Z~9SA59Ou2L@#Xhg(N)+AFH26#P= zK51WphAj^9saQ9YJWKIm42LQ0oIdxOIBCZ$ia|Ev9L(WPaW!iWN}_HTFlS2GU5kzp zSk?Q{=k;pixct!;v9EOg{bDtoyS;VMcS)VhG*JI(N9I*_5xZ!f&20!<70P5`D3502 z9XJtOKkQsFQ(;u2ukZ4iM4O!%EMb(I)Z}4vTEH^s=z|@fZbGaCz|r@m9#qY>dPcGh zS0TL46d5#CMEWTdTg&3t2@T;@UMD^;=O@LtHl}$Jy;Ve;6S8$2usYqP4r~8_GXBXE zc)^G5=3C5=G17B@YxkA+^^KVal>e)KM+-qd?+!;N^+_@Wb|>~7C#pA_89N4lKiPO^ z`itC$_Fo^;P=^XhxU$Ek_mSW|9 zN*bX%U68N%9-ckxqWr5RWu9IE8FwQsBySA(X%~#*eq6qPD1tR# zHDB8Z+k7S^7HiN89MxQgp^K{K3p^(`pkJVCDJg#}DrC}>G{X!sMj7@BsG%iN`&*MAkiiep z&XBvTscG4`YA{e)*AHpdHFF>UCO#k%VK?ZWEek3DtVu`W!ANsbV086FdiH#*q*=Kr zNw7YzX_@_AbaiV{U$d5WGddfWZQtZW1{!6IGcde?!G#SV9p#pFVe-}wbK3wse%6Y4 zL)I|Eo<~mqMtgX9{b7nbwzRelo_|Y%SlfH+_;?tRVR6!ds5ManPlGM?PjHBv{yEF~ z_eNltvLFyBA<`LZcYh}N(DJK_G?>A12<#g80UDWY+P#eBg zm~(Xbm8z4Y-O65?h21l-r=Q}K<+`TT`TZA;K=RCFMBsjJMeAX)>WulZVvcap{fTz=$bW9S(fxEvOV;1M7QR3j#{BHeV%qbH+OQ) z^%5Guc()07bxulA*Gg%k`V(QtDoL@-4vQsggJlVZmq(JUDLmJ+q{n4n+L;7|N3`)n ziQCAU>_C3+aq13ZkKgH{FZiV+yx0c+kV?{f7{!2x>HTVdzCEkkY$InduNu|IT>Rs0 zL2!#d`p`kli(__lh$OOP7J4(aK_pg!QVddoq2P)KnMQ}RYB#vci(AaOILaJffwd}k YW7!{2(s9u3m$i2KgyV6#&86%A2SJncN&o-= literal 0 HcmV?d00001 From 493f792ff22f477330ffefe13aac657df4eebe1f Mon Sep 17 00:00:00 2001 From: Wenhan Shi Date: Thu, 15 Oct 2020 21:52:47 +0900 Subject: [PATCH 05/27] Update _index.md change `s-4vcpu-8g` to `s-4vcpu-8gb`. refer to https://developers.digitalocean.com/documentation/v2/#sizes --- .../en/quick-start-guide/deployment/digital-ocean-qs/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index 1dc6e9845c6..d8a5b929ae0 100644 --- a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -32,7 +32,7 @@ See the [Quickstart Readme](https://github.com/rancher/quickstart) and the [DO Q Suggestions include: - `do_region` - DigitalOcean region, choose the closest instead of the default - `prefix` - Prefix for all created resources - - `droplet_size` - Droplet size used, minimum is `s-2vcpu-4gb` but `s-4vcpu-8g` could be used if within budget + - `droplet_size` - Droplet size used, minimum is `s-2vcpu-4gb` but `s-4vcpu-8gb` could be used if within budget - `ssh_key_file_name` - Use a specific SSH key instead of `~/.ssh/id_rsa` (public key is assumed to be `${ssh_key_file_name}.pub`) 1. Run `terraform init`. From 33675f73f3f7a8a278e3f6c36ad36fd038a03b71 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Thu, 15 Oct 2020 11:10:55 -0700 Subject: [PATCH 06/27] Fix internal link on monitoring page --- content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md index e44a8fb83be..451677b3e35 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/_index.md @@ -62,7 +62,7 @@ By viewing data that Prometheus scrapes from your cluster control plane, nodes, [Grafana](https://grafana.com/grafana/) allows you to query, visualize, alert on and understand your metrics no matter where they are stored. Create, explore, and share dashboards with your team and foster a data driven culture. -# Enabling Cluster Monitoring +# Enable Monitoring As an [administrator]({{}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster. From 1d6e6fd8f6677800e4640ef69e0976b27390b2cc Mon Sep 17 00:00:00 2001 From: catherineluse Date: Thu, 15 Oct 2020 12:42:22 -0700 Subject: [PATCH 07/27] Edit enable Istio doc --- .../en/istio/v2.5/setup/enable-istio-in-cluster/_index.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md index 9bee04ac7ab..52da36b2041 100644 --- a/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md +++ b/content/rancher/v2.x/en/istio/v2.5/setup/enable-istio-in-cluster/_index.md @@ -7,10 +7,7 @@ aliases: --- -Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. - - - `cluster-admin` - +>**Prerequisite:** Only a user with the `cluster-admin` [Kubernetes default role](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. 1. From the **Cluster Explorer**, navigate to available **Charts** in **Apps & Marketplace** 1. Select the Istio chart from the rancher provided charts @@ -40,7 +37,7 @@ The first option is to add a new Network Policy in each of the namespaces where matchLabels: app: istio-ingressgateway ``` -The second option is to move the `ingress-system` namespace to the `system` project, which by default is excluded from the network isolation +The second option is to move the `istio-system` namespace to the `system` project, which by default is excluded from the network isolation ## Additonal Config Options From 0481db7c025e484651d7aa4ec8d9e40041ad4d96 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Fri, 16 Oct 2020 16:21:04 +0200 Subject: [PATCH 08/27] Add rke add-on note to FAQ commands --- content/rancher/v2.x/en/faq/technical/_index.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/faq/technical/_index.md b/content/rancher/v2.x/en/faq/technical/_index.md index 1151e35489c..7187dd07eeb 100644 --- a/content/rancher/v2.x/en/faq/technical/_index.md +++ b/content/rancher/v2.x/en/faq/technical/_index.md @@ -20,6 +20,10 @@ New password for default administrator (user-xxxxx): ``` +> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8** +> +>If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart. + Kubernetes install (RKE add-on): ``` $ KUBECONFIG=./kube_config_rancher-cluster.yml @@ -28,7 +32,6 @@ New password for default administrator (user-xxxxx): ``` - ### I deleted/deactivated the last admin, how can I fix it? Docker Install: ``` @@ -46,6 +49,10 @@ New password for default administrator (user-xxxxx): ``` +> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8** +> +>If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart. + Kubernetes install (RKE add-on): ``` $ KUBECONFIG=./kube_config_rancher-cluster.yml From 30d7d68c4ddb8c4294621acb04f0c6a4628d21f2 Mon Sep 17 00:00:00 2001 From: "S.A. Birl" <33668651+sbirl@users.noreply.github.com> Date: Fri, 16 Oct 2020 11:49:54 -0400 Subject: [PATCH 09/27] Update _index.md 2nd attempt, since #2780 wanted me to fix some 120 lines of "conflicts". ?! I am assuming a user starts off in Cluster Manager, not Explorer. Bold 'local' as a key term to look for, as local is literal. --- content/rancher/v2.x/en/backups/v2.5/_index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/backups/v2.5/_index.md b/content/rancher/v2.x/en/backups/v2.5/_index.md index 4a10f006a37..12edfac9015 100644 --- a/content/rancher/v2.x/en/backups/v2.5/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/_index.md @@ -66,11 +66,12 @@ The Backup and Restore custom resources can be created in the Rancher UI, or by # Installing the rancher-backup Operator -The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the local cluster. +The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the **local** cluster. (*If you do not see `rancher-backup` in the Rancher UI, you may have selected the wrong cluster.*) ### Installing rancher-backup with the Rancher UI -1. In the Rancher UI, go to the **Cluster Explorer.** +1. In the Rancher UI's Cluster Manager, choose the cluster named **local** +1. On the upper-right click on the **Cluster Explorer.** 1. Click **Apps.** 1. Click the `rancher-backup` operator. 1. Optional: Configure the default storage location. For help, refer to the [configuration section.](./configuration/storage-config) From 0656aa0652546bd3d774ad00fecf7e3e9fa0e824 Mon Sep 17 00:00:00 2001 From: Nick Gerace Date: Sun, 18 Oct 2020 13:21:59 -0400 Subject: [PATCH 10/27] Add clarification on Windows logging support Add clarification on Windows logging support with some caveats. These will be subject to change with upstream fixes and internal improvements. --- content/rancher/v2.x/en/logging/v2.5/_index.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index 42fea2004b4..14043395a47 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -272,11 +272,12 @@ spec: In the above example, we ensure that our pod only runs on Linux nodes, and we add a ```toleration``` for the taint we have on all of our Linux nodes. You can do the same with Rancher's existing taints, or with your own custom ones. -**Why do we not schedule logging-related pods on Windows nodes?** +**Are clusters with Windows worker nodes supported?** -No parts of the logging stack are compatible with Windows Kubernetes nodes. -For instance, if a logging pod is attempting to pull its image from a container registry, there may only be Linux-compatible images available. -In this scenario, the pod would be stuck in an ```ImagePullBackOff``` status; and would eventually change to a ```ErrImagePull``` status. +Yes, clusters with Windows worker support logging with some small caveats... + +1. Windows node logs are currently unable to be exported. +2. ```fluentd-configcheck``` pod(s) will fail due to an [upstream issue](https://github.com/banzaicloud/logging-operator/issues/592), where ```tolerations``` and ```nodeSelector``` settings are not interited from the ```logging-operator```. **Adding NodeSelector Settings and Tolerations for Custom Taints** From edc2592944dca4bb0b469f24f50a063c3359c37f Mon Sep 17 00:00:00 2001 From: Ansil H Date: Mon, 19 Oct 2020 22:31:02 +0530 Subject: [PATCH 11/27] Fix OPA hyperlink Fix OPA hyperlink --- content/rancher/v2.x/en/opa-gatekeper/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md index 3b2b2ea095a..0b34c3b2698 100644 --- a/content/rancher/v2.x/en/opa-gatekeper/_index.md +++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md @@ -9,7 +9,7 @@ _Available as of v2.4.0_ > This is an experimental feature. -To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. +To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making. From b799542fb356c1571699253d22754090ef922c6e Mon Sep 17 00:00:00 2001 From: Alex Seymour <9771530+axeal@users.noreply.github.com> Date: Mon, 19 Oct 2020 10:19:06 +0200 Subject: [PATCH 12/27] Remove secrets from read only project role The read only project role does not grant the permission to view secrets, this commit updates the Project Role Reference table to reflect this --- .../v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 6d04183c0b5..9cc4c383172 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -113,11 +113,11 @@ The following table lists each built-in custom project role available in Rancher | Manage Services | ✓ | ✓ | | | Manage Volumes | ✓ | ✓ | | | Manage Workloads | ✓ | ✓ | | +| View Secrets | ✓ | ✓ | | | View Config Maps | ✓ | ✓ | ✓ | | View Ingress | ✓ | ✓ | ✓ | | View Project Members | ✓ | ✓ | ✓ | | View Project Catalogs | ✓ | ✓ | ✓ | -| View Secrets | ✓ | ✓ | ✓ | | View Service Accounts | ✓ | ✓ | ✓ | | View Services | ✓ | ✓ | ✓ | | View Volumes | ✓ | ✓ | ✓ | From 1d1887205aa2e1c25091d025c5ca294d7b9abaeb Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Mon, 19 Oct 2020 11:25:16 -0700 Subject: [PATCH 13/27] Fix typo --- content/rancher/v2.x/en/logging/v2.5/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index 14043395a47..826efb55e25 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -277,7 +277,7 @@ You can do the same with Rancher's existing taints, or with your own custom ones Yes, clusters with Windows worker support logging with some small caveats... 1. Windows node logs are currently unable to be exported. -2. ```fluentd-configcheck``` pod(s) will fail due to an [upstream issue](https://github.com/banzaicloud/logging-operator/issues/592), where ```tolerations``` and ```nodeSelector``` settings are not interited from the ```logging-operator```. +2. ```fluentd-configcheck``` pod(s) will fail due to an [upstream issue](https://github.com/banzaicloud/logging-operator/issues/592), where ```tolerations``` and ```nodeSelector``` settings are not inherited from the ```logging-operator```. **Adding NodeSelector Settings and Tolerations for Custom Taints** From 719fc581c8d9d823c03f81cd4123cda45b568aa2 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Mon, 19 Oct 2020 13:57:30 -0700 Subject: [PATCH 14/27] Add favicon.png --- static/img/favicon.png | Bin 0 -> 376 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 static/img/favicon.png diff --git a/static/img/favicon.png b/static/img/favicon.png new file mode 100644 index 0000000000000000000000000000000000000000..d8cf2de9f79e8dcc3a73dc8cbb98fa2a1ed6417d GIT binary patch literal 376 zcmV-;0f+vHP)NCu5k&CD^%wxD{XlH^ zc~Qv&T3QISO95(EAkeN0Oi=N9AQk}P1Uh&cWQPLOP6n6*0-&@#9UP#KY$p>iNF3-K z?E*;A;lKh74&0z{56GqSku?$tK7e#H^t&v;qeg)V%>mdf$tS~dm|6AsLICCfs6nm;ZkR{xh;rlI>s~a)5>=iUS#e3jX6W;2WO` z!(Ub&@*VK@0$zEhfi4M|ps97Bzy~I9Rv9=@$cR)vV=WK92ld)!chl|I$+cRqYfB#z_50}18O*6BAJaAke)_{Q9u9y1Q-B; W13YIq5?9^;0000 Date: Mon, 19 Oct 2020 17:02:16 -0700 Subject: [PATCH 15/27] add initial Deprecated Rancher 2.5 FAQ --- .../en/faq/deprecated-features-25x/_index.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 content/rancher/v2.x/en/faq/deprecated-features-25x/_index.md diff --git a/content/rancher/v2.x/en/faq/deprecated-features-25x/_index.md b/content/rancher/v2.x/en/faq/deprecated-features-25x/_index.md new file mode 100644 index 00000000000..a30b421224b --- /dev/null +++ b/content/rancher/v2.x/en/faq/deprecated-features-25x/_index.md @@ -0,0 +1,16 @@ +--- +title: Deprecated Features in Rancher v2.5 +weight: 100 +--- + +### What is Rancher's Deprecation policy? + +Starting in Rancher 2.5 we have published our official deprecation policy in the support [terms of service](https://rancher.com/support-maintenance-terms). + +### Where can I find out which features have been deprecated in Rancher 2.5? + +Rancher will publish deprecated features as part of the [release notes](https://github.com/rancher/rancher/releases/tag/v2.5.0) for Rancher found on GitHub. + +### What can I expect when a feature is marked for deprecation? + +In the release where functionality is marked as Deprecated it will still be available and supported allowing upgrades to follow the usual procedure. Once upgraded, users/admins should start planning to move away from the deprecated functionality before upgrading to the release it marked as removed. The recommendation for new deployments is to not use the deprecated feature. \ No newline at end of file From d5a4c120759fd082f385f33dd40fda11eab2338d Mon Sep 17 00:00:00 2001 From: Ansil H Date: Tue, 20 Oct 2020 11:06:01 +0530 Subject: [PATCH 16/27] Updated links of nginx & aws elb --- .../resources/advanced/rke-add-on/layer-7-lb/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-7-lb/_index.md index 072605c0dc2..fe5397fb635 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-7-lb/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/rke-add-on/layer-7-lb/_index.md @@ -69,8 +69,8 @@ Health checks can be executed on the `/healthz` endpoint of the node, this will We have example configurations for the following load balancers: -* [Amazon ALB configuration](alb/) -* [NGINX configuration](nginx/) +* [Amazon ELB configuration]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/) +* [NGINX configuration]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/) ## 3. Configure DNS From 16aae00415710a8aed201a12d76710196c49c8a4 Mon Sep 17 00:00:00 2001 From: Ansil H Date: Tue, 20 Oct 2020 11:10:18 +0530 Subject: [PATCH 17/27] Updated link to infra-for-ha-with-external-db --- .../resources/k8s-tutorials/ha-with-external-db/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-with-external-db/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-with-external-db/_index.md index d0318164552..39a84969586 100644 --- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-with-external-db/_index.md +++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-with-external-db/_index.md @@ -17,7 +17,7 @@ For systems without direct internet access, refer to the air gap installation in # Prerequisites -These instructions assume you have set up two nodes, a load balancer, a DNS record, and an external MySQL database as described in [this section.](../infra-for-ha-with-external-db) +These instructions assume you have set up two nodes, a load balancer, a DNS record, and an external MySQL database as described in [this section.]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db/) # Installing Kubernetes From 133e9b2a483034d7a77ed366971ff7bb0fffe01e Mon Sep 17 00:00:00 2001 From: Ansil H Date: Tue, 20 Oct 2020 11:19:25 +0530 Subject: [PATCH 18/27] updated hyperlinks --- .../k8s-tutorials/infrastructure-tutorials/_index.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md index c24bffb45ad..bab44738755 100644 --- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md +++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md @@ -6,10 +6,8 @@ weight: 5 The K3s documentation has: -- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{}}/k3s/latest/en/installation/tutorials/ha-with-external-db) -- Instructions for [setting up a high-availability K3s Kubernetes cluster with an external DB for a Rancher server]({{}}/k3s/latest/en/installation/tutorials/ha-with-external-db) +- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{}}/k3s/latest/en/installation/ha/) The RKE documentation has: -- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{}}/) -- Instructions for [setting up a high-availability RKE cluster]() \ No newline at end of file +- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/) From 7fe77713a944a0b395f5935078418ea2e0c7a5c0 Mon Sep 17 00:00:00 2001 From: Sebastian Karasek Date: Tue, 20 Oct 2020 09:45:56 +0200 Subject: [PATCH 19/27] Update link to monitoring v2.5 --- .../v2.x/en/monitoring-alerting/v2.5/migrating/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md index f28ba241414..09f97c13715 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md @@ -25,10 +25,10 @@ Unlike in Monitoring & Alerting V1, both features are packaged in a single Helm Monitoring V2 can only be configured on the cluster level. Project-level monitoring and alerting is no longer supported. -For more information on how to configure Monitoring & Alerting V2, see the [docs for monitoring in Rancher v2.5](/rancher/v2.x/en/monitoring-alerting). +For more information on how to configure Monitoring & Alerting V2, see the [docs for monitoring in Rancher v2.5](../). ### Changes to Role-based Access Control Project owners and members no longer get access to Grafana or Prometheus by default. If view-only users had access to Grafana, they would be able to see data from any namespace. For Kiali, any user can edit things they don’t own in any namespace. -For more information about role-based access control in `rancher-monitoring`, refer to [this page.](../rbac) \ No newline at end of file +For more information about role-based access control in `rancher-monitoring`, refer to [this page.](../rbac) From bfc4982537ecbce2f1f93d7cf66c8ccdbff274da Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 20 Oct 2020 09:36:27 -0700 Subject: [PATCH 20/27] Change links --- .../k8s-tutorials/infrastructure-tutorials/_index.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md index bab44738755..b9406d8405b 100644 --- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md +++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md @@ -4,10 +4,7 @@ shortTitle: Infrastructure Tutorials weight: 5 --- -The K3s documentation has: +To set up infrastructure for a high-availability K3s Kubernetes cluster with an external DB, refer to [this page.]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha-with-external-db/) -- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{}}/k3s/latest/en/installation/ha/) -The RKE documentation has: - -- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/) +To set up infrastructure for a high-availability RKE Kubernetes cluster, refer to [this page.]({{}}/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/infra-for-ha/) From 1a8bdd599ad46bcdf91f533f2c61b90084313f3e Mon Sep 17 00:00:00 2001 From: catherineluse Date: Tue, 20 Oct 2020 09:54:50 -0700 Subject: [PATCH 21/27] Fix links --- .../rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md | 2 +- content/rancher/v2.x/en/cluster-admin/tools/_index.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md index b513b3947c2..0b1f5b26cfe 100644 --- a/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md +++ b/content/rancher/v2.x/en/backups/v2.5/back-up-rancher/_index.md @@ -5,7 +5,7 @@ aliases: - /rancher/v2.x/en/backups/back-up-rancher --- -In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups](../legacy/backup/single-node-backups/) +In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups]({{}}/rancher/v2.x/en/backups/v2.5/docker-installs/docker-backups) ### Prerequisites diff --git a/content/rancher/v2.x/en/cluster-admin/tools/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/_index.md index 9d65c984350..ed36ea5ae7e 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/_index.md @@ -68,6 +68,6 @@ Rancher's integration with Istio was improved in Rancher v2.5. Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark. -If you are using Rancher v2.5, refer to the CIS scan documentation [here.](./v2.5) +If you are using Rancher v2.5, refer to the CIS scan documentation [here.]({{}}/rancher/v2.x/en/cis-scans/v2.5) -If you are using Rancher v2.4, refer to the CIS scan documentation [here.](./v2.4) \ No newline at end of file +If you are using Rancher v2.4, refer to the CIS scan documentation [here.]({{}}/rancher/v2.x/en/cis-scans/v2.4) \ No newline at end of file From 43bddfbe6e4efe56e778793c7436475925a74d20 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Tue, 20 Oct 2020 13:40:16 -0700 Subject: [PATCH 22/27] Change Rancher v2.5 monitoring configuration link --- .../v2.x/en/monitoring-alerting/v2.5/migrating/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md index 09f97c13715..28b629bb432 100644 --- a/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md +++ b/content/rancher/v2.x/en/monitoring-alerting/v2.5/migrating/_index.md @@ -25,7 +25,7 @@ Unlike in Monitoring & Alerting V1, both features are packaged in a single Helm Monitoring V2 can only be configured on the cluster level. Project-level monitoring and alerting is no longer supported. -For more information on how to configure Monitoring & Alerting V2, see the [docs for monitoring in Rancher v2.5](../). +For more information on how to configure Monitoring & Alerting V2, see [this page.]({{}}/rancher/v2.x/en/monitoring-alerting/v2.5/configuration) ### Changes to Role-based Access Control From 2aa6fae041fd513546ad2f85d54d1a9782d29b6a Mon Sep 17 00:00:00 2001 From: catherineluse Date: Tue, 20 Oct 2020 13:29:31 -0700 Subject: [PATCH 23/27] Restore cluster.yml examples --- .../3-node-certificate-recognizedca/_index.md | 164 ++++++++++++++++ .../3-node-certificate/_index.md | 179 ++++++++++++++++++ .../3-node-externalssl-certificate/_index.md | 4 +- .../3-node-externalssl-recognizedca/_index.md | 4 +- 4 files changed, 347 insertions(+), 4 deletions(-) create mode 100644 content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate-recognizedca/_index.md create mode 100644 content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate/_index.md diff --git a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate-recognizedca/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate-recognizedca/_index.md new file mode 100644 index 00000000000..4a233f537a9 --- /dev/null +++ b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate-recognizedca/_index.md @@ -0,0 +1,164 @@ +--- +title: Template for an RKE Cluster with a Certificate Signed by Recognized CA and a Layer 4 Load Balancer +weight: 3 +aliases: + - /rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca +--- + +RKE uses a cluster.yml file to install and configure your Kubernetes cluster. + +This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. + +The following template can be used for the cluster.yml if you have a setup with: + +- Certificate signed by a recognized CA +- Layer 4 load balancer +- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) + +> For more options, refer to [RKE Documentation: Config Options]({{}}/rke/latest/en/config-options/). + +```yaml +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + +services: + etcd: + snapshot: true + creation: 6h + retention: 24h + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If self-signed, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If self-signed, must be signed by same CA as cattle server + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + # Rancher install via RKE addons is only supported up to v2.0.8 + - image: rancher/rancher:v2.0.8 + args: + - --no-cacerts + imagePullPolicy: Always + name: cattle-server + # env: + # - name: HTTP_PROXY + # value: "http://your_proxy_address:port" + # - name: HTTPS_PROXY + # value: "http://your_proxy_address:port" + # - name: NO_PROXY + # value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access" + livenessProbe: + httpGet: + path: /ping + port: 80 + initialDelaySeconds: 60 + periodSeconds: 60 + readinessProbe: + httpGet: + path: /ping + port: 80 + initialDelaySeconds: 20 + periodSeconds: 10 + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP +``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate/_index.md new file mode 100644 index 00000000000..ec05b5bc479 --- /dev/null +++ b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-certificate/_index.md @@ -0,0 +1,179 @@ +--- +title: Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer +weight: 2 +aliases: + - /rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate +--- +RKE uses a cluster.yml file to install and configure your Kubernetes cluster. + +This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. + +The following template can be used for the cluster.yml if you have a setup with: + +- Self-signed SSL +- Layer 4 load balancer +- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) + +> For more options, refer to [RKE Documentation: Config Options]({{}}/rke/latest/en/config-options/). + +```yaml +nodes: + - address: # hostname or IP to access nodes + user: # root user (usually 'root') + role: [controlplane,etcd,worker] # K8s roles for node + ssh_key_path: # path to PEM file + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + - address: + user: + role: [controlplane,etcd,worker] + ssh_key_path: + +services: + etcd: + snapshot: true + creation: 6h + retention: 24h + +addons: |- + --- + kind: Namespace + apiVersion: v1 + metadata: + name: cattle-system + --- + kind: ServiceAccount + apiVersion: v1 + metadata: + name: cattle-admin + namespace: cattle-system + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: cattle-crb + namespace: cattle-system + subjects: + - kind: ServiceAccount + name: cattle-admin + namespace: cattle-system + roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-ingress + namespace: cattle-system + type: Opaque + data: + tls.crt: # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server + tls.key: # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server + --- + apiVersion: v1 + kind: Secret + metadata: + name: cattle-keys-server + namespace: cattle-system + type: Opaque + data: + cacerts.pem: # CA cert used to sign cattle server cert and key + --- + apiVersion: v1 + kind: Service + metadata: + namespace: cattle-system + name: cattle-service + labels: + app: cattle + spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + - port: 443 + targetPort: 443 + protocol: TCP + name: https + selector: + app: cattle + --- + apiVersion: extensions/v1beta1 + kind: Ingress + metadata: + namespace: cattle-system + name: cattle-ingress-http + annotations: + nginx.ingress.kubernetes.io/proxy-connect-timeout: "30" + nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # Max time in seconds for ws to remain shell window open + nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" # Max time in seconds for ws to remain shell window open + spec: + rules: + - host: # FQDN to access cattle server + http: + paths: + - backend: + serviceName: cattle-service + servicePort: 80 + tls: + - secretName: cattle-keys-ingress + hosts: + - # FQDN to access cattle server + --- + kind: Deployment + apiVersion: extensions/v1beta1 + metadata: + namespace: cattle-system + name: cattle + spec: + replicas: 1 + template: + metadata: + labels: + app: cattle + spec: + serviceAccountName: cattle-admin + containers: + # Rancher install via RKE addons is only supported up to v2.0.8 + - image: rancher/rancher:v2.0.8 + imagePullPolicy: Always + name: cattle-server + # env: + # - name: HTTP_PROXY + # value: "http://your_proxy_address:port" + # - name: HTTPS_PROXY + # value: "http://your_proxy_address:port" + # - name: NO_PROXY + # value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access" + livenessProbe: + httpGet: + path: /ping + port: 80 + initialDelaySeconds: 60 + periodSeconds: 60 + readinessProbe: + httpGet: + path: /ping + port: 80 + initialDelaySeconds: 20 + periodSeconds: 10 + ports: + - containerPort: 80 + protocol: TCP + - containerPort: 443 + protocol: TCP + volumeMounts: + - mountPath: /etc/rancher/ssl + name: cattle-keys-volume + readOnly: true + volumes: + - name: cattle-keys-volume + secret: + defaultMode: 420 + secretName: cattle-keys-server +``` \ No newline at end of file diff --git a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-certificate/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-certificate/_index.md index 3f840174b9e..593a42473c7 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-certificate/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-certificate/_index.md @@ -1,13 +1,13 @@ --- title: Template for an RKE Cluster with a Self-signed Certificate and SSL Termination on Layer 7 Load Balancer weight: 3 -aliases: +aliases: - /rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate --- RKE uses a cluster.yml file to install and configure your Kubernetes cluster. -This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{}}/rancher/v2.x/en/installation/install-rancher-on-k8s/#installation-outline). +This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. The following template can be used for the cluster.yml if you have a setup with: diff --git a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md index 316456d9e84..917a39af68c 100644 --- a/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md +++ b/content/rancher/v2.x/en/installation/resources/advanced/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md @@ -1,13 +1,13 @@ --- title: Template for an RKE Cluster with a Recognized CA Certificate and SSL Termination on Layer 7 Load Balancer weight: 4 -aliases: +aliases: - /rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca --- RKE uses a cluster.yml file to install and configure your Kubernetes cluster. -This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{}}/rancher/v2.x/en/installation/install-rancher-on-k8s/#installation-outline). +This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. The following template can be used for the cluster.yml if you have a setup with: From 490230b0b89827686e04409363c669b3bfff01d5 Mon Sep 17 00:00:00 2001 From: catherineluse Date: Wed, 14 Oct 2020 13:18:55 -0700 Subject: [PATCH 24/27] Update docs on snapshot behavior --- .../cluster-admin/backing-up-etcd/_index.md | 79 ++++++++++++++++++- .../rke/latest/en/etcd-snapshots/_index.md | 24 ++++++ 2 files changed, 102 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md b/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md index 369f5a34d61..438b976bc8b 100644 --- a/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md @@ -29,6 +29,9 @@ This section covers the following topics: {{% tabs %}} {{% tab "Rancher v2.4.0+" %}} + +### Snapshot Components + When Rancher creates a snapshot, it includes three components: - The cluster data in etcd @@ -37,13 +40,50 @@ When Rancher creates a snapshot, it includes three components: Because the Kubernetes version is now included in the snapshot, it is possible to restore a cluster to a prior Kubernetes version. -The multiple components of the snapshot allow you to select from the following options if you need to a cluster from a snapshot: +The multiple components of the snapshot allow you to select from the following options if you need to restore a cluster from a snapshot: - **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0. - **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes. - **Restore etcd, Kubernetes versions and cluster configuration:** This option should be used if you changed both the Kubernetes version and cluster configuration when upgrading. It's always recommended to take a new snapshot before any upgrades. + +### Generating the Snapshot from etcd Nodes + +For each etcd node in the cluster, the etcd cluster health is checked. If the node reports that the etcd cluster is healthy, a snapshot is created from it and optionally uploaded to S3. + +The snapshot is stored in `/opt/rke/etcd-snapshots`. If the directory is configured on the nodes as a shared mount, it will be overwritten. On S3, the snapshot will always be from the last node that uploads it, as all etcd nodes upload it and the last will remain. + +In the case when multiple etcd nodes exist, any created snapshot is created after the cluster has been health checked, so it can be considered a valid snapshot of the data in the etcd cluster. + +### Snapshot Naming Conventions + +The name of the snapshot is auto-generated. The `--name` option can be used to override the name of the snapshot when creating one-time snapshots with the RKE CLI. + +When Rancher creates a snapshot of an RKE cluster, the snapshot name is based on the type (whether the snapshot is manual or recurring) and the target (whether the snapshot is saved locally or uploaded to S3). The naming convention is as follows: + +- `m` stands for manual +- `r` stands for recurring +- `l` stands for local +- `s` stands for S3 + +Some example snapshot names are: + +- c-9dmxz-rl-8b2cx +- c-9dmxz-ml-kr56m +- c-9dmxz-ms-t6bjb +- c-9dmxz-rs-8gxc8 + +### How Restoring from a Snapshot Works + +On restore, the following process is used: + +1. The snapshot is retrieved from S3, if S3 is configured. +2. The snapshot is unzipped (if zipped). +3. One of the etcd nodes in the cluster serves that snapshot file to the other nodes. +4. The other etcd nodes download the snapshot and validate the checksum so that they all use the same snapshot for the restore. +5. The cluster is restored and post-restore actions will be done in the cluster. + {{% /tab %}} {{% tab "Rancher prior to v2.4.0" %}} When Rancher creates a snapshot, only the etcd data is included in the snapshot. @@ -51,6 +91,43 @@ When Rancher creates a snapshot, only the etcd data is included in the snapshot. Because the Kubernetes version is not included in the snapshot, there is no option to restore a cluster to a different Kubernetes version. It's always recommended to take a new snapshot before any upgrades. + +### Generating the Snapshot from etcd Nodes + +For each etcd node in the cluster, the etcd cluster health is checked. If the node reports that the etcd cluster is healthy, a snapshot is created from it and optionally uploaded to S3. + +The snapshot is stored in `/opt/rke/etcd-snapshots`. If the directory is configured on the nodes as a shared mount, it will be overwritten. On S3, the snapshot will always be from the last node that uploads it, as all etcd nodes upload it and the last will remain. + +In the case when multiple etcd nodes exist, any created snapshot is created after the cluster has been health checked, so it can be considered a valid snapshot of the data in the etcd cluster. + +### Snapshot Naming Conventions + +The name of the snapshot is auto-generated. The `--name` option can be used to override the name of the snapshot when creating one-time snapshots with the RKE CLI. + +When Rancher creates a snapshot of an RKE cluster, the snapshot name is based on the type (whether the snapshot is manual or recurring) and the target (whether the snapshot is saved locally or uploaded to S3). The naming convention is as follows: + +- `m` stands for manual +- `r` stands for recurring +- `l` stands for local +- `s` stands for S3 + +Some example snapshot names are: + +- c-9dmxz-rl-8b2cx +- c-9dmxz-ml-kr56m +- c-9dmxz-ms-t6bjb +- c-9dmxz-rs-8gxc8 + +### How Restoring from a Snapshot Works + +On restore, the following process is used: + +1. The snapshot is retrieved from S3, if S3 is configured. +2. The snapshot is unzipped (if zipped). +3. One of the etcd nodes in the cluster serves that snapshot file to the other nodes. +4. The other etcd nodes download the snapshot and validate the checksum so that they all use the same snapshot for the restore. +5. The cluster is restored and post-restore actions will be done in the cluster. + {{% /tab %}} {{% /tabs %}} diff --git a/content/rke/latest/en/etcd-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/_index.md index 735fb8bab96..b7b4aca5ce6 100644 --- a/content/rke/latest/en/etcd-snapshots/_index.md +++ b/content/rke/latest/en/etcd-snapshots/_index.md @@ -27,6 +27,30 @@ You can use RKE to [restore your cluster from backup]({{}}/rke/latest/e These [example scenarios]({{}}/rke/latest/en/etcd-snapshots/example-scenarios) for backup and restore are different based on your version of RKE. +# How Snapshots Work + +For each etcd node in the cluster, the etcd cluster health is checked. If the node reports that the etcd cluster is healthy, a snapshot is created from it and optionally uploaded to S3. + +The snapshot is stored in `/opt/rke/etcd-snapshots`. If the directory is configured on the nodes as a shared mount, it will be overwritten. On S3, the snapshot will always be from the last node that uploads it, as all etcd nodes upload it and the last will remain. + +In the case when multiple etcd nodes exist, any created snapshot is created after the cluster has been health checked, so it can be considered a valid snapshot of the data in the etcd cluster. + +### Snapshot Naming + +The name of the snapshot is auto-generated. The `--name` option can be used to override the name of the snapshot when creating one-time snapshots with the RKE CLI. + +An example one-time snapshot name is `rke_etcd_snapshot_2020-10-15T16:47:24+02:00`. An example recurring snapshot name is `2020-10-15T14:53:26Z_etcd`. + +### How Restoring from a Snapshot Works + +On restore, the following process is used: + +1. The snapshot is retrieved from S3, if S3 is configured. +2. The snapshot is unzipped (if zipped). +3. One of the etcd nodes in the cluster serves that snapshot file to the other nodes. +4. The other etcd nodes download the snapshot and validate the checksum so that they all use the same snapshot for the restore. +5. The cluster is restored and post-restore actions will be done in the cluster. + ## Troubleshooting If you have trouble restoring your cluster, you can refer to the [troubleshooting]({{}}/rke/latest/en/etcd-snapshots/troubleshooting) page. From 32d937707cf5502439031f230176a006e7fdb4b1 Mon Sep 17 00:00:00 2001 From: David Noland Date: Wed, 21 Oct 2020 10:10:50 -0700 Subject: [PATCH 25/27] Fixed commands to set logging Fixed commands to work if audit logging is enabled, which deploys a second container in the rancher pod. Also optimized the kubectl command so the greps and awks are not needed. --- content/rancher/v2.x/en/troubleshooting/logging/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.x/en/troubleshooting/logging/_index.md b/content/rancher/v2.x/en/troubleshooting/logging/_index.md index 50024334901..0c038f81ec4 100644 --- a/content/rancher/v2.x/en/troubleshooting/logging/_index.md +++ b/content/rancher/v2.x/en/troubleshooting/logging/_index.md @@ -17,17 +17,17 @@ The following log levels are used in Rancher: * Configure debug log level ``` $ KUBECONFIG=./kube_config_rancher-cluster.yml -$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set debug; done +$ kubectl -n cattle-system get pods -l app=rancher --no-headers -o custom-columns=name:.metadata.name | while read rancherpod; do kubectl -n cattle-system exec $rancherpod -c rancher -- loglevel --set debug; done OK OK OK -$ kubectl --kubeconfig $KUBECONFIG -n cattle-system logs -l app=rancher +$ kubectl -n cattle-system logs -l app=rancher -c rancher ``` * Configure info log level ``` $ KUBECONFIG=./kube_config_rancher-cluster.yml -$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set info; done +$ kubectl -n cattle-system get pods -l app=rancher --no-headers -o custom-columns=name:.metadata.name | while read rancherpod; do kubectl -n cattle-system exec $rancherpod -c rancher -- loglevel --set info; done OK OK OK From f50ed0721a9db33f6031b3675ad37e309619b993 Mon Sep 17 00:00:00 2001 From: Ansil H Date: Thu, 22 Oct 2020 00:40:38 +0530 Subject: [PATCH 26/27] fix ros system services link fix ros system services link --- content/os/v1.x/en/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/os/v1.x/en/_index.md b/content/os/v1.x/en/_index.md index a4d46db0150..d42a627a00c 100644 --- a/content/os/v1.x/en/_index.md +++ b/content/os/v1.x/en/_index.md @@ -29,7 +29,7 @@ You can adjust memory requirements by custom building RancherOS, please refer to ### How RancherOS Works -Everything in RancherOS is a Docker container. We accomplish this by launching two instances of Docker. One is what we call **System Docker** and is the first process on the system. All other system services, like `ntpd`, `syslog`, and `console`, are running in Docker containers. System Docker replaces traditional init systems like `systemd` and is used to launch [additional system services](installation/system-services/). +Everything in RancherOS is a Docker container. We accomplish this by launching two instances of Docker. One is what we call **System Docker** and is the first process on the system. All other system services, like `ntpd`, `syslog`, and `console`, are running in Docker containers. System Docker replaces traditional init systems like `systemd` and is used to launch [additional system services]({{}}/os/v1.x/en/system-services/). System Docker runs a special container called **Docker**, which is another Docker daemon responsible for managing all of the user’s containers. Any containers that you launch as a user from the console will run inside this Docker. This creates isolation from the System Docker containers and ensures that normal user commands don’t impact system services. From 2b1129f19f1f31f6e361de61231ab6ab6d0b34ab Mon Sep 17 00:00:00 2001 From: catherineluse Date: Thu, 22 Oct 2020 17:38:20 -0700 Subject: [PATCH 27/27] Update steps to enable and uninstall logging --- .../rancher/v2.x/en/logging/v2.5/_index.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/logging/v2.5/_index.md b/content/rancher/v2.x/en/logging/v2.5/_index.md index 826efb55e25..329b5fce0c3 100644 --- a/content/rancher/v2.x/en/logging/v2.5/_index.md +++ b/content/rancher/v2.x/en/logging/v2.5/_index.md @@ -7,6 +7,7 @@ weight: 1 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5) - [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster) - [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters) +- [Uninstall Logging](#uninstall-logging) - [Configuring the Logging Application](#configuring-the-logging-application) - [Working with Taints and Tolerations](#working-with-taints-and-tolerations) @@ -37,7 +38,24 @@ If you install Rancher using the Rancher CLI on an Linux OS, the Rancher Helm c ### Enabling Logging for Rancher Managed Clusters -If you have Enterprise Cluster Manager enabled, you can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. +You can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app. + +1. In the Rancher UI, go to the cluster where you want to install logging and click **Cluster Explorer.** +1. Click **Apps.** +1. Click the `rancher-logging` app. +1. Scroll to the bottom of the Helm chart README and click **Install.** + +**Result:** The logging app is deployed in the `cattle-logging-system` namespace. + +### Uninstall Logging + +1. From the **Cluster Explorer,** click **Apps & Marketplace.** +1. Click **Installed Apps.** +1. Go to the `cattle-logging-system` namespace and check the boxes for `rancher-logging` and `rancher-logging-crd`. +1. Click **Delete.** +1. Confirm **Delete.** + +**Result** `rancher-logging` is uninstalled. ### Configuring the Logging Application