From a79533257dfd0ecad2ef168ab2311e3225b153e3 Mon Sep 17 00:00:00 2001 From: dnoland1 Date: Thu, 11 Apr 2019 22:37:53 -0700 Subject: [PATCH 01/43] Update _index.md --- content/rancher/v2.x/en/project-admin/namespaces/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/project-admin/namespaces/_index.md b/content/rancher/v2.x/en/project-admin/namespaces/_index.md index ba3b9cf7dc2..e56bfd6bc1c 100644 --- a/content/rancher/v2.x/en/project-admin/namespaces/_index.md +++ b/content/rancher/v2.x/en/project-admin/namespaces/_index.md @@ -5,7 +5,7 @@ weight: 2520 Within Rancher, you can further divide projects into different [namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/), which are virtual clusters within a project backed by a physical cluster. Should you require another level of organization beyond projects and the `default` namespace, you can use multiple namespaces to isolate applications and resources. -Although you assign resources at the project level so that each namespace can in the project can use them, you can override this inheritance by assigning resources explicitly to a namespace. +Although you assign resources at the project level so that each namespace in the project can use them, you can override this inheritance by assigning resources explicitly to a namespace. Resources that you can assign directly to namespaces include: From 8cb7a1ffdc6d8893bc200cc9614b939322e71348 Mon Sep 17 00:00:00 2001 From: Stefan Lasiewski Date: Fri, 12 Apr 2019 11:55:29 -0700 Subject: [PATCH 02/43] 'Use Catalog Templates', not 'User Catalog Templates' Pretty sure this is a typo. There's a big difference between 'Use Catalog Templates' and 'User Catalog Templates', so it would be good for someone to validate this. --- .../v2.x/en/admin-settings/rbac/global-permissions/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md index 1263a405b79..51da015a34e 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md @@ -49,7 +49,7 @@ The following table lists each custom global permission available and whether it | Manage Roles | ✓ | | | Manage Users | ✓ | | | Create Clusters | ✓ | ✓ | -| User Catalog Templates | ✓ | ✓ | +| Use Catalog Templates | ✓ | ✓ | | Login Access | ✓ | ✓ | > **Notes:** From 19d479e8b06bb2193f733420b72262a2a424d16e Mon Sep 17 00:00:00 2001 From: dnoland1 Date: Fri, 12 Apr 2019 14:31:28 -0700 Subject: [PATCH 03/43] kubectl to get context, instead of instructing user to look at config --- .../rancher/v2.x/en/cluster-admin/kubeconfig/_index.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md b/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md index 17b63934f43..95c6b71078b 100644 --- a/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md @@ -30,7 +30,13 @@ For [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provis > **Note:** By default, all Rancher Launched Kubernetes clusters have [Authorized Cluster Endpoint]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#authorized-cluster-endpoint) enabled. -To find the name of the context(s), view the kubeconfig file. +To find the name of the context(s), run: +``` +kubectl config get-contexts --kubeconfig /custom/path/kube.config +CURRENT NAME CLUSTER AUTHINFO NAMESPACE +* my-cluster my-cluster user-46tmn + my-cluster-controlplane-1 my-cluster-controlplane-1 user-46tmn +``` ### Clusters with FQDN defined as an Authorized Cluster Endpoint From e6961e78877e9c6f091cfae7452241480b8d1db0 Mon Sep 17 00:00:00 2001 From: Denise Date: Fri, 12 Apr 2019 14:36:03 -0700 Subject: [PATCH 04/43] Update _index.md --- content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md b/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md index 95c6b71078b..32843651a65 100644 --- a/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/kubeconfig/_index.md @@ -31,6 +31,7 @@ For [Rancher Launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provis > **Note:** By default, all Rancher Launched Kubernetes clusters have [Authorized Cluster Endpoint]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#authorized-cluster-endpoint) enabled. To find the name of the context(s), run: + ``` kubectl config get-contexts --kubeconfig /custom/path/kube.config CURRENT NAME CLUSTER AUTHINFO NAMESPACE From d9cec7cb0a3e20a12bf860fcea72c84e121fb87b Mon Sep 17 00:00:00 2001 From: Hieu Pham <35533395+phamhi@users.noreply.github.com> Date: Sat, 13 Apr 2019 10:58:01 -0400 Subject: [PATCH 05/43] Update _index.md Grammatical fix and added clarification --- .../config-rancher-for-private-reg/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/_index.md index ef20c1718c9..9dc14874cd3 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/_index.md @@ -7,7 +7,7 @@ aliases: Rancher needs to be configured to use the private registry in order to provision any [Rancher launched Kubernetes clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) or [Rancher tools]({{< baseurl >}}/rancher/v2.x/en/tools/). ->**Note:** If you want to configure Rancher for your private registry when when starting the rancher/rancher container, you can use the environment variable `CATTLE_SYSTEM_DEFAULT_REGISTRY`. +>**Note:** If you want to configure Rancher to use your private registry when starting the rancher/rancher container, you can use the environment variable `CATTLE_SYSTEM_DEFAULT_REGISTRY`. 1. Log into Rancher and configure the default admin password. From fcbb585eff0aa899482eec613fce98186ebce68d Mon Sep 17 00:00:00 2001 From: Fyery Date: Tue, 16 Apr 2019 11:58:56 +0800 Subject: [PATCH 06/43] add windows powershell script --- README.md | 12 +++++++ scripts/dev-windows.ps1 | 74 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100755 scripts/dev-windows.ps1 diff --git a/README.md b/README.md index 002b29e77a0..5756258b737 100644 --- a/README.md +++ b/README.md @@ -5,16 +5,28 @@ Rancher Docs The `rancher/docs:dev` docker image runs a live-updating server. To run on your workstation, run: +Linux ```bash ./scripts/dev ``` +Windows +```powershell +./scripts/dev-windows.ps1 +``` + and then navigate to http://localhost:9001/. You can customize the port by passing it as an argument: +Linux ```bash ./scripts/dev 8080 ``` +Windows +```powershell +./scripts/dev-windows.ps1 -port 8080 +``` + License ======= Copyright (c) 2014-2019 [Rancher Labs, Inc.](http://rancher.com) diff --git a/scripts/dev-windows.ps1 b/scripts/dev-windows.ps1 new file mode 100755 index 00000000000..72350371c7e --- /dev/null +++ b/scripts/dev-windows.ps1 @@ -0,0 +1,74 @@ +#Requires -Version 5.0 + +param ( + [parameter(Mandatory = $false,HelpMessage="Build the build & dev images instead of pulling from the registry")] [switch]$buildBuild, + [parameter(Mandatory = $false,HelpMessage="Build the dev image instead of pulling from the registry")] [switch]$buildDev, + [parameter(Mandatory = $false,HelpMessage="Port to listen on")] [string]$port, + [parameter(Mandatory = $false,HelpMessage="Skip pulling build/dev images")] [switch]$skipPull, + [parameter(Mandatory = $false,HelpMessage="Use DIR to for the theme, to devlop the theme at the same time")] [string]$theme, + [parameter(Mandatory = $false,HelpMessage="Upload/push the build image after building")] [switch]$upload +) + +$DefaultPort = 9001 +$ListenPort = $DefaultPort +$Image = "rancher/docs" +$Tag = "dev" +$twitterConsumer = $env:TWITTER_CONSUMER +$twitterSecret = $env:TWITTER_SECRET + +$dirPath = Split-Path -Parent $MyInvocation.MyCommand.Definition +$baseDirPath = Get-Location +if ($dirPath -eq $baseDirPath) { + $baseDirPath = (Resolve-Path "$dirPath\..").Path +} +pushd $baseDirPath + +if ($port) { + $ListenPort = $port +} + +$ThemeVolume = "" +if ($theme) { + Write-Host "Using theme from $theme" + $ThemeVolume = "-v ${baseDirPath}/${theme}:/run/node_modules/rancher-website-theme" +} + +if ($buildBuild) { + Write-Host "Building ${Image}:build" + docker build --no-cache -f Dockerfile.build --build-arg TWITTER_CONSUMER=$twitterConsumer --build-arg TWITTER_SECRET=$twitterSecret -t ${Image}:build . + if ($upload) { + docker push ${Image}:build + } + $buildDev = $true +} elseif ($skipPull) { + Write-Host "Skipping pull of ${Image}:build" +} else { + Write-Host "Pulling ${Image}:build" + docker pull ${Image}:build +} + +if ($buildDev) { + $Tag = "local" + Write-Host "Building ${Image}:${Tag}" + docker build -f Dockerfile.dev -t ${Image}:${Tag} . +} elseif ($skipPull) { + Write-Host "Skipping pull of ${Image}:${Tag}" +} else { + Write-Host "Pulling ${Image}:${Tag}" + docker pull ${Image}:${Tag} +} + +Write-Host "Starting server on http://localhost:${ListenPORT}" +docker run --rm -p ${ListenPort}:${ListenPort} -it ` + -v ${baseDirPath}/archetypes:/run/archetypes ` + -v ${baseDirPath}/assets:/run/assets ` + -v ${baseDirPath}/content:/run/content ` + -v ${baseDirPath}/data:/run/data ` + -v ${baseDirPath}/layouts:/run/layouts ` + -v ${baseDirPath}/scripts:/run/scripts ` + -v ${baseDirPath}/static:/run/static ` + -v ${baseDirPath}/.git:/run/.git ` + -v ${baseDirPath}/config.toml:/run/config.toml ` + ${ThemeVolume} ${Image}:${Tag} --port=${ListenPort} + +popd From 3821004b7678654e33ff62d695de22583ee451d9 Mon Sep 17 00:00:00 2001 From: Tobias Theobald Date: Fri, 12 Apr 2019 13:45:41 -0700 Subject: [PATCH 07/43] Improve PassRole IAM example Make it more obvious that role name in PassRole IAM example needs the role name replaced by capitalizing the spot --- .../cluster-provisioning/rke-clusters/node-pools/ec2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 10adf21a7ea..5722a01b0a6 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -140,7 +140,7 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2. "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*", "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*", "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*", - "arn:aws:iam::AWS_ACCOUNT_ID:role/your-role-name" + "arn:aws:iam::AWS_ACCOUNT_ID:role/YOUR_ROLE_NAME" ] }, { From d851ea2472dffb2c63059c925b3b882e47e2b8e1 Mon Sep 17 00:00:00 2001 From: Bill Maxwell Date: Tue, 16 Apr 2019 12:18:13 -0700 Subject: [PATCH 08/43] Add additional resource request for cluster level monitoring. Call out the additional resources required for Cluster level Prometheus monitoring. --- .../cluster-admin/tools/monitoring/_index.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md index 957bd5a7a23..cfb1aba7009 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md @@ -39,7 +39,7 @@ As an [administrator]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/global ### Resource Consumption -When enabling cluster monitoring, you need to ensure your worker nodes and Prometheus pod have enough resources. The tables below provides a guide of how much resource consumption will be used. +When enabling cluster monitoring, you need to ensure your worker nodes and Prometheus pod have enough resources. The tables below provides a guide of how much resource consumption will be used. In larger deployments, it is strongly advised that the monitoring infrastructure be placed on dedicated nodes in the cluster. #### Prometheus Pod Resource Consumption @@ -51,6 +51,24 @@ Number of Cluster Nodes | CPU (milli CPU) | Memory | Disk 50| 2000 | 2 GB | ~5 GB/Day 256| 4000 | 6 GB | ~18 GB/Day +Additional pod resource requirements for cluster level monitoring. + +Workload | Container | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable +---------|-----------|---------------|---------------|-------------|-------------|------------- +Prometheus|Prometheus| 750m | 750Mi| 1000m | 1000Mi| Y + ||Prometheus-proxy| 50m | 50Mi | 100m | 100Mi| Y + ||Prometheus-auth| 100m | 100Mi | 500m | 200Mi | Y + ||Prometheus-config-reloader| - | - | 50m | 50Mi | N + ||rules-configmap-reloader | - | - | 100m | 25Mi | N +Grafana | grafana-init-plugin-json-copy | 50m |50Mi|50m|50Mi|Y + ||grafana-init-plugin-json-modify|50m|50Mi|50m|50Mi|Y + ||grafana |100m|100Mi|200m|200Mi|Y + ||grafana-proxy|50m|50Mi|100m|100Mi|Y +Kube-State Exporter|kube-state |100m|130Mi|100m|200Mi|Y +Node Exporter | exporter-node | 200m | 200Mi | 200m | 200Mi|Y +Operator | prometheus-operator | 100m | 50Mi | 200m | 100Mi | Y + + #### Other Pods Resource Consumption Besides the Prometheus pod, there are components that are deployed that require additional resources on the worker nodes. From 3b912941c4d33dc2bd0954df297aa6426f5f5996 Mon Sep 17 00:00:00 2001 From: William Jimenez Date: Tue, 16 Apr 2019 13:17:56 -0700 Subject: [PATCH 09/43] Update _index.md typo fix --- content/rancher/v2.x/en/installation/single-node/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index da42b4201b9..3cdfcb34490 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -88,7 +88,7 @@ docker run -d --restart=unless-stopped \ {{% /accordion %}} {{% accordion id="option-d" label="Option D-Let's Encrypt Certificate" %}} -For production environments, you also have the options of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. +For production environments, you also have the option of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. >**Prerequisites:** > From 85d7fadb69974056975a89dbd9fa0f8e49f8c168 Mon Sep 17 00:00:00 2001 From: Kevin Heidt Date: Wed, 17 Apr 2019 10:01:50 -0400 Subject: [PATCH 10/43] Changed "we advice" to "we advise" --- content/rancher/v2.x/en/installation/single-node/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index 3cdfcb34490..dabf756c793 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -186,7 +186,7 @@ If you are visiting this page to complete an air gap installation, you must pre- In the situation where you want to use a single node to run Rancher and to be able to add the same node to a cluster, you have to adjust the host ports mapped for the `rancher/rancher` container. -If a node is added to a cluster, it deploys the nginx ingress controller which will use port 80 and 443. This will conflict with the default ports we advice to expose for the `rancher/rancher` container. +If a node is added to a cluster, it deploys the nginx ingress controller which will use port 80 and 443. This will conflict with the default ports we advise to expose for the `rancher/rancher` container. Please note that this setup is not recommended for production use, but can be convenient for development/demo purposes. From f61511940a40bac8c526fa36cc9a957b5f18efcd Mon Sep 17 00:00:00 2001 From: William Jimenez Date: Thu, 18 Apr 2019 11:41:37 -0700 Subject: [PATCH 11/43] Update _index.md more consistent language --- content/rancher/v2.x/en/admin-settings/authentication/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/_index.md index 061d7734c4b..0dc19a78a1b 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/_index.md @@ -30,7 +30,7 @@ The Rancher authentication proxy integrates with the following external authenti
However, Rancher also provides [local authentication]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/local/). -In most cases, you should use an external authentication service over local authentication, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down. +In most cases, you should use an external authentication service over local authentication, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if your external authentication provider is unavailable or undergoing maintenance. ## Users and Groups From a7476729baa133c20792c194294fec3c75b16300 Mon Sep 17 00:00:00 2001 From: Murali Paluru Date: Fri, 19 Apr 2019 11:49:26 -0700 Subject: [PATCH 12/43] Fix typo --- .../config-rancher-system-charts/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/_index.md b/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/_index.md index f3743ba2f49..fd1ae176f70 100644 --- a/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/_index.md +++ b/content/rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/_index.md @@ -6,7 +6,7 @@ aliases: ## A. Prepare System Charts -The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as moniotring, logging, alerting and global DNS. To be able to use these features in an air gap install, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach and configure Rancher to use that repository. +The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. To be able to use these features in an air gap install, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach and configure Rancher to use that repository. ## B. Configure System Charts From 269d3e39ac5e649f2ba3889e884b81c56cdbf4b9 Mon Sep 17 00:00:00 2001 From: galal-hussein Date: Tue, 9 Apr 2019 00:13:13 +0200 Subject: [PATCH 13/43] Rotate Certificates docs for 2.1 and 2.0 --- .../certificate-rotation/_index.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md index e45f9fd710f..13744ef7835 100644 --- a/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md @@ -32,3 +32,28 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat 4. Click **Save**. **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. + +_Certificate Rotation for v2.1.14 and v2.0.9_ + +Certificate Rotation for all services was backported to **v2.1.14** and **v2.0.9**, the following services will be rotated: + +- etcd +- kubelet +- kube-apiserver +- kube-proxy +- kube-scheduler +- kube-controller-manager + +Certificates can be rotated through the API using the following steps: + +1. In the **Global** view, navigate to the cluster that you want to rotate certificates. + +2. Select the **Ellipsis (...) > View in API**. + +3. Click on **RotateCertificates**. + +4. Click on **Show Request**. + +5. Click on **Send Request**. + +**Results:** All kubernetes certificates will be rotated. From b9cff79792a8411d70972ea582baf1e4a4329cba Mon Sep 17 00:00:00 2001 From: Alena Prokharchyk Date: Tue, 23 Apr 2019 13:49:29 -0700 Subject: [PATCH 14/43] Update _index.md --- .../certificate-rotation/_index.md | 23 ++++++++----------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md index 13744ef7835..aa817ecd9f0 100644 --- a/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md @@ -3,12 +3,8 @@ title: Certificate Rotation weight: 2040 --- -_Available as of v2.2.0_ - By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters automatically generate certificates for the Kubernetes components. Rotating these certificates is important before the certificates expire as well as if a certificate is compromised. After the certificates are rotated, the Kubernetes components are automatically restarted. -> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. - Certificates can be rotated for the following services: - etcd @@ -18,6 +14,11 @@ Certificates can be rotated for the following services: - kube-scheduler - kube-controller-manager + +### Certificate Rotation in Rancher v2.2.x + +_Available as of v2.2.0_ + Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. 1. In the **Global** view, navigate to the cluster that you want to rotate certificates. @@ -33,18 +34,14 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. -_Certificate Rotation for v2.1.14 and v2.0.9_ +> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. -Certificate Rotation for all services was backported to **v2.1.14** and **v2.0.9**, the following services will be rotated: -- etcd -- kubelet -- kube-apiserver -- kube-proxy -- kube-scheduler -- kube-controller-manager +### Certificate Rotation in Rancher v2.1.x and v2.0.x -Certificates can be rotated through the API using the following steps: +_Available as of v2.1.14 and v2.0.9_ + +Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. 1. In the **Global** view, navigate to the cluster that you want to rotate certificates. From 0ef631e6735d13377c32eb1a5f3dcdb678dba499 Mon Sep 17 00:00:00 2001 From: William Jimenez Date: Tue, 23 Apr 2019 15:05:13 -0700 Subject: [PATCH 15/43] Update _index.md remove stray markup --- content/rke/latest/en/config-options/_index.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/rke/latest/en/config-options/_index.md b/content/rke/latest/en/config-options/_index.md index e47133db2c7..0df26d39165 100644 --- a/content/rke/latest/en/config-options/_index.md +++ b/content/rke/latest/en/config-options/_index.md @@ -122,5 +122,3 @@ $ echo $SSH_AUTH_SOCK ### Add-ons Job Timeout You can define [add-ons]({{< baseurl >}}/rke/latest/en/config-options/add-ons/) to be deployed after the Kubernetes cluster comes up, which uses Kubernetes [jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/). RKE will stop attempting to retrieve the job status after the timeout, which is in seconds. The default timeout value is `30` seconds. - -```yaml From 82f6ae987fe78aebc87c3d27dd481a731f61b670 Mon Sep 17 00:00:00 2001 From: William Jimenez Date: Thu, 25 Apr 2019 10:11:19 -0700 Subject: [PATCH 16/43] Update _index.md I think this is what the paragraph is trying to say? --- .../v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md index 08a4077a03e..c2821d5c62a 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md @@ -24,7 +24,7 @@ Load Balancers have a couple of limitations you should be aware of: - Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive. -- If you want to use a load balancer with a Hosted Kubernetes cluster (i.e., clusters hosted in GKE, EKS, or AKS), you must host your load balancer with the same cloud provider. Please review the compatibility tables regarding support for load balancers based on how you've provisioned your clusters: +- If you want to use a load balancer with a Hosted Kubernetes cluster (i.e., clusters hosted in GKE, EKS, or AKS), the load balancer must be running within that cloud provider's infrastructure. Please review the compatibility tables regarding support for load balancers based on how you've provisioned your clusters: - [Support for Layer-4 Load Balancing]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#support-for-layer-4-load-balancing) From edb79da50a203a683ad7dfe93083deaa1455743e Mon Sep 17 00:00:00 2001 From: dnoland1 Date: Thu, 25 Apr 2019 14:25:39 -0700 Subject: [PATCH 17/43] Update requirements to explicitedly state x86 --- .../v2.x/en/installation/requirements/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md index 0a79919978e..643401726de 100644 --- a/content/rancher/v2.x/en/installation/requirements/_index.md +++ b/content/rancher/v2.x/en/installation/requirements/_index.md @@ -11,16 +11,16 @@ Whether you're configuring Rancher to run in a single-node or high-availability
Rancher is tested on the following operating systems and their subsequent non-major releases with a supported version of [Docker](https://www.docker.com/). -* Ubuntu 16.04 (64-bit) +* Ubuntu 16.04 (64-bit x86) * Docker 17.03.x, 18.06.x, 18.09.x -* Ubuntu 18.04 (64-bit) +* Ubuntu 18.04 (64-bit x86) * Docker 18.06.x, 18.09.x -* Red Hat Enterprise Linux (RHEL)/CentOS 7.6 (64-bit) +* Red Hat Enterprise Linux (RHEL)/CentOS 7.6 (64-bit x86) * RHEL Docker 1.13 * Docker 17.03.x, 18.06.x, 18.09.x -* RancherOS 1.5.1 (64-bit) +* RancherOS 1.5.1 (64-bit x86) * Docker 17.03.x, 18.06.x, 18.09.x -* Windows Server version 1803 (64-bit) +* Windows Server version 1803 (64-bit x86) * Docker 17.06 * _Experimental, see [Configuring Custom Clusters for Windows]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)_ From c8084fc0ef5555fb876791dc339c2d667afb1808 Mon Sep 17 00:00:00 2001 From: Frank Mai Date: Tue, 16 Apr 2019 22:30:16 +0800 Subject: [PATCH 18/43] Patch the warning for node exporter port --- .../v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md index b4fac99a95b..0f667bcd1a6 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md @@ -28,6 +28,8 @@ The [node exporter](https://github.com/prometheus/node_exporter/blob/master/READ When configuring Prometheus and enabling the node exporter, enter a host port in the **Node Exporter Host Port** that will not produce port conflicts with existing applications. The host port chosen must be open to allow internal traffic between Prometheus and the Node Exporter. +>**Warning:** In order for Prometheus to collect the metrics of the node exporter, after enabling cluster monitoring, you must open the **Node Exporter Host Port** in the host firewall rules to allow intranet access. By default, `9796` is used as that host port. + ## Persistent Storage >**Prerequisite:** Configure one or more [storage class]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) to use as [persistent storage]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) for your Prometheus or Grafana pod. From b93bd8f3806086658c439a5dfe11ea509c778c76 Mon Sep 17 00:00:00 2001 From: dnoland1 Date: Thu, 4 Apr 2019 14:06:49 -0700 Subject: [PATCH 19/43] Update _index.md --- content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md index 60618c1b81e..2bf5aba5ca3 100644 --- a/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md @@ -8,7 +8,7 @@ aliases: Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters. -Rancher supports the following services: +Rancher supports integration with the following services: - Elasticsearch - Splunk @@ -56,7 +56,7 @@ As an [administrator]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/global 1. Select **Tools > Logging** in the navigation bar. -1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports the following services: +1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services: - [Elasticsearch]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/) - [Splunk]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/) From d7344ffbf241dc78e880b533b24babbe1cafcbb3 Mon Sep 17 00:00:00 2001 From: David Noland Date: Thu, 25 Apr 2019 14:46:40 -0700 Subject: [PATCH 20/43] Added note on ARM64 --- content/rancher/v2.x/en/installation/requirements/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md index 643401726de..1c81efaeea6 100644 --- a/content/rancher/v2.x/en/installation/requirements/_index.md +++ b/content/rancher/v2.x/en/installation/requirements/_index.md @@ -32,7 +32,9 @@ sudo ros engine list # Switch to a supported version sudo ros engine switch docker-18.09.2 ``` - +See [Running on ARM64 (Experimental)]({{< baseurl >}}/rancher/v2.x/en/installation/arm64-platform/) if you plan to run Rancher on ARM64. +
+
[Docker Documentation: Installation Instructions](https://docs.docker.com/)

From 8648893d15249bb9594178fa7f86ee67e4f7d8d5 Mon Sep 17 00:00:00 2001 From: William Jimenez Date: Fri, 26 Apr 2019 12:12:45 -0700 Subject: [PATCH 21/43] Update _index.md grammar fixes and sentence flow --- .../v2.x/en/cluster-admin/backing-up-etcd/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md b/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md index 19eaa115c2b..eeb685b96cf 100644 --- a/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md +++ b/content/rancher/v2.x/en/cluster-admin/backing-up-etcd/_index.md @@ -7,15 +7,15 @@ _Available as of v2.2.0_ In the Rancher UI, etcd backup and recovery for [Rancher launched Kubernetes clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) can be easily performed. Snapshots of the etcd database are taken and saved either [locally onto the etcd nodes](#local-backup-target) or to a [S3 compatible target](#s3-backup-target). The advantages of configuring S3 is that if all etcd nodes are lost, your snapshot is saved remotely and can be used to restore the cluster. -Rancher recommends enabling the ability to set up recurring snapshots, but one-time snapshots can easily be taken as well. +Rancher recommends configuring recurrent `etcd` snapshots for all production clusters. Additonally, one-time snapshots can easily be taken as well. >**Note:** If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/restoring-etcd/). ## Configuring Recurring Snapshots for the Cluster -By default, any [Rancher launched Kubernetes clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) are enabled to take recurring snapshots that are saved locally. +By default, [Rancher launched Kubernetes clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) are configured to take recurring snapshots (saved to local disk). To protect against local disk failure, using the [S3 Target](#s3-backup-target) or replicating the path on disk is advised. -During cluster provisioning or editing the cluster, the configuration about snapshots are in the advanced section for **Cluster Options**. Click on **Show advanced options**. +During cluster provisioning or editing the cluster, the configuration for snapshots can be found in the advanced section for **Cluster Options**. Click on **Show advanced options**. In the **Advanced Cluster Options** section, there are several options available to configure: @@ -39,7 +39,7 @@ By default, the `local` backup target is selected. The benefits of this option i #### S3 Backup Target -The `S3` backup target allows users to configure a S3 compatible backend to store the snapshots. The main benefit of this option is that if the cluster loses all the etcd nodes, the cluster can still be restored as the snapshots are stored externally. The downside of using the `S3` backup target is that additional configuration is required in order to have these snapshots saved remotely. +The `S3` backup target allows users to configure a S3 compatible backend to store the snapshots. The primary benefit of this option is that if the cluster loses all the etcd nodes, the cluster can still be restored as the snapshots are stored externally. Rancher recommends external targets like `S3` backup, however its configuration reuqirements do require additional effort that should be considered. | Option | Description | Required| |---|---|---| @@ -55,7 +55,7 @@ Select how often you want recurring snapshots to be taken as well as how many sn ## One-Time Snapshots -Besides recurring snapshots, you might want to take a one-time snapshot in specific use cases. For example, if you're about to upgrade the Kubernetes version of your cluster, you might want to take a snapshot right before the upgrade. +In addition to recurring snapshots, you may want to take a "one-time" snapshot. For example, before upgrading the Kubernetes version of a cluster it's best to backup the state of the cluster to protect against upgrade failure. 1. In the **Global** view, navigate to the cluster that you want to take a one-time snapshot. From 18c2cfcaff362a6a96a237750af58a7fed140c8f Mon Sep 17 00:00:00 2001 From: Chris McKee Date: Mon, 29 Apr 2019 11:39:00 +0100 Subject: [PATCH 22/43] Add s3 backup option to rancher/ha-backups; correct wording of titles and mention the versions --- .../en/backups/backups/ha-backups/_index.md | 62 +++++++++++++++---- 1 file changed, 49 insertions(+), 13 deletions(-) diff --git a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md index 0437530f6bd..50c78cc88ab 100644 --- a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md +++ b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md @@ -44,37 +44,54 @@ To take recurring snapshots, enable the `etcd-snapshot` service, which is a serv **To Enable Recurring Snapshots:** 1. Open `rancher-cluster.yml` with your favorite text editor. - 2. Add the following code block to the bottom of the file: - ``` - services: - etcd: - snapshot: true # enables recurring etcd snapshots - creation: 6h0s # time increment between snapshots - retention: 24h # time increment before snapshot purge - ``` +_Pre 0.2.0_ + +~~~yaml +``` +services: + etcd: + snapshot: true # enables recurring etcd snapshots + creation: 6h0s # time increment between snapshots + retention: 24h # time increment before snapshot purge +``` +~~~ +_Post 0.2.0: Note: S3 backup is optional_ +~~~yaml +``` +services: + etcd: + backup_config: + enabled: true # enables recurring etcd snapshots + interval_hours: 6 # time increment between snapshots + retention: 60 # time in days before snapshot purge + s3_backup_config: # optional + access_key: "myaccesskey" + secret_key: "myaccesssecret" + bucket_name: "my-backup-bucket" + endpoint: "s3.eu-west-1.amazonaws.com" + region: "eu-west-1" +``` +~~~ 3. Edit the code according to your requirements. 4. Save and close `rancher-cluster.yml`. - 5. Open **Terminal** and change directory to the location of the RKE binary. Your `rancher-cluster.yml` file must reside in the same directory. - 6. Run the following command: ``` rke up --config rancher-cluster.yml ``` - **Result:** RKE is configured to take recurring snapshots of `etcd` on all nodes running the `etcd` role. Snapshots are saved to the following directory: `/opt/rke/etcd-snapshots/`. #### Option B: One-Time Snapshots When you're about to upgrade Rancher or restore it to a previous snapshot, you should snapshot your live image so that you have a backup of `etcd` in its last known state. -**To Take a One-Time Snapshot:** +**To Take a One-Time Local Snapshot:** 1. Open **Terminal** and change directory to the location of the RKE binary. Your `rancher-cluster.yml` file must reside in the same directory. @@ -86,7 +103,23 @@ When you're about to upgrade Rancher or restore it to a previous snapshot, you s **Result:** RKE takes a snapshot of `etcd` running on each `etcd` node. The file is saved to `/opt/rke/etcd-snapshots`. -### 2. Backup Snapshots to a Safe Location +**To Take a One-Time S3 Snapshot:** + +1. Open **Terminal** and change directory to the location of the RKE binary. Your `rancher-cluster.yml` file must reside in the same directory. + +2. Enter the following command. Replace `` with any name that you want to use for the snapshot (e.g. `upgrade.db`). + + ```shell + rke etcd snapshot-save --config rancher-cluster.yml --name snapshot-name \ + --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \ + --bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com + ``` + + *The snapshot is saved in `/opt/rke/etcd-snapshots` as well as uploaded to the S3 backend.* + +### 2. Backup Local Snapshots to a Safe Location + +> Note: This step is done for you where S3 backups are enabled After taking the `etcd` snapshots, save them to a safe location so that they're unaffected if your cluster experiences a disaster scenario. This location should be persistent. @@ -98,3 +131,6 @@ In this documentation, as an example, we're using Amazon S3 as our safe location root@node:~# s3cmd mb s3://rke-etcd-snapshots root@node:~# s3cmd put /opt/rke/etcd-snapshots/snapshot.db s3://rke-etcd-snapshots/ ``` + + + From 3f42c51a573cde11b2b018c42caede573e1d4b2b Mon Sep 17 00:00:00 2001 From: Chris McKee Date: Mon, 29 Apr 2019 11:39:50 +0100 Subject: [PATCH 23/43] Split the rancher ha-restoration into local / s3 based and add versions. Add process to restore from s3 with note on state file / cluster file. --- .../restorations/ha-restoration/_index.md | 30 ++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md index 94093b8a135..e1d0e4bf522 100644 --- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md +++ b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md @@ -33,10 +33,38 @@ We recommend that you start with fresh nodes and a clean state. Alternatively yo ### 2. Place Snapshot and PKI Bundle +**Local Snapshots** + Pick a one of the clean nodes. That node will be the "target node" for the initial restore. Place the snapshot and PKI certificate bundle files in the `/opt/rke/etcd-snapshots` directory on the "target node". * Snapshot - `.db` -* PKI Bundle - `pki.bundle.tar.gz` +* PKI Bundle - `pki.bundle.tar.gz` *(Pre RKE 0.2.0 only; after 0.2 you should have an cluster.rkestate file)* + +***Continue to step 3*** + + + +**Remote Snapshots** (rancher 2.1 / rke 0.2.0 onwards) + + +Ensuring your `cluster.rkestate` file is present, run rke restore from s3. + +```shell +rke etcd snapshot-restore --config rancher-cluster-restore.yml \ +--name snap-shot-name.db \ +--s3 --access-key KEY --secret-key SECRET \ +--bucket-name my-rancher-etcd-backup-bucket \ +--s3-endpoint s3.amazonaws.com \ +--region eu-west-2 +``` + +Once the process has completed, if rancher has been installed via helm, the UI will load (can take a few minutes). + +At this point the restoration is complete. + +> Note: At this point it is a good idea to ensure your `kube_config_cluster.yml` and `cluster.rkestate` are backed up and preserved for any future maintenance. + + ### 3. Configure RKE From 75660cfd35029c226f30bc0f4f305ba0ca92e778 Mon Sep 17 00:00:00 2001 From: Chris McKee Date: Mon, 29 Apr 2019 11:40:52 +0100 Subject: [PATCH 24/43] Minor changes to etcd snapshot page to include mention of restoring rancher / that the "example" is a scenario (all the titles above are called example) and a note around cluster state. --- content/rke/latest/en/etcd-snapshots/_index.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/content/rke/latest/en/etcd-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/_index.md index f17de91087c..b691f0e8f11 100644 --- a/content/rke/latest/en/etcd-snapshots/_index.md +++ b/content/rke/latest/en/etcd-snapshots/_index.md @@ -158,14 +158,18 @@ $ rke etcd snapshot-restore --config cluster.yml --name mysnapshot _Available as of v0.2.0_ +> **Note:** Ensure your `cluster.rkestate` is present before starting the restore, as this contains your certificate data for the cluster + When restoring etcd from a snapshot located in S3, the command needs the S3 information in order to connect to the S3 backend and retrieve the snapshot. -``` +```shell $ rke etcd snapshot-restore --config cluster.yml --name snapshot-name \ --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \ --bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com ``` -## Example +> **Note:** if you were restoring a cluster that had rancher installed the UI should start-up after a few minutes; you don't need to re-run helm. + +### Example Scenario of restoring from a Local Snapshot In this example, the Kubernetes cluster was deployed on two AWS nodes. @@ -185,7 +189,7 @@ $ rke etcd snapshot-save --name snapshot.db --config cluster.yml ![etcd snapshot]({{< baseurl >}}/img/rke/rke-etcd-backup.png) -### Store the Snapshot Externally to S3 +### Store the Snapshot Externally in S3 As of v0.2.0, this step is no longer required, as RKE can upload and download snapshots automatically from S3 by adding in [S3 options](#options-for-rke-etcd-snapshot-save) when running the `rke etcd snapshot-save` command. @@ -253,7 +257,7 @@ nodes: After the new node is added to the `cluster.yml`, run `rke etcd snapshot-restore` to launch `etcd` from the backup. The snapshot and `pki.bundle.tar.gz` file are expected to be saved at `/opt/rke/etcd-snapshots`. As of v0.2.0, if you want to directly retrieve the snapshot from S3, add in the [S3 options](#options-for-rke-etcd-snapshot-restore). -> **Note:** As of v0.2.0, the file **pki.bundle.tar.gz** is no longer required for the restore process. +> **Note:** As of v0.2.0, the file **pki.bundle.tar.gz** is no longer required for the restore process as the certificates required to restore are preserved within the `cluster.rkestate` ``` $ rke etcd snapshot-restore --name snapshot.db --config cluster.yml @@ -294,3 +298,6 @@ docker container inspect rke-bundle-cert ``` The important thing to note is the mounts of the container and location of the **pki.bundle.tar.gz**. + + + From 01bbc1ce80a49fe9dfebdb6f777047c504357cc8 Mon Sep 17 00:00:00 2001 From: Adam Herrington Date: Tue, 30 Apr 2019 11:37:11 -0500 Subject: [PATCH 25/43] Same CA note when replacing certificates only applies when certificate is a private CA signed certificate --- .../v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md index 98d8199aee6..2866ca911e5 100644 --- a/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md +++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/tls-secrets/_index.md @@ -15,7 +15,7 @@ kubectl -n cattle-system create secret tls tls-rancher-ingress \ --key=tls.key ``` -> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. Replacing the certificate is only supported if the new certificate is signed by the same CA as the certificate currently in use. +> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use. ### Using a Private CA Signed Certificate From 408b829660b984af0b05fbb7630d989f7d1b6eaf Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 30 Apr 2019 16:00:30 +0200 Subject: [PATCH 26/43] Troubleshooting updates --- .../kubernetes-components/_index.md | 107 +++++++++++++++++- .../kubernetes-resources/_index.md | 22 ++-- 2 files changed, 118 insertions(+), 11 deletions(-) diff --git a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/_index.md b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/_index.md index e5c87ab8e39..e224efc44ce 100644 --- a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/_index.md +++ b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/_index.md @@ -58,16 +58,22 @@ The cluster state (`/var/lib/etcd`) contains wrong information to join the clust ### etcd cluster and connectivity checks -If any of the commands respond with `Error: context deadline exceeded`, the etcd instance is unhealthy (either quorum is lost or the instance is not correctly joined in the cluster) +The address where etcd is listening depends on the address configuration of the host etcd is running on. If an internal address is configured for the host etcd is running on, the endpoint for `etcdctl` needs to be specified explicitly. If any of the commands respond with `Error: context deadline exceeded`, the etcd instance is unhealthy (either quorum is lost or the instance is not correctly joined in the cluster) * Check etcd members on all nodes Output should contain all the nodes with the `etcd` role and the output should be identical on all nodes. +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl member list ``` +Command when internal address is configured on the host: +``` +docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list" +``` + Example output: ``` xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001 @@ -79,10 +85,16 @@ xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001 The values for `RAFT TERM` should be equal and `RAFT INDEX` should be not be too far apart from each other. +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table ``` +Command when internal address is configured on the host: +``` +docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table +``` + Example output: ``` +-----------------+------------------+---------+---------+-----------+-----------+------------+ @@ -96,10 +108,16 @@ Example output: * Check endpoint health +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl endpoint health --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") ``` +Command when internal address is configured on the host: +``` +docker exec etcd etcdctl endpoint health --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") +``` + Example output: ``` https://IP:2379 is healthy: successfully committed proposal: took = 2.113189ms @@ -109,6 +127,7 @@ https://IP:2379 is healthy: successfully committed proposal: took = 2.451201ms * Check connectivity on port TCP/2379 +Command when no internal address is configured on the host: ``` for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5"); do echo "Validating connection to ${endpoint}/health"; @@ -116,8 +135,17 @@ for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 done ``` +Command when internal address is configured on the host: +``` +for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5"); do + echo "Validating connection to ${endpoint}/health"; + curl -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health"; +done +``` + If you are running on an operating system without `curl` (for example, RancherOS), you can use the following command which uses a Docker container to run the `curl` command. +Command when no internal address is configured on the host: ``` for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5"); do echo "Validating connection to ${endpoint}/health"; @@ -125,6 +153,14 @@ for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 done ``` +Command when internal address is configured on the host: +``` +for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5"); do + echo "Validating connection to ${endpoint}/health"; + docker run --net=host -v /opt/rke/etc/kubernetes/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health" +done +``` + Example output: ``` Validating connection to https://IP:2379/health @@ -137,6 +173,7 @@ Validating connection to https://IP:2379/health * Check connectivity on port TCP/2380 +Command when no internal address is configured on the host: ``` for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4"); do echo "Validating connection to ${endpoint}/version"; @@ -144,8 +181,17 @@ for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4 done ``` +Command when internal address is configured on the host: +``` +for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f4"); do + echo "Validating connection to ${endpoint}/version"; + curl -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version"; +done +``` + If you are running on an operating system without `curl` (for example, RancherOS), you can use the following command which uses a Docker container to run the `curl` command. +Command when no internal address is configured on the host: ``` for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4"); do echo "Validating connection to ${endpoint}/version"; @@ -153,6 +199,14 @@ for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4 done ``` +Command when internal address is configured on the host: +``` +for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f4"); do + echo "Validating connection to ${endpoint}/version"; + docker run --net=host -v /opt/rke/etc/kubernetes/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version" +done +``` + Example output: ``` Validating connection to https://IP:2380/version @@ -167,10 +221,16 @@ Validating connection to https://IP:2380/version etcd will trigger alarms, for instance when it runs out of space. +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl alarm list ``` +Command when internal address is configured on the host: +``` +docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list" +``` + Example output when NOSPACE alarm is triggered: ``` memberID:x alarm:NOSPACE @@ -186,11 +246,18 @@ Resolution: * Compact the keyspace +Command when no internal address is configured on the host: ``` rev=$(docker exec etcd etcdctl endpoint status --write-out json | egrep -o '"revision":[0-9]*' | egrep -o '[0-9]*') docker exec etcd etcdctl compact "$rev" ``` +Command when internal address is configured on the host: +``` +rev=$(docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT endpoint status --write-out json | egrep -o '\"revision\":[0-9]*' | egrep -o '[0-9]*'") +docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT compact \"$rev\"" +``` + Example output: ``` compacted revision xxx @@ -198,10 +265,16 @@ compacted revision xxx * Defrag all etcd members +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl defrag --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") ``` +Command when internal address is configured on the host: +``` +docker exec etcd sh -c "etcdctl defrag --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")" +``` + Example output: ``` Finished defragmenting etcd member[https://IP:2379] @@ -211,10 +284,16 @@ Finished defragmenting etcd member[https://IP:2379] * Check endpoint status +Command when no internal address is configured on the host: ``` docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table ``` +Command when internal address is configured on the host: +``` +docker exec etcd sh -c "etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table" +``` + Example output: ``` +-----------------+------------------+---------+---------+-----------+-----------+------------+ @@ -226,6 +305,32 @@ Example output: +-----------------+------------------+---------+---------+-----------+-----------+------------+ ``` +### Log level + +The log level of etcd can be changed dynamically via the API. You can configure debug logging using the commands below. + +Command when no internal address is configured on the host: +``` +curl -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) https://localhost:2379/config/local/log +``` + +Command when internal address is configured on the host: +``` +curl -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv $ETCDCTL_ENDPOINT)/config/local/log +``` + +To reset the log level back to the default (`INFO`), you can use the following command. + +Command when no internal address is configured on the host: +``` +curl -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) https://localhost:2379/config/local/log +``` + +Command when internal address is configured on the host: +``` +curl -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv $ETCDCTL_ENDPOINT)/config/local/log +``` + ## controlplane This section applies to nodes with the `controlplane` role. diff --git a/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md b/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md index fb4575d0b6a..06d63135786 100644 --- a/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md +++ b/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md @@ -20,28 +20,30 @@ Run the command below and check the following: ``` -kubectl get nodes +kubectl get nodes -o wide ``` Example output: ``` -NAME STATUS ROLES AGE VERSION EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -etcd-0 Ready etcd 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -etcd-1 Ready etcd 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -etcd-2 Ready etcd 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -controlplane-0 Ready controlplane 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -controlplane-1 Ready controlplane 1m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -worker-0 Ready worker 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 -worker-1 Ready worker 2m v1.11.5 Ubuntu 16.04.5 LTS 4.4.0-138-generic docker://17.3.2 +NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME +controlplane-0 Ready controlplane 31m v1.13.5 138.68.188.91 Ubuntu 18.04.2 LTS 4.15.0-47-generic docker://18.9.5 +etcd-0 Ready etcd 31m v1.13.5 138.68.180.33 Ubuntu 18.04.2 LTS 4.15.0-47-generic docker://18.9.5 +worker-0 Ready worker 30m v1.13.5 139.59.179.88 Ubuntu 18.04.2 LTS 4.15.0-47-generic docker://18.9.5 ``` #### Get node conditions +Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition) + +``` +kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{end}}' +``` + Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition) that are active that could prevent normal operation. ``` -kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{if ne .type "Ready"}}{{if eq .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}' +kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{if ne .type "Ready"}}{{if eq .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{else}}{{if ne .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{": "}}{{.status}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}' ``` Example output: From 9a7e7a20f4b05fc701856fff4ee2de947745be32 Mon Sep 17 00:00:00 2001 From: loganhz Date: Sun, 5 May 2019 13:31:33 +0800 Subject: [PATCH 27/43] Windows preview release --- .../rke-clusters/windows-clusters/_index.md | 119 +++++++++--------- .../v2.x/en/installation/references/_index.md | 1 + .../en/installation/requirements/_index.md | 4 +- layouts/shortcodes/ports-custom-nodes.html | 26 ++-- static/img/rancher/enable-windows-support.png | Bin 24009 -> 0 bytes static/img/rancher/flannel.png | Bin 10455 -> 0 bytes static/img/rancher/linux-control-plane.png | Bin 84856 -> 0 bytes 7 files changed, 81 insertions(+), 69 deletions(-) delete mode 100644 static/img/rancher/enable-windows-support.png delete mode 100644 static/img/rancher/flannel.png delete mode 100644 static/img/rancher/linux-control-plane.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index c0f110517da..29f0aa3d0d2 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -3,23 +3,22 @@ title: Configuring Custom Clusters for Windows (Experimental) weight: 2240 --- -_Available as of v2.1.0_ +_Available as of v2.3.0-alpha1_ ->**Important:** -> +>**Important:** +> >Support for Windows nodes is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using Windows nodes in a production environment. When provisioning a [custom cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) using Rancher, you can use a mix of Linux and Windows hosts as your cluster nodes. -This guide walks you through create of a custom cluster that includes 3 nodes: a Linux node, which serves as a Kubernetes control plane node; another Linux node, which serves as a Kubernetes worker used to support Ingress for the cluster; and a Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. +This guide walks you through create of a custom cluster that includes 3 nodes: a Linux node, which serves as a Kubernetes control plane node; another Linux node, which serves as a Kubernetes worker used to support Rancher Cluster agent, Metrics server, DNS and Ingress for the cluster; and a Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. >**Notes:** > ->- For a summary of Kubernetes features supported in Windows, see [Using Windows in Kubernetes](https://kubernetes.io/docs/setup/windows/intro-windows-in-kubernetes/). ->- Windows containers must run on Windows Server 1803 nodes. Windows Server 1709 and earlier versions do not support Kubernetes properly. ->- Containers built for Windows Server 1709 or earlier do not run on Windows Server 1803. You must build containers on Windows Server 1803 to run these containers on Windows Server 1803. - - +>- For a summary of Kubernetes features supported in Windows, see [Using Windows Server Containers in Kubernetes](https://kubernetes.io/docs/getting-started-guides/windows/#supported-features). +>- Windows worker adding script must run on Windows Server 2019 (core version 1809 or above) hosts. Core version 1803 and earlier versions do not support Kubernetes properly. +>- Containers built for Windows Server 1803 or earlier do not run on Windows Server 2019. You must build containers on Windows Server 2019 to run these containers on Windows Server 2019. +>- Windows Overlay networking requires [KB4489899](https://support.microsoft.com/en-us/help/4489899) hostfix. Most of Cloud-hosted VMs already have this hotfix. ## Objectives for Creating Cluster with Windows Support @@ -28,14 +27,16 @@ When setting up a custom cluster with support for Windows nodes and containers, - [1. Provision Hosts](#1-provision-hosts) -- [2. Cloud-host VM Networking Configuration](#2-cloud-hosted-vm-networking-configuration) -- [3. Create the Custom Cluster](#3-create-the-custom-cluster) -- [4. Add Linux Host for Ingress Support](#4-add-linux-host-for-ingress-support) -- [5. Adding Windows Workers](#5-adding-windows-workers) -- [6. Cloud-host VM Routes Configuration](#6-cloud-hosted-vm-routes-configuration) +- [2. Create the Custom Cluster](#2-create-the-custom-cluster) +- [3. Add Linux Master Node](#3-add-linux-master-node) +- [4. Add Linux Worker Node](#4-add-linux-worker-node) +- [5. Add Windows Workers](#5-add-windows-workers) +- [6. Cloud-host VM Routes Configuration for Host Gateway Mode (Optional)](#6-cloud-hosted-vm-routes-configuration-for-host-gateway-mode) + + ## 1. Provision Hosts To begin provisioning a custom cluster with Windows support, prepare your host servers. Provision three nodes according to our [requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/)—two Linux, one Windows. Your hosts can be: @@ -44,73 +45,67 @@ To begin provisioning a custom cluster with Windows support, prepare your host s - VMs from virtualization clusters - Bare-metal servers -The table below lists the [Kubernetes roles]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we're installing all three roles on this node. Node 2 is also a Linux worker, which is responsible for Ingress support. Finally, the third node is your Windows worker, which will run your Windows applications. +The table below lists the [Kubernetes roles]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we’re installing all three roles on this node. The second node is also a Linux worker, which is responsible for running DNS server, Ingress controller, Metrics server and Rancher Cluster agent. Finally, the third node is the Windows worker, which will run your Windows applications. Node | Operating System | Future Cluster Role(s) --------|------------------|------ -Node 1 | Linux (Ubuntu Server 16.04 recommended) | [Control Plane]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#etcd), [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) -Node 2 | Linux (Ubuntu Server 16.04 recommended) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) (This node is used for Ingress support) -Node 3 | Windows (*Windows Server 1803 required*) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) +Node 1 | Linux (Ubuntu Server 18.04 recommended) | [Control Plane]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#etcd), [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) +Node 2 | Linux (Ubuntu Server 18.04 recommended) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) +Node 3 | Windows (Windows Server 2019 required) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) + +>**Notes:** +> +>- If you are using AWS, you can choose *Microsoft Windows Server 2019 Base with Containers* as Amazon Machine Image (AMI) +>- If you are using GCE, you can choose *Windows Server 2019 Datacenter for Containers* as OS image ### Requirements - You can view node requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). -- All nodes in a virtualization cluster or a bare metal cluster must be connected using a layer 2 network. -- To support [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/), your cluster must include at least one Linux node dedicated to the worker role. +- For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. +- For **VXLAN (Overlay)** netwokring, you must confirm the Windows Server 2019 host with [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. +- Your cluster must include at least one Linux worker node to run Rancher Cluster agent, DNS, Metrics server and Ingress related containers. - Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy. -## 2. Cloud-hosted VM Networking Configuration +## 2. Create the Custom Cluster ->**Note:** This step only applies to nodes hosted on cloud-hosted virtual machines. If you're using virtualization clusters or bare-metal servers, skip ahead to [Create the Custom Cluster](#3-create-the-custom-cluster). +To create a custom cluster that supports Windows nodes, follow the instructions in [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster), starting from [2. Create the Custom Cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster). While completing the linked instructions, look for steps that requires special actions for Windows nodes, which are flagged with a note. These notes will link back here, to the special Windows instructions listed below. -If you're hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below. + +1. Select `v1.14 or above` version for **Kubernetes Version**. + +1. Select **Flannel** as **Network Provider**. + +1. Select **Enable** for **Windows Support**. + +1. Choose the **Flannel Backend**. There are two options [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). Default is **VXLAN (Overlay)** mode. + +If your nodes are hosted by a **Cloud Provider** and you want automation support such as load balancers or persistent storage devices, see [Selecting Cloud Providers]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) for configuration info. + +Finally, resume [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 6]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-6). + +>**Important:** If you are using *Host Gateway (L2bridge)* mode and hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below. Service | Directions to disable private IP address checks --------|------------------------------------------------ Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck) Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward) -Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding) +Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding) -## 3. Create the Custom Cluster +## 3. Add Linux Master Node -To create a custom cluster that supports Windows nodes, follow the instructions in [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster), starting from [2. Create the Custom Cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster). While completing the linked instructions, look for steps that requires special actions for Windows nodes, which are flagged with a note. These notes will link back here, to the special Windows instructions listed in the subheadings below. - - -### Enable the Windows Support Option - -While choosing **Cluster Options**, set **Windows Support (Experimental)** to **Enabled**. - -![Enable Windows Support]({{< baseurl >}}/img/rancher/enable-windows-support.png) - -After you select this option, resume [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 6]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-6). - -### Networking Option - -When choosing a network provider for a cluster that supports Windows, the only option available is Flannel, as [host-gw](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) is needed for IP routing. - -![Flannel]({{< baseurl >}}/img/rancher/flannel.png) - -If your nodes are hosted by a cloud provider and you want automation support such as load balancers or persistent storage devices, see [Selecting Cloud Providers]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) for configuration info. - -### Node Configuration - -The first node in your cluster should be a Linux host that fills the Control Plane role. This role must be fulfilled before you can add Windows hosts to your cluster. At minimum, the node must have this role enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). +The first node in your cluster should be a Linux host that fills both *Control Plane* and *etcd* role. Both of this two roles must fulfill before you can add Windows hosts to your cluster. At a minimum, the node must have 2 roles enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). Option | Setting -------|-------- Node Operating System | Linux -Node Roles | etcd
Control Plane
Worker - -![Recommended Linux Control Plane Configuration]({{< baseurl >}}/img/rancher/linux-control-plane.png) +Node Roles | etcd
Control Plane
Worker (optional) When you're done with these configurations, resume [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 8]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-8). +## 4. Add Linux Worker Node - -## 4. Add Linux Host for Ingress Support - -After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Add another Linux host, which will be used to support Ingress for your cluster. +After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Add another Linux host, which will be used to support *Rancher cluster agent*, *Metrics server*, *DNS* and *Ingress* for your cluster. 1. Using the content menu, open the custom cluster your created in [2. Create the Custom Cluster](#2-create-the-custom-cluster). @@ -128,9 +123,11 @@ After the initial provisioning of your custom cluster, your cluster only has a s 1. From **Rancher**, click **Save**. -**Result:** The worker role is installed on your Linux host, and the node registers with Rancher. +**Result:** The **Worker** role is installed on your Linux host, and the node registers with Rancher. -## 5. Adding Windows Workers + + +## 5. Add Windows Workers You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option. @@ -150,11 +147,13 @@ You can add Windows hosts to a custom cluster by editing the cluster and choosin 1. **Optional:** Repeat these instruction if you want to add more Windows nodes to your cluster. -**Result:** The worker role is installed on your Windows host, and the node registers with Rancher. +**Result:** The **Worker** role is installed on your Windows host, and the node registers with Rancher. -## 6. Cloud-hosted VM Routes Configuration -In Windows clusters, containers communicate with each other using the `host-gw` mode of Flannel. In `host-gw` mode, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network. + +## 6. Cloud-hosted VM Routes Configuration for Host Gateway Mode + +If using [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) backend of Flannel, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network. - When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work. @@ -171,7 +170,7 @@ Then follow the instructions for each cloud provider to configure routing rules Service | Instructions --------|------------- Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute). -Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined). +Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined). ` ` diff --git a/content/rancher/v2.x/en/installation/references/_index.md b/content/rancher/v2.x/en/installation/references/_index.md index f84bb00b71c..9ccafe15b9c 100644 --- a/content/rancher/v2.x/en/installation/references/_index.md +++ b/content/rancher/v2.x/en/installation/references/_index.md @@ -74,6 +74,7 @@ These ports are typically opened on your Kubernetes nodes, regardless of what ty | TCP | 2379 | etcd client requests | | TCP | 2380 | etcd peer communication | | UDP | 8472 | Canal/Flannel VXLAN overlay networking | +| UDP | 4789 | Flannel VXLAN overlay networking on Windows cluster | | TCP | 9099 | Canal/Flannel livenessProbe/readinessProbe | | TCP | 6783 | Weave Port | | UDP | 6783-6784 | Weave UDP Ports | diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md index 0a79919978e..109ca0ee078 100644 --- a/content/rancher/v2.x/en/installation/requirements/_index.md +++ b/content/rancher/v2.x/en/installation/requirements/_index.md @@ -20,8 +20,8 @@ Rancher is tested on the following operating systems and their subsequent non-ma * Docker 17.03.x, 18.06.x, 18.09.x * RancherOS 1.5.1 (64-bit) * Docker 17.03.x, 18.06.x, 18.09.x -* Windows Server version 1803 (64-bit) - * Docker 17.06 +* Windows Server 2019 (64-bit) + * Docker 18.09 * _Experimental, see [Configuring Custom Clusters for Windows]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)_ If you are using RancherOS, make sure you switch the Docker engine to a supported version using:
diff --git a/layouts/shortcodes/ports-custom-nodes.html b/layouts/shortcodes/ports-custom-nodes.html index 9b9f06e10d8..4edf822d2f6 100644 --- a/layouts/shortcodes/ports-custom-nodes.html +++ b/layouts/shortcodes/ports-custom-nodes.html @@ -21,8 +21,8 @@ git.rancher.io (2):
35.160.43.145:32
35.167.242.46:32
52.33.59.17:32 - etcd Plane Nodes - 443 TCP (3) + etcd Plane Nodes + 443 TCP (3) 2379 TCP @@ -45,6 +45,10 @@ 8472 UDP + + 4789 UDP (7) + + 9099 TCP (4) @@ -52,8 +56,8 @@ - Control Plane Nodes - 443 TCP (3) + Control Plane Nodes + 443 TCP (3) 2379 TCP @@ -76,6 +80,10 @@ 8472 UDP + + 4789 UDP (7) + + 10250 TCP @@ -93,8 +101,8 @@ - Worker Plane Nodes - 443 TCP (3) + Worker Plane Nodes + 443 TCP (3) 6443 TCP @@ -105,6 +113,10 @@ 8472 UDP + + 4789 UDP (7) + + @@ -175,7 +187,7 @@ - Notes:

1. Nodes running standalone server or Rancher HA deployment.
2. Required to fetch Rancher chart library.
3. Only without external load balancer.
4. Local traffic to the node itself (not across nodes).
5. Load balancer / proxy that handles tragging to the Rancher UI / API.
6. Only if SSL is not terminated at external load balancer. + Notes:

1. Nodes running standalone server or Rancher HA deployment.
2. Required to fetch Rancher chart library.
3. Only without external load balancer.
4. Local traffic to the node itself (not across nodes).
5. Load balancer / proxy that handles tragging to the Rancher UI / API.
6. Only if SSL is not terminated at external load balancer.
7. Only if using Overlay mode on Windows cluster. \ No newline at end of file diff --git a/static/img/rancher/enable-windows-support.png b/static/img/rancher/enable-windows-support.png deleted file mode 100644 index d7ed2d07a3154246bdd68596c81319447bb61b83..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 24009 zcmeFZQ*6rK-lL zHP&8h?p?c9tvN?UC@DxH!Q;b&fq@}OONps~fq~2YyFP=3{&yVH_Qw5p0(Vl86alN5 zCOicL`wk{8CamTTe&GY7uQQbV^z5nXbJo3@;stKB;Dy8p2yjji%4`UbZzxKT7a1+F z_T*Z1CJn&U1cPCj!XzND?j3H^YB71-T0g)1JMGgkugcoc*HFx2B((W_HJN=kHOYOP zl@2uG*;qt}(2;wm-%e76rGdo!cFh2Jgn6i?z9)vAbp2-c3Ezlnk}!cBHO8^`J{>5N z{F5vXRSC9N0nyno`p#=l@@m2^tyu^lTluG|NDf?-H^g6LCp-K*9RlMZF5XwL2huIY zuXbvt3bYb$3~AN!!@yuic<_*3AZmbhibjzX*(j;dS8(hHHXCO&DwQ8i=|AT*kXz-j zm<>DR((t^VuXuZAaU?oKIBX!=egOP9?f+tQhm;BTFWV9H4W_C72*-#}{VRrPV3}4X z^q*_O0P+-}-qi8TND?%GEiCI2Q82QeTOj-RhCxw~Z7ES}x9QaE57c z8!AMjRsX{%92Qm>o)%tX?Ik|sLL`M;!_s){TrQafsZKrGyizFmm!2!wW&{zFF%hA<5g3qW$#8w}imo+A@)@7Yd_8a_%BzGF2mAFRc81 zcN+5M)z$qeINW=W0`I%Gk~>l}ed7x=gS=){BCZ{>6C6p3hx3UWK^Kowy4_QOnf6FUUyA7|GmS#buBPe|?_>w;p4 zRPcKozi|82-JVhGCoX%$W0@0Pffe0BgEnWvG=OgUN4Ec`P1O=s&Mi08c7LC+FNcdIoL3f z3`@JBDbQOv~C+o zJ~98^59IER2)z>@nXI6i;EB1UI;NKo%Q`f-87Zg878yWTGwi4MZ3R5esoI~NP8h(w z<81{u*8F9F56zNlOjHT`^MQugL~Vh-^C_0B1NZ>}$AgbSz-sc7%9N#UQcjk+vClj> z#3RCjmyD{5>MfSO<*gj`CH1?$DH;{rB=W{Hp_kXJr-v=NIb5N(0=d_-h)lH8{&!jEBX4xy4%4$BB9wYbEZN zdMM=tHpLhnygj0h{2%js{Ca%_xQxo@0vDD@aRj>EJOJ-x`M|5OyB^Nf--)0)#x7L7 zx4o&+W&%{ilSB4A_gjsZw`wx)TcMsH$*e&bR#PJW`8Sn-M9#N5iuqMgs1_x;%A+YniFwbpV8vS|Jzvn0;AcfcmAd)iWuB zE6(^aV}IalF^ib_JSiME@dhZ45rbAcrp4%4@B!&HE<-hX;b*m2#=u}&G%T{q?w?D! z#=^`JFc>y-N!=!Q*7+=K8MjGN%JH@#+sy2r zg-qBW($Uzys#^MD5^1C_*N;8PR-xy6;~Y9v`Ha z-B#O?K3@d7sC$}X&$*TPu)iODv8e7YNL;o8hyzNHu^)#D3 zGta$P?QChsX#F!p-N@ZmJzmCBd;C>ev1)tlg|4<%f|EmNS2TVgcpVvfA3xRhCL2fw zLlyxcY>I-K-|K6;ad5Uih%o`_JNFZs8k<9?5AX56+Tl}kH3B5v>;}HyXsX$Gzzh9; zHesM~F8ECyo)D=0@&>fOiM`}`)*%@>7IGre^?ot9FemI)dLaGsJkD;r=}A&^#P&Us&- zscWJ0H$Us)PT=0Y6y!k&h>i!t*IaXWHTz3I z0&FD=m|btAJU1_^6wxpF-=wHsghOn0!+J)mtEA5yiWC~NbJ{ogXja!L{g6`&K~ke< zOsc3-)39>w3D|`BY7|r~U#*8Qx3vyrb&s`QA-w#r59;Fpu)c2r89aup5Q*&cS?d zdwL}DZmd5ZCb;th6WmvX!XHsS@r0yVb=cfK`j+`Gh7Iu@;*85=^L5Jja32!w;V~x6kEvMtDjk)Y5pL?{KgI!fX8`C zaaNgppwA`Vq+wM5hlm-+;6P*5L#o;1X6F5R$SJe6pn4{(zrnGnvnolVT8+^H9o4ZJ zD23nT_2yOQAt~@P%L(tuSaVKIFZQj3stumrVYdRlqIrFm0z;umpd_WXcS^4fZ{j$W zjBhEicw!Ha>%UWBJ*^9+Vn4fD>HprbV_6)3s7!#_0hq*Z1GH)Uj{m`8nbdt7w z!f|cd4&DeHPWOzvew$G6Z^TlHkn6clW4-iZnJLMmd=K7%qE`&rG?1{8WmaKFh&$)l z36cC8O0ByQJ=~&eydW2!dPP|8Kvh!xn;!D(2Wpx!dWoE1TLYVcVuSv=Rp(6(JH5q1 zR@HEhiRsClAXktgxU>PkdqprT!B7NSV-DPn<~_A zyhv6>f%usiwA;M=yq7QpmBck7oh}k5%sp=@(^Z#S#! zP-@S^g#msh-R(t;8~=>P!_9>%Bnyn$5*)OKqM2|e<3UHE6p2DA#(G^@;uw5q0Ft=Q zXQ5%i=|zQO@EL9wZQ=s#B(KQ54=eSCyHTo!h=l$MQX1l5=eUyDe!RdaCD|4l3kW`r z-72|ZeQQJtz>`QbSYfBLzoNarJuW5gbvmvY#41f8>y<`JA4IE{H;o9&5r#DW=9Lvp zC2XiBY$BnNB^3d#fD0ui3qTNS$98$7ydI!6(~H5bh_mZ@ApCNF)(Hn3?*7{f^uAd* zSOR3%3+Lhy%_f7JoN5LcNxC4xbM4dv4F#oW$UjZ)s#W84LpYl84!F^xO!|BrzrJPl zR3V}WI5TtQwiBAoOqsq0t~E*&UdUSZS6Y1qAGO*B_Sm*62F z6}%}?usI&9_{7o^p)VgW4c~pcpJ^j(&Gi(doR(1Q{tf50>A`(v-*$7EDTFARgnn~? zQrQU~paJTQRvCjDW8qfnI4jH@zRM!@^?bK^SubSHYj4!k8r~;58ThivY*YWNbPud( z5Lf%@aIs-(#s{y1P3U<^$?*)MzmGrMQeo3}&y3!ZN>L99rd1>sD&9p6lp4%J;LvyZ=pLB z`QrsHn{dx#3AqVa^vaW1ntorK*Y&OSsRz~+8psBh+gF1K(PoclPCFb5Nhgo)P4qAk zv-&_??^_dRWXQN*Y&baDo>CPOOO*Q(7pIM;isVT`M*-&ydEb)#YP6(2ho3NXp+|2;y z%_fpn+KXPFASngekWG>1boBJvZalZoml4=oPzDF_#O~#_m>vfdw{}|+oed^JN>SHC(wnMPvahdg2lPi{8f(9}y)X7j#NbmQ9NKxs zS75V3?&GiQ`dfd$cpR9PB(8YPeV4wyL-E1C7Vx9}g)CNoQ6*ddMD5pC&FzOicK>s~ zQ}2Vj2Cq1>8bq(W!gjn9)#?o{^!L#2_EGB#V#p)O7RHN*6lr%n_6xY>wrf};{iu`? zd&AxW7{--{8kAZ}moN$VBoZ3XUxaeAL=W8ZZE~jE4SmjqgTa}oOl27{EcN|7C)F>r zwT>t*ZsUpiSc)w}H5i^0l2jQGTS61^`1@|2?JTEJqoSt;8ZO~lTj~dJQryXow|9lv z4dJ#!hOrMJfow*1G6pcGWircR+&Bn(e+MCXzf%V`^}{nT&Iqf@!Z@~Vu|=?tT&j_s zpJmRjbN6zFkI__W```65fZXM^i#C5YqIgxD>D!w+ZtlVZfHo|{{bj&96wXJ+q`hdC zwX7!Qqk^u2v=%`OPoUP^c~pKIORnSDT(UBD7{#8X&Z96#qjyjfE1hIkHg}ub`<4eZu>rOOinM?{2cb% z;YI!|-*FN5j?6g%mV!1?#fi+Sfrp2dJ^eqz&ZB&C8AOphKwVu;FbLL|czvMO85&11 zxe#{{7WL#<2hzLJ@@#a|hM_U~s4lW#a~9)w_w~;y(aew4@k`$Yfwyf636Nf z!iH-Erj;KiV;BI$`ZV{jwD*%SMp*xW#8A%sZ@2XCokKrzP#!y8@O|8uCpx*4Sc#x2 zz{ugyE4iY&U;aFxgXFN?;!}vRONbp)TN&hu zeep^7P{jTjE{h#BF__x5SB`>=F);jzacu>e>K?Sc|C+5d9 z`80Gtv%(a8Ph{HK{I$Pm|JN_cB7}^I3Z}IJ+wKG)%@7d}o>ylHq-;`$X21B@Ti~Z0 zthQrHxwsOg7IsGhQh(LsiaR0Q+8kpBOCn^$m!k4q!FJiesX79jc*nRXY&EmtU@p_{ zw6w$Zuua!*b`NdW-qjRi3mq@~LO6mF8Fqx8(iSoP*JxQ6-f2TEF(#D~;V&Evu{tib z+zugT%%XXDUSNyg-D5?MWZqT~C^y6U1|NXu-|IjjM;m3oNBy%yIl(f38+VA(DZ$=A zJV9m1?7Mg+!~dF3b|eA&GHGn!YW<9>g1(VjnJ2H46>}SUOFJN z*QWA8Z)BDYugS^{WJ5Re2>sD$MD+r?hXzCxPHm`KK(tI^2M)7#nkw1JI{g6eiW z7-Yi!t zbPC8fXV$hN^xT!Rx|wpLxx`$%OKG)6pOVEo!{auSf!@pADVe`+I2X$CY46#%YFNk2 zg#ev`*I+Yar+>D>6Mk_71$CEI)QAcxp4sypv>l9vAu10Z_;}ewwQ|dzPkm6CTJY%I zb}2sOs8i7v+U4OiyG&tlAa;K^5?wp@+&)vk3;bBQ{c>zsP_n~$Mh(YER{J3Y{OZGZ z^{zo$0tS3-09F?o^50`;5`F(p<=j6!=8X`DIEeGoMLJ51O8B{YXQ_Ush@SCf5X`OZ zd0&73?-=7Np~Xg=$j@un`q_U}u= zh`=RcjYD-}JCW`$lViDfR^ti+Mu^hdX&Gmtr1whj_l%db!DXD3e=`=@SZ9_gSa{N8 z3jCEFinK&0^+@x$iUpMl2M#X%SwJvq!1I_}boWM&bAav={B1Wq6?4HwY(ka^n;7>J zpNLB-&-~oWaWe`_R!O5+kt6_^+Q{BC-N&}tsO~B#5CQ7Z3`-dY?F>>`;`%D8;fn^3 z7=+VN9b@yhQFO$$0XVm$)yZ7QCgN)K2&Rl;I2g)k0zu4>qgDwK=)qkGwSSigvIzw) zjw_Q)Q#OZvfG%F?T?iz*TLlRy6x->ovV!U=)uRKq30klS?8AYh$Z`odLaeCwkyCxy zC++v~!OP=fk8;!632dtoiW}CbL1yOuK=D_lxEcPNZWr2;mk2fLT6cKghWjotfYv-7 z4bf}a5u7I%@pFE*8ZR;KR|-e*^hXstqmV1`Jo-|Y9_$%t@>_mz^!U~hFEhYm@bk5w z9vbGoJYP&1b=pu@PHJX6gd&-MeWJslFRMN2Qz0mN#q#hLu#w6ULvT;Catk2#Pxlg}LcwkesUQaWRdtM@e0QgYDl*o)x0F@vr_F#f!knM!x!IxMDb+crYwjwg z7iM(R`V9>^k?wVwl0Zt1amKSJHpL;z;<`J)Y-kPHWI01nNaw*aCr7>)&2N;7(JTv% z)s5YV%rH++r623VZIiH2L2LddO?>K0=)`X5;*7+A6bfW3&D^>d~8!Q3XZ( zh(u`Irl$H!$9rW_H~ObLoAwpLUj~zraPbr{;v1(lx+r^lA4v^KVIaHw;zWc}^Ek6B8KR$6I0FZCHhS zpwWP*$~YLPxOakVmQ^HjjaQedT&Y`*;;Lw*T^*tsmp+oBAGVMYBDB!iAXpfc4~;@# zGvExiZ)*XEFhDr6kKzCpLxJS*&kfwBf+e93yzSlM+T?Ps1grZ@b zKqXDxe4<<6>}u#h6NFYfM#uVvq>T|w1ALU!1MOrOjLXFZ=j6x-TdQl+a2|K~MwYd) z$xYf`zOOs&7^R7^kuGfn#ZEC%JF$(xCk+`diLJS~j6%Q?o=Ij$=o_@!GMCYqw(C{2 zvFi)ixJ=Ye5nw^q5$j%tHi9nuJqdah4~6}b>a7@$|70IbLt~6TF{_(!mdA`IlmRLi zcS3!{D7hON1}-^`MNUx*10NrsrXHxj*L#MCAIM69aZeZ37G;ij2?CWBU%GvDu^AV4 z&T^qHwA4GP;1lB`vN96e$;oMzueG3rrf;jr_+ukJI2X2*!~K*2wol_WBet|AIVVjq z?v>|rApIDbVren94dLD~lC1d-9s2`KdSMb&i2*0&8rX2Vn#F+(`1B=)QuziGOT+73 zhi#z6b~HI*{m;6xs}NpR(jt! zU<%aLTYgjx#r1_m@(x-10ep@|zK_M0Dxm;nrWP|0ld@c>F&Wb$mzJg(p%a~=+6-JG zTl}n7dIhEKHQoG33b?ps5ZHK5Byc(vK5k5f>_MPm? zDp`d@4DM`WD&x|SrfK`Ig%NxE65WH^xACiv?eV-KXo_uo(d(rrl_Vx7< z6@YVLdBUN@L}Lm=5@?P`+U`dlRTp-m4`=E*z!9@ygZS%ean|Iwo8l zdlb0lePwW!6XjKfDM@nl5s}wI1wM$6b}$MbGHJcMu@C!)*koHEYte~^&dKZBRa9sn z9q#oL?oiD_Tgew=q}t-FdhT*DHkHS z*{PC&M#rXFv(|we^auC4__s1LGKK^ViXADeG8aO=wcxbKJt%WxiHqG-G8k`Q$xeJ?6gFOlq{38G|cJb3=HuwoT0rP6ibR zCQuf)b?Bk-V>FZ&5udWY6Oz*{a~C#AuzL!c`Wvx0jNbeVK4FQ($hbXqL*rM6VP&S2 zCd$R5(#v}$hMIVu?`1hsZ+ATRIj0IHLAea%(o4PjERj;S@;r-56V&6%gA@*u8}_T5 za_9wd>keLu{M++|g9?X6>4U%N(9P{g{+N8Fc!x7GFH9+L5{5lh9dUb$k{3ZT9AYyJ zjxknaHuXHpYQvd~+m|XE5^u_qe&OC86&n7%yxJwR9(cibA1}_#=1ZR+@J8k$(&<)P zCou0o?X<@mvq*Ap;@|}JO9AsZG|1dpbEUJD4-?;#suEC5Vii77d6WxH@-XF1c;35Y zuEHit4|SiO0k=vMv*YC8r;L&rV!Wuc9o1Nxw&y%ImDo#rG6Ve{&`mB+d5xf>m?N$P zXWAJB$Dsks-8}=0g;*JlG{se~A2+kmV#rqwjj35ElnQFz`7qtpmfRR$<{t6eh|JrM z=y1EIzM29SGlM;^JZ<7-wBeBqHq_~6{JcZhB#Mq4u1nQvDT5_^RKDfmx3&kwsz+{& zHpopTiyMTO{BwCdIF~k;_6r-Fr7VJedHaORxaH$sw8p`MEp&LSz0wO>==WH}1w^Sl zr##V$Z^j=v8o^^JR{OA7Lkb)7N;A_q#qe4E!;>ZwP3$hNu5(ZQMwY9Cq0qD*W4EaM z2UTJ0A(+g(>lnddXVFp`P*6?xi$oF-GrY{Cw~?Dv3`hYqQ30FN1UA(=QnbgkF;z(c zHLh0~#5+v;OrfX|hb!7iua)Ii%k%!2ID) znHfmmjmamKhhgISt}v}1t^%M$l|hPmHn8>OxEHn4Nytau^KGDBFw;p ztle#MPX@sMw|v58 zfh^x?*<_GF2Kz z`MOP<{!V&Qd5ys&L7W7+*?m=5KB*(ogRK;?;R-X%^y@|$>Ei5GrFfF+s*tXfpM6gX zx#59PN`#S-+3Z7?kk3A@WggtP_%`h@-ruMPHea3QHJyU!L_dRRO?rr7VM60QAP#&r z%Nw$|la^=!Con-iv((YF5oD&#%5O946zRkp-r&pQA8Beph>b6?um5FD%Wqi(s+95E zp_^Wsu7+1ZM~YvRL>NYIV8|ikoevHYY7V}#)p(+|37}#-l06R->nd)625oNM92Yx~ z=K1IblYU{`hkz3NRzxg181yjojag8_c!Y=F8Flv4y*W~;&)1{L<-p0tkr~dcIflnF zJNTMZA5mF#xu!vQj5M_Su*67tp%T{u{0owN-4|(0$B~IYI7OY~4rnb?b6ZLenizft zV_9T1m773piZ`?Nv_TdZxARCDeO+}2tyL9IhEgYjIa>JLJ2GZ+L>E>w#bd&F^3Aei z7SLTBuFXNL87I>Vr~ItqNcrdOJs4mQ(4iGU-9OjE^GA6{-sSNUcuVM) ztJnhst8+g&1XBFT2BFKmUiE3JT?&0qgoX>q7BS6?GJj`(e>0!Cocl?OYu<@ef0dw( zLCH~=j9~&8A3(ZX8Njp4aM>k;D>b?6qFy`U&nm*OXecej`fL);Fvodt6k(?51hW8K z=+nT3J_(}Vfy=K+$InG76wMa&d%N@AHo5&32C;Bz8LQwoL&}JKUBMv<7xBDOTj^Dv zYn5-wbk8qIGqM50Dr$B(YHs7G_lzlmEfmQVR?BQ`hpq&PEk`=yo4fF`07=rIt=~M= zRx{@9gwK-X$NGsPjq(B$ol!2j38{tgXd2Fdx&!64_y-WWLJ^^%t{d`$`4RXk&APG6 zU0W);rkG@QFt@4>GZX0&Kc5LoYO{ugLc-7)UP!S$$_TR$Yv$8l5U48Fr^(Kd1sx+X zB2k*HjGKF@k9!`)0zvU`Bj916$oOd!`C^UT|Jz!dtjt||S0xy-_OGAkpcLGh>xV!U9eaXYxA2tCjPU3!LYf{Vt%eZ>Nrx6&ftKrkI7 zXD!dB86httA&~CVG+&d_Z`Nc&NB9T24E+uFmu4sd@>3frocM)D!|2vD2Ix~aM?aUK=gE0rk zVk4wB90h0Uc(p-AdF%7&tkE|Nxuj-7hwbj`m<(-Q5foi3q1J@3&|dB8IkG_)04m-j z`S2fm@NwUVCU;EIy)|F68H6acO*H|cF`rG@o;3N6hVpm9a@kFf8Z>>fVR24LRchjt z*Ka9~YmRZd*p>1H%7&O;c}ZiE>$_l-J}GKZvepH6T}}2vHp!n4jnt*~b>!fVO7}{R z_wMP)4rm0GL9Pt!&9EfrtNZa3(MV0nCFaAQVsa1HLou6k zD~qKVl$xwxfvD7ef!c+8`p0rq8VwJcIbBKGFe|26<>gI14PP3i4PDZSi)H1AEHlDu zY1M;(boA=7QOA#n+_uOmC3{R9LxMy+w@e9uZwq(rQfO8J38R3(NZ~SU1nD5Z#YDNg z*4fV#R;0NHF)JFI4i#*s?))&h0}Go3o1M`Zv>OI$)+l>&g40tAYijK;VG+j=8u>$kU>IUayH|Aqa9W>AV(;=g)Fn%~p&A`YKyY|23)*2r7aJ7Xpqq3Sb< zZDe2J;m`OGfo6s$FFHBylSeuNPZ#r}X?IDNicNA7{} z1kC>I^{Gj&yO6Hn=a+qh5mTW>gNZZ$L)ySgROAcXs?$ewA^gKg%rQhZPh5UYMBJHbBo<4k%! zUg~fw%^PVONM54(vVVVU4(Bvneh@K)lNSTI6#vn5Gmna%0U|C{NTTS8#r}?Hl#8#3u5>CE_ZeIB`4=hw-XtqaPdl zCT;>%)CKhRYZHh23N&eHDJQI1Crah*L4I*PBSJvv0t0O-QTZHM=ZKz>k#t+x30p21Su^FkNm2L)*yIF_Ch(5{WhjQ;DJp!mLyX1GY zl9=EQx_{&hd;l$~QZO&n_i?TNEKgu*`WNGse*L3lzW>inD7qLD(B&LDF|G&A3 zr}3emRs5$^F8Tf)?FbW$*6u$P@+k6PRV77q{xM$v_%Y0X0A+n6J*@uE()nLpXHx%^ zXa9pE?HjmwnkraP*MFA&G5+Lo|0lWsGjso=H~-&1a{u3!<&HZADsT&};zfb$+tKOh zcb*+dD>ETS$3_EAf<5WMesinKV0H=&TCNGH2BOPL*vyMjc{egl&R$bi&QNA| zz7rT3HLV^nw-QSk+KR@7FXE#kkkR=D9)y?9+fKu1yb2mH@gq>qos@j%%c!rd$C*fF z`kvQH;Pabwf;*#7eG-g&BE!_r%7qJmq24!&3>UG_xV}FrF4qWT!Z+XrJinPd=T!H3 z!#k<26#*23$xbwsvP)w!4P{{GrBfE#9;OKJn<*SQ513Ji6{j zl;#Z9gz8#v*CD%A`=I5FhCj3VoSGchSe=VJq~&A=xDI;N~z zuY;TEdZ1eq$ma%`@$p0WfZFbJyl&s}=UO<3PNQQN)|WwN9oWIKB90Fzk9+z)7~U-8 zXP5n|GyJikU)&?!-kxXAlcN9fnLI$`W>aC{(O!s79EN1*%vxeGygWNl>jfpCdmg&ZxIKCgy3FVC80ps`rOkeb2@9tn{D86CfeSWpqBPp=5211HY~nB^BXPanj2(^<99)s!nUkAptEJne0%;7gj)izIA>0a^i-d()wT947BP$H3D&viN9~3K}ju4sTl>R^_YTx+xHy5op2EL z;O*bcHotr(KRXrIDTS&0#VnaI7d3FP(G^jVVta6iO%Z`qX8P=Ey(O-N(m3mE&rIyM zXTkq>*Z|PJU=W44`%m|LwB)+L9r;Vo8$6c(FP%3uJ=;Q}a;qJX>!K!>i&)U^;)n$-{8zppB;F3LHM>70XP@APCq@k}Z?8tCwq7pt<$Pc- zuX*EUy8T+vMOeIAj~K~uN1tJfrr;$iN2X}8Sq+ED*+LXzUs<1vd^}&?C$Zv2Or^xi zMhdgv&Y)J_9CMb!Rup&zEZG3TtW@acwXrYUO)##!&M04S{S>w6xvV$By+|~omQgtJ zO8sCzA#?|&lnh)yz{cpuulIF=&)jts!6=~!!%t|*5D7uhFkW*T^P$5f*c{FFb&-~W zNkt+nO$Gv77v+-SRFTxVzR*BkB|v)>?uB{ZFcQH{FUCxM6n^=lq@ESymEQqef-2#H zfEM>2$xL@-+)%{iBuCTo)yQY8V9--OZ2#w_yT=6f#^0O$m8Nsjj(6zY(#ZGz39Y%= zp_ZY(qr)k!n^{!?7D!-%oPo8s0nyjj0m2RbrBow$rrt()b(p4lB&@FQ7ao7R2{QxX zBHIEXPm>h^vAd%H^y&??=GkpO!i>=rLM@r4Z0P#XoBONyo)$=-6jqN#?xNrZdWD6D zC*WXxZVNn$9j=`>{l41PgnGrf2O}#tHg|Mm)`x~ve^HZ4pG!zuRbAgH$O};dH;`HhGXkX{H z5AU6h^=*9!Zre54V(XKkLj#G{D(f#jcUmTOwE}@oPiacx_hX}zT|ls383A)oJqg0k z+*tab({p=39}7xip93`OE!_}RdRYg3F9OO~nv4tr{i3D?`S()lE?h=V7b!*tk~1=gWSTdrcsw!Y#1*Ndsx*i>Y<>#)t! zKWOa;bW-M6z@8QTtm8s9PuuJweOjI|Ep(}^-BG0$W%t-1Q|0rZY`yUtrTA)SrJ)j= ze!3kOhbbo2;W2^N{U(5O#kY+37$=Rh(|K&;u+8|7_e!{Q?}C`c7Gz-==DdEiDT9Uw zHWRQp3xNIomnyqiV-1j3ax z1@@~J<`nO2Y%hiR#<=EIRoKWRGW_MT`r=QDf6tIZmVj75(;P`=#maxGhOd}NHZ(j4 zFQ;g#M@MRinMs6+%jB95XS|3sN75%^S^4b!|<| z=Y73G0la(Jh8s4h*?`}^GT*ouvQ^6-i(mGc7-|^$*MdH!v_xEh?x=r~5G~8Em~?#L zHJ?eoi+Uj-H=*R2f1w}X92mTI@prvksIFvW1vWG|R@5NGU)9AFrN0dA$qk>HcX?2nqL-)6*Ho=5 zGhSRWZz$FGH6hdG-vIq&pF(OEr@^C=^$=ui#XL;PdgCj1H2sEcg`a}v1Y)4{UqO}n z67iIDRCYaMiTFuTwEI2Z9y1xid_Y^k?j>f0d4G_(s(EMe50AD^P&H_?Ej(B)4t*q& z)&js`r<;X%Xizv50_7y5+#2P=IU5Cbzo6ZX6U%jB_Ect`s1HLkB@Qi+WN3qECqA^{ z2x17sAaRPoE0ZolNd)HNu*o}|6%9UAQw8&=BR-<26vPx*j&Lnr8c*}|;zuh(4j4S3 zAo*`h*0~;-fRHg2G9gS`fOt%t7Fl`)1<>^;K2x0T?wb;j=7BQ1GT^n#6UmT-a>1h` zyh{f~&m&N(LS{VQ79`RxuxT< zW^s6qiE%R~=5m%!R@%JvUPU}G>Z#d)`vC37h=f)_2$4XruODiN+MF{t%TB(}Vqnt+ zA!ZSZaWD)3r6CMM5TVZ||TCX2)(Tu_^W- z8bH8KNi}9wz|KA$!8Pd~E|H;Z`Bs=E<*2`1L!_?ai8dd`P6-jTj8US`sR6qgbYRoJSGaW(Y&)0ByCT4-*umu?o`#>jWjRzv+~ zB!lmAKWbQrHH1cc`^{1lJK=gZ_Af%_@*dWh-Ld10b-x`j=&AOX)@Qv)KtB=g#V`a4 zzp&Or8g&zi@=}x@{koWti`f$?%e-PK#RP9wv@~Z3Do2M>Ji#xAi&KrHGQy18p0X;b z#(3$qd6vgv+T}s$+V?Qp!y>ao3U1oqQtqzkr7g0T4_~!~(Dw2Qaf$;>H*9$Ji>6N- z2_u|8EN{!iD8 zbKhYwJ&rchYxr zntrHS<|u^$vO!vts5*~fw;xMBxDT(pL}w#W=iCMC=J|tJ<bLAh9|V3<0h6p z@+|bng%xbveze-95t$HIy*83|COr=a;aZUVI!a;E<8?uW=6FQ$QOeH@um;xBE=VjB zs3g=&DQO1>M{3A7`E#_X9(b+l8FXHFiiL>gg&|c5*Ui=rH~+5;2H%wN&P!W>JHa z!M3i=OW2!NK#R|zDf72N(JzjqzLX;gX|r4m(1hm5wb9ubPEPXYSFL z6~oTkn2}@Mt1&TtGhT9BfBu8sFllzf!(%e>$GKX8Z;4YvVW+9k*Ka=@4N^I}#@#(x zW--=O6V8_KY8E&PDrRCc4dWcL9h5@vF`2B+HZ_cuns$3E>P*-DYtA2o^zhTd``=P} z$Tvfe6xg+s`iGo(_vE;$)cH^p?KWdN&rx95=qis7`Y+qBULtyHFJ?H)%97e1Gk@;slKt#+GXX|szil$hT z*W)1ANbD2mbR`l8tEOWzXrUCAM1P54=dAY`a=C zDYMX;aeXO!icZE41x_Gg5P$+)7+zasA@&wvEHm^SOdN}c4@`;1N*&orz(vjU{1}q4 ztai2GVll7%N*PkWSuDNmU+o^VASw(Io6Vi9Bm%>A4!92+D~DtEE{5s!%U z>SRol!4!nKJ=T5@jw-11GFe01Qu7R!m*eNJYej&H+NFU%Ido9H#l@XU}&+;8E z%}OXjk0=Z~?2J>4fl;j%!<~va=gY_C-TwNG`{oM87i={Y%qGN_3FJt|IL6DRXpQmt z`FS(mK(U6Fcw$E}h9@;m)&i`d-QT_c!~J$Xyl3V;@64I=oOxyjQY}_0 z2x?06SrU1>$-fn!oP_d2HE`LzAekN!#4AxwVXvb|4dJmYg!Zb~i~d}C!?~+yhhViE zOifNcuy{#aSf;vIaNnV!Xim_xQ#!GutCre(wTp(j%sfsrBV(7W@-LA>2(ZE~ zi>dDK$S-2O>co0qZ+Cn^@qRycaeev7lE5!TcjWV4ZvW$R zVMm zBUu3WB;=@&u!{RP{IIq&G4hIbN@b|W+Klm9XNl8=Av2~d0-h0?BBm^^`dpL%jUQ=| zqh=Gx)lCJ@1NX&-U(H`<>w0f2evfG4@UcsHC!LbHRzeVQ@}aToVU)I$?^mFNgq=Y( zIJ>1mAimy_GIujaAiMU5v%eQ#@5q($lP-G&ZZE6%Y)SJpwnpRV2ktp}eGlfQZ3($W*P?sY_R+g@>)J#TcP zrU8{q@)yM8*0-x6)(&*qH10?S-+wQR=Q-8}R$jGhF{)*r5T1X~n<&4>-%E}cNuQ>d zmgUV45L4j_9-8geqY8M-jG>r|V(g>vu4uV?iByek5K3&HJR>M08#J(_L*_X)e}8UR zPKc#1axr9uWgd62p%gZ?UxndCwySCt4DVqZQZTpSpDD3b|I)*-6Shw=Oo&||bp-%R zZ-59fiGC2FLs}vx?=Sop!&FHAt<RuT=wMtJcw_*av@Gd6ikrnr_@?#Y+ z@?#ZDONub6$NVs=$FF$}9$;sqK&deDb*O&vGGSC(%wiY^k6EJvUMvaYT1W=AEAtF}*@4}BFp&oT%>>Fkw!R{_ZQI9ghk&(%UlOYb zk>yvgeDtYA`8(QlrV>?27f_C!b?~`nzVdgsc_+6y59G$TqX!U|ts9AjU2q&N`c7J$ z|C%5A()jp-7xHJ|w(Ck@*(eax%6)2V{=a%dyBo;2AI*r|Ahx-)qkO*5ZyDEul=xy@%y8%E?<^Gt_x6*aCu@RE$aCs(Z$|puA zi&ZGS4sfl_{bko}G`?Z^D)odccEB3itBmlI7|+dkB5*JFgBnP3;G}p{kqb)%F;W6H zb`LW1K8k;t=MFx5OQqQG(v(sy38;FAE6*{ZOsx);1()8<_s~K4;?`5Xsiq({)eJ=u zGkc*_57Tr zKPz4%%8Gg_gaGC3^e1adrvNro{@r&?bG(I2!puX&EZav$1V`~*V+$hBzpm{YEKjB7 zY}D->RWtP2<5U%Z7v1{hVm)|m>lGduJFsS%q8(Ln=F2I_wa7v3yXkPQjP-qWd`6^t zKCDs1zzfbbN;a|nKD&4L%h`dOWUv|ZqL8xp6YcB)j7<%-Z9V?Xq@e@T_9CEd@8qPU zsEE_*)6{tM*t;txAHDe^;C7Cb)#`|+W$ng;+;KI^C1C6C{FLaY2bI+|;S(QV^%GB7 zXkWX66Mmyk(u4v@{*n?-PMTRXTA-U6TedFDInvEy&c>x#sAVG0UAiuX0?wm@KNa&| zF^xKRz?O~&a%4lj+H&fy56&*fvhW*^`gdG9=_if~Izk0S=R=pAJ08fjpQ&%s2-s$N zB+)t!paahM=4WSAKTBCEP3GwaV_iKfq1!D(xLIOoL|4d@o1(9<3cu60;6WA?hk21{ z@Z*x?hITBJTg~8PKaWmbIO=A)u9)+A&ZKz6D*AG%WzKREs!Mdth|rWnKV5cT5EURO znv9zc(+EID%MH;}yEWd%iEXdr}626{PD4@qu)wcoxDh-F|HCtb4Fr z(alyZ!5(dIiKgLS-v9$ps&c)JWgkfFZaW~3>IAaLj;=o^@q&YRN zzE6(s`bgKemC{>~oyez`GjlGzzk{#&1TU|GE&tY&THMZ(1Z)@ucQ;mQHVP9(p3VLa zN4Fm~GeV+VKF4E25+A1jFJhs$L~*)R)l8gXK-DOdyKbQ5GyLP*p4R<)``0kxsZTtX zD4bIf3xnht7Pua}*P56)N^smflhj0m3PzullKdI(Q!BH)&DK8oS1Qsva;W2xJ}NL znygwpX1HGd49UqJ4=+0ID0&N8M!J(fSX$vgI;s)&n+ySBZGbfiW z-35TwZyT=O)V^EMD^-Ei{Wc zQ?7Z4$nF*Ya5tNkl(tdjojJdsa%xOlK+qGDn0`Bd%&xD^*=a0VBjYbyRY!KiESEBs zA}oIbHnk{UE(_HKOo+LS~Pl}EG@kUHJy4MNQE=VKUUL1e0w zKhmkM=ZJONCZWb{zj`H1KpQi!qN9l7T|m%k+_C~_c~bxQ9NlWe&PI~)$)X3a+_uei z@b{XI#unJ`??YRG^82zcknRY0wjYK4kSJii!q-pa`1lS|jsL)u+x_A}?&Y72aABoB zszoz3?Isu%l%`&2eesZJXSjM&h;zz#8ZPmAfymQ3QHw@TCz|UCWu=Y@V1Lgno64wK zmATlHXWvp{w6vS`wXp{t^YTK>qx3-=xw=-X@ zX{azUq@z0|Bj?Q*vG;n?hhRRZ7s%tUg?a-SXYy)=wn2RqHO-72PXV8L-l)p!0l`%r zq(UQraZ6f)hkEUQw5m8Qfi~7`a}v%lpy6K1&6`b7&N{z&q)_0U{^emH>7VorW^1B{ z2D$DuHLaIg##@aXQvN9n8RjTAexB2Hq}&zFjR?nxP)wEY&Yv>OV3QIag=0$$E@$(| zT;O|Q7G-`n9kz--5xTrEG7m|!Nf;r#=Sb+BRd2>I))2RKc{R}mH%DK?FGmiWdxwP| z)<2r-MCcovT|xo~aH7-6&;NrnllXK}sB5dwf}m9y$)IK5a>~m^G4g2-LwHpqBc?r_ zA3|IF!*A6yn_QwMq4o#k`AnBvN;JjCd5$4zoH@>s9MQVWdA=>wyuoIN#|opm^e(*; zn$_IC*;w7r`LJ`|2$ld6aq5v(C2AFXqR|x$Ff0RN3PWh)&&*K7bJddZ6j+0m2 zSLFmEMq=DTim&1`3g>4ZuW~9vl($&n=8%u?0N!)74fllS(Pc=+&P;+>4Mb0Pho1u6NU21nLmE2h$=f#XGexWyEMmrI`RbhH<# zT!h5iwiTIWy-StASC>P#NGop-gkHo8dF)p;H4+0LqZejoB3oOf@GZa7%UmzW0P})# zMm+{KH8gxk#*^#Gj$~udSCc}zQ{zS8mMq&bx{YKR=!fH^I`1yTV}71dhMvRjcyzy& z%fIz0iQmKZ{j1{;vVrs`-bJOq5Am)XWf!oZ8EkY5YWrx-hWX@MVvS$d>>2RCalL-XjjM-tm)P8Cy8uEKS~+Nn}y z0qz0QuOhpNVm^GJic#XBC_Q?vub-Tp92yn%@L;8bp)A)uPKB-& zJ)Aa?IYyG}wlV6#{ALq8$jeOP*#lc0ye8ELG$wGha>F~H zFvs3Bq%y!#S#pw-R=IUPeW2up&no*mw}#q%1SyG}=t&-?fV4F-B~rhFWXq5K`)PR; zis@8mhT|2+37Iyiag2@-0yjCH+bAnPsHm)*oS%<5Jv|)>dy7=)>86vbpMnLqUB&zC zrJ00Tm#-O*f~yH6g10G$#UC7>E~*|6i!n^H5cO#733UAt4>&4?bNqJb zUm+&l&~cpY+aP6Se8SGvhKoS&!i=AG>1wJDKcyhH7@b0{CzpW>Cn%!^)_WajJ07vL z>{CF-iZ=5z>jr<mZ661cIjN z@l80jj?tBk(}%rQLhXQp*=(cy-sYeShGIb}Vu@u}oSKdUKm-71mocGia(N-@hO2Dj z8W~K+;)gJFy>J?ubGc%FFEKLNr&6&9Y(LqoJ&_Ccr?KG^8a$UUgAZJNz8pn%MJ)xN z8{t}SJ22XToqQkX-y&-Zc(P-WX2Cc$T^Fx}y$*T>@=^RvNsI&MPY^>HU9MtB{w4H$ zLhX;|%+aqm3uxuq55W!RK0LATcmscp+y8z-2?0Z|djFwrxp{e|_D^Gr_go=sXIDU@ z(N)gUhAKuMDHNGC9VG~U0Os4gIg4s~@lQI=?KiQ+8}%3MF-GnF;)R;EUG#S6UIlX- z(F=JI_0X(vG!pIH+xpSV_<0Ls6u#Z|$8VQM@ZeaRtC7XhaZ@py+MqQt0y!Pek^qz`7ne%7qqhGzIdhN4DI=?5aqJGaQ)}ZLm6`CqxkDtCA~N7aUwllhSU9yF>%d4 znhD(YWOX@zSpJ0J+q9)TVKwAw_yFB$LU>5Ad~9M(YET{Dyh>@_3F<`LKu<^g$B`fR zmL_DPw)p0XIG?}s%3x!TxANB63uV((N1^w2px>@T_)+6TT3NmV!1hK$^X5ZQ%WZSE zh_RnpP$vh3is385O1V4yJ7n-V zhHX!2*TMF@0Cra`a=Q1HU&Et6a;oZcYcqR`m&`>m23{Zz>BOu$pDH15Cp?(*wQ)|| zQosD$voS^umChS>f7hQJyQBb?p?=v z(Y5G{=8sb;6z|DScny@E;U?Mu`UJIXT8>$_V=;JY* z_&P~{fOC#-k34DoOk&?ZlZ31JMjIxYWp{~{cUjSo+TOF81k>35Xs5E0QRUK=yMVNJ z1w_VnPGoL@S3LAbH4b*O6R(ZChC9vcDbTlWq&08Xj7QpEIV^mAn*dY!8MJTiiaPWl zU1Zjm1Zp$GXy*b#SZK|{2JO+l&EV#>xeF*|*@`7IAn!$dw}`yOd?bDRKs%I?1SFNx z>zxshu;V|*HemMQ$3b64rL4+M)1=ya!~pW8L}7{V(;#BlU`IU7dhTF^H(m7UztSmi z6ovge6PS@4nj{076Sr^w;G)4~M$F1EzPgQWaI52{Vr(+Irm&|Bd&({FWNwSwWzaezTJ009||t}POvXGSdcuf;QP6F z^We4rU+sUUaNj230VaSVAI3sKE*J}qWoJKbXl(S&f5r^W9^+rA92d!o+z@B_pbLqM zEz6H^>AJ>cK--uTnt&fOyn^%Xtj3jU-X%mmo;v{;%uH`Ai+zn*q*fl9=BPho;t%v8 zZjZJ?c}!O2i0r^Algb&RyH>vukFJ`8Mpmvo8z%B!nFfx<0d;eB{gHlV8zY&47cj_^ zHu_qbPC6b+6X44@F}vlk9GCX-l^j!GCQskIK2-5tCvlm%46TmJAD^R=xs%~=M}9s* zu?0JF*&qN=r>nQEI7&{d=a*{6+QN=`cd90HLn1FLg-d^<_i{9hr4zofp_-m1Et?$| zf`6&WI=xZ{GGbziJYBt1I4n$JiT1#^^e|>qgRB*1PcM+3oR#0 zUV1_=4d?ISl2~-$$B)1>3IoG|hj3k9nXGN)XSe~Z7I#zE_?u{PGro1& z&5LPCe+H?4ci$QR__}mN$bY#k`G$>{#2K->d(7O&z`&rYl1>->U{=4h=WI zI|ef#8m?rbrg(-CDbM*+j!rnH+9(I}FiPF30E$xh7sE9Cm}g%I)G~WIgWq=G$ArLf zIki|UD|yMuLM;JEff2soO zy>dP`G&OiRZIaLk5s|BIbm$FR8s*1EO{GtC1jUDiX4X!!Iq+O<`qyq0o_yaZNi|G3 z&nB((oy&|3|8EtQ6#QsI^pzS&O3u%u=;bHFZ;G`8LGgh!WBiIV)HKio?u|!{8hHtfKh5Si$Nc3Y%6CF-_YnCK^vRCN&9? z5#itCf`5xmd|9_f4xZDO%45ZHYXHXBALW1L(Y%HON*M60GtE9JXQg1o$#{Dr1hZbb zcf?`b1)qxJzHQQYxE4*8iRiAnQp+=Nq1OE%17UsUsG=c3Vs8tbgwynx7$ zt7GCk>T~)>E0(s8xOTs)fpjFe(t2-Os{VWI0hN$n)|OxsIzbd8y8=iB`ddav7cyb< pzxRUy(9Cwh47XNagejWTp!`Mtxxzht%xw01>dH{18U>56{{fTDan=9; diff --git a/static/img/rancher/flannel.png b/static/img/rancher/flannel.png deleted file mode 100644 index e53612209ad35f82a1f05003f19b77bf6db56bf1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10455 zcmY+qWn7fs^9BqEQqocaBC&J`C`cn+0+LI2ce6@LE)5GyFGwR@OZSpXBOsj%DBU2a zk6-oof1c;fecvzcb3Sus&dglb%z!o26bSI1;GvQrTa&meKJ9s)ex~+UA zwW0Nr+pL->!o4P-hCm_v!K1$54FR{{U$2(Y2YPJj&F-$+l}d~&3sXxKl^+8*G_>>5 z<-q2OYMWu>J;&vydcNN3*Q)BzUT$|Lf8y+Tr*rwTtrK)vZko!=O8D(Dx||e=2Ik`s zWNh%nF1`{O&+c=V89~_-{%e_8PK@Ya#ylK042qC)TQxaN(!*71LVQO zX8H90q|!qR(V3Q)zHjhrBl$2#2991;s75fe{eOh>QsHFI2m3qv4Pd7BLJGybVvw5%VI(hE#s>+A;|3KFF;5a(7mKbJI)p z0li0MRc0KI)$5{iAoO}A1jb^~BFmH3>&V;jL3`KR@8*hz<7eY@ey@k`uju=}$I(m? zZ~B&~{jp*>Av!4u>vIET@6Fp@Zq`5p<%ksKidWeDT{e^ngYFxnO6_M?=#PJ;PcV?g zFea_nSF{*mw1pwAa;P#?+@??=Qj>|Q&NCvoo)}|?kAJPHq^C{8UJ72vB zI|Z{%?@p}yX;F00aZ^!eNd*Pb_rA_0Ud9|JRH*gHqhu%}&g~4VXL?&~75YZsX_l{)BNW3-k!7K3>A9lu{epRcLe4P1&W?-QGC8}Ju!FZHkTXg2 z$1kDO7%?oxsw|x+E$^!|ko*8<-k zV>ds4WStJ%M!K^@UmqX~{6s~<>1ZCF+^bY?!3Kk{n<|_J!J&7j=S}JxkwJI9wI5kO zOss;)+9LgLItH2i-p{MN^5^3zoCR-hzcN{Y48&tU?akT0bGQ3tav+%|>lr{nc1r8A z6e!snSZ!LE2liw=g_w4I(D+4g)ANa3r;Eaud8qig7(ckxO*Gk(@?_bQx1gy0fo0v} zh0oq}fs=Ew>Z>5S_e8leuBMV08C2s3AeyYBFClGun5U!FKIVhhfx)7>zKZYd4?rku z|Bd~=HOl0`t^Tycy$+JDyAy7zpPSENfwym%dn@-`6U;UX5{T7{6LGz}kI$Ke#iMP5 zI`B)ZO_9+sT?EU(>7rqG-{NT zfRdDQVtsG&u}gp#gxF@h-I#)SIwbbjtk7C`m#ui<#h$obH4!68M_8JvKYFf7a!IHJ z!}sg8{tPcn$?qFYlM9GlQ~UOoeXN63U$lK#yXg>T%&;BlTHrQA#i6}S09~5-0-o$fF1j)73_2UmZCrfibqkb3V}ekNHNzha zuD%NHxil2lWSk3m?$QC`ln^@;Q!~w!*3I0b1%gEdi6~ar&xR57G*5dcV4_$-*Yfu{ zt}Bs4qvY+ILaZxzn03)8jEogofKqDXjR6f6qMyT@Wv9N1NjyjB~h*g1) z_Ko>nXcLuYKD2c}ce(DXJZ-=}z7^&^eqY))NE!HN$12c}T!Otgb#nxcH ztV{E;#kenAuRi_B!0Qe&W=c`RgsqMz^2=R^ob9!?xj=ONioJ7cKr6{a~WwVc)ka zUD~4YIvP>Mr=xWf$@kKJt0}H8A$HPs1h;$~$Oy=clB~g}<0@oy=aI=mxbHEy9F|%v z(jUD93y!=}SxQ;)zgLf{3vzqV+LvqgOCi_n3;{Cg+E8l<7k2T5;4~_C5$IFW6c7ps z+JF^xp&Bz7RxC`>{qs#eTdQpbQ_K_;uKZ=4arvcMmVdH6mjY(AQw?*+IT*`b=pl-F zCf&(y9dl`UE@bCn#wRAaFYXgQVs6#Du4`~y$M1IbLkMn6V#qbDVynIs7DYrK5J=j= z`EY7#A>3rj{iI%t3fPF3VHfH+Gov=>mZbAp;mGZpN2S$%#%$AOQK0}osG5I9#sH|&}g z)VKXa7rsnMqnoX9S$KY{LAzu5t~o%>Kp8Vo>XW~4YL=nKF9sa6jwDU-Hky9FPP62` zlQEyjLLw`2Iuy{fg|&crLK#VfrxczPJ(yT^jL=$pPer%!aJiXKYkM^N7CX2l#z5bFQ-RoG>nn9uqsbCqe+^b7BqL*J2enBM8WZ4h9h&_HhY1xvDo z*viSTXx3Y zbh_{}+4yz=I`Yi(S^PlJ6J*-e`k-XM!^1J}C^<`2A~LM{@is-J5)UW1 zbO`FC7v0)?x@+TU5>`s^_4hP}&xG{bI{%&${yOA;rCM_*!-5}Q-zUW!| zRcRPs(UfLvdCVtr&??Qi5R3a#KnO>5n5wR)wU?^mX+(=E-WKHTi(%c{=b}J2;aEZ< zq-P$V)em#8VV^VDJ%tYwqe|jd8VhlSqjcfNFFT(R0ILVnx{ydqX?R*LS$i>ry20nS z=<>3tZLp2~#0%DUJlT>7_yuHVV!T#oZ6b?PY`pC1CZwF2@ChNI)-|P%p-041~IgA-&T{Q3r z1{M`T!I_BEvxU9>GFr7bjL1mO#4MT%Cqex5h(Gce0dV{6Nr@LI#F5c1P1mZtGX;V-Q*Ig`{uuq?Havy~{~nc5`Uc%m6?3tR5lxzELT|7el_ z8yr7h32nROm)>E9$|#%UxQ_middZ0_!kZ6?1>y|zUtd>s7^alBrtBss#nrFj3d?yJ zxrBAtaTQf8Q>XMu)n^mKc3C*vN=@vo|Ct9M)19oS6Asekzt|dBX%rpiEn$TjzO$K5 zsBJcNkwIe#&)eP%En;9vQ*~loH1yu?oUVv`+(E@`p^^)Y3XG1(jiW^&+J1gKmE93>^PjGz%xP0H|Feic{M4v zO8o@Lt%!8~Gh$T(o2~X1LGHBA;oF*RqTf@c|7pvcVvO0eN9=g=tC|*d7tynm<=*p+uSHe+Ntgp$|Go0Zl z`bQy)NZ0^HjJUP*a{LyZR1Ac|pv!hK=&dz%LW-52J-B5UsLFF&<0+V<%EHGjgk&Mb zZ5a@Cb_vc=Lp}HBi~LFgie!f+A#bI}Y5v_AZw z8(zqoLC@;y3VM=Bx3sjhsHmx5`}zuf+uwhquN28_p5@!7!&6}Y&r0Rk=msk7fUI(> zT~vgVNHS!f3+#?tZS|8^srls&JueqZ-$U6wvVV`QwXHQQQ0o^ky@ zlXMbd+7*7D4WF8siQCvPueYGU3y(!1io~HbwiRRpbb`;V=bZHYj`0zQ0Y$Z1;AdLC z6nw#F9HKnY@Tp#!smy;~t4E2^DfM7lUowBHv^JlMUEgBFU8SW@i8d$ANX(VWf{{T# zhCL^Cqa@dReX8R`)W*I~{9Vs8++5&rT?ljMU4_($3TFA>s7NJoYqr>oUo67*y%< zd$HR6PdbPNK<<$OklIxX^O~9}T=4yHFExdh!PCGv+0f?4*VGoD=IooWAJPgHa7m;Q zHg$3ua`L?$H{p^q)}{Aec-4kzD9;6XxxhFl_$5_Pzs`6e)^oL;<$XI@qaNYmz5a;b zOjh)`!M>}4%z7BK{~0g3`%F47B4}!y*{JL|Jh#BuW2C$x^9^W2#)A_oP@h*;L0zrZ znW?BW+F;#Jp*ub&mV>(Ns2ZK7DFZU^dpxZbkwefV;Q)=PGk^;Buia!Y2`K0P(=~Fq z+}<&jV4mTGD+V*VC zEWjC9bTj*O0LA`;K$jfA^DOvBa&~(BJA@XGm8ZpQPGp7SzF|Okjl*jb>5*Mh_PtLG z(zKPH`GP7ka_fuoX7Ou~+khpdNUa(Hd$RQDwO>XkojkAa>tDBcr>4XT+EvxVJ?4rj zwwBNQLkd=u_1|hGc~=tZ&Fziu*Wa?F5FPQXqvKI$pbZmwE#H{o4ktqF8qfMEV)ybT z?xD9-b*Hgjh-B=S^>62Si(k5Mx;}dE>-!n`gYKezFcjuY==DI|X(Yeg1WExg?hF(* zTxz^Z@<`3DJcia1mA?x)US+n$i0F`LLB+&Do^v*~0Xqy#e+z}`xwxR$4wm||y$pZ*ud(F~C6WHreEyavFZ&aeHH$#ERccA>9tOEXD z`k&0)%X){2m;n&{H00a(6ylh^mAx4SiXYvnrksoL*s_6VPje2tiK-}(eF4Wx znEr|zT|e>c=pSw5x=gGm1j71g-hx_?!XM}MNWy1_M&McpNtB+IMQ3#_(;m#v1XY55 z4Z~l^2Vxwk+>{%<@%)-uxqQ_@T2((g!~Z)XG@s$5gU0TGsJ?r@L*C|rPN4g564L7A zZD^7%-hpBBUWZvXksWM65MHCf>gxPz7LUJPPSIWr6{$;>V?1t|jcIMnXX8mhnOP*3 zkSG=dJ^)(qqb}=-oR+z2mF)Pe`H;H4BTB?mToI_01qYR2ZVy`pb(M$5bV=m`njxFa zx#wG&q5+ z*&$9_>A4iE`OV?9Amz(^f6zw=ERMM>v}&>{?X&vtBLX9EzO0qq zzIjh?!dui0)j9V0Iq$+ksJ=LNs=Pd*$$gtyl;K%Op;?lr$pJ~J=$Eak*|s_t3pCK? z4Bv4ov^o!cIrT*rB!IFn555*~UO>Aqi41eNqcJdYiZiYSu-6fj$Tso74DxJ*#vuM}jVHac#?Xax%>z0~}-O ztLF}Uz%US(P-2Rr+7-Z1U6OosJ2rE%icuRl!dXWz$}oN5b(=A5oNoyyNlGZjIl1#i zAItw*YV<5Uk)##Exur|KPpwxRi`J~4lJ_C%m#3l)(wPm+V9qa?&$)~eT=hycFgT0eG*D(CTj2IS-j+` zUS#RPlxYy%iK|a^KPzh01z(czsoHviZ{+ioQrT)7OaT3np9}i~fQtM!?tXh|VT?YhZSUuiNZogV z9~bVsIiMs9xb;dzu9NQ=z4?m1w5Oxk!EvmGhW1D z`7`AS0UQf1Qg2%jDEl!*l=ep5UI`u z%jTl%Ozm4`FtNh9?+Wb>>XZzg-C&+RGjej)BIG?%+brTmy)Y*E)!){=5-PDQxTmm- zEgjslSWz6^=RE){Gdll+IM@_|XSS0?7yxQ=Fr9%{ZxS-%L8~bMe$rZ+F|J#`WsR~O zRpXd3zKQfwgrI|TG2K{$ngI$l)^!IJ+s{zjNbtFJH#zeCg?BQ_^>?PiMqmITzk2O!MjLM&q^HYMbLJ-}ki9xaV>yXo})CD;-s; z3w@ttHbkJ}c<{>plxfU{N!)f90D30HiRXrI4j1eN>06hjQdQr7#KogG>8vywGSMhB z<6BrvZBF@tGtwsiLz-B8WqF!z5Pd<%*RzDE7L56GSM;@PIHA>X_p(|=xgO!|X|0pu zI-y8waJ#Y77lcY?{dYkl?E4M1h2`ha-g9gWD(J541B(r@#+SS)M2fa3jg(N=3ZUWG zhp`5G$(SFx#iu>8U-lEU)rKOXWM722*FIXYHPsFOOK9%l&(=LY0E*6P+xSt|_)2M9 z?K+Mr$7IG-4}W?QogC9AT31yPG>3?9$;NxOkH(JWk~6 z`L1nvPHJ6cC3-4_&kxxiNN4>i1J|^1Tfk-lxlj*-H06Sh`9Wlf$hS z#qucw!CdM=3MZ?j*|qw)9C_BR;IJ~EG4Si1Xso?H5x)M0ekVz^YD_r42nuq3Vx#*U z<<6e)PFX?%{eCSWAKSC}{GFsl9by30KgGVTDeW-w%jbIOm5^N2 zu6#7r<(u=%VvF~$W?L=KTRQt562bGoH_m^u;H;^m7nOzJ7@q zu{B@KKh3jloyg$PRG+}@QDBIza%4(c$#Qm`d@)7YG|P_i?e_NzBaxhlOUjAdp4|4X zhqhYct6w+!g*&8l#pFUtSWk?Z9CK2HwzUQ14qAmD-VQKnhtAxfW?wgf%j=EK^q1JV7Osut|G(;a8Y z&S8hLo>WP@`VAFqDieUglm+=**Agz`Bn&}oxpB#;v*Zzbdxy8<24UL0fxkT`u$(xN zzT4^75sKAyC-Oe>UQrpf%fUP7!E;NELg8gMBzaG(kZ@b{q|Zwi`9yp4>w*$rC;YVbX{wW7%=xt7#8 zFIqE;&+GfN-(AXEceO1n+qIoWh)1JRJeerAtS=o1@NUOd$Y^O9> zPC>tbG@zH5Sx^f$Z;m_oVMK#x{iRj+E8h*kSsf{r?IJPtOvH9#`(6Y~A*^954FhgT zhXS>Rw+Z(_XGuLg%}%RR4ID~ie-}lJ_Ho>l>(8NdoHL`Q%C?s}ON`_2_P{TzelKtA zJCZiSzP>_|tIZ|L6Y#afog7C_^L&X+CXP4k_s+VbC(76 zr{MeWF|o8qBm3#^$oUC|b%$6LQ1>qQpEbS#4L&-&9y(NK&|>;qyh7?9Gp8Av){6J8MSe0ndmy+0X(XtOM*ESx3SV_fJUm6 z;kKCq{dM688!ptTm@tpE`-1a0iZef%UK-x?VkQ@!GDs zH$u6*QCk+s-fk(EPQ3tmJC&!VXna8R^V8HfiqZ9}8=8!=4~*(oxXeU`a(`KD!dMPH~Ju^RGjRGJf0dKVXHqfj&m8?` zw6vlIE%&~C<6%fK4uRj7d>W1r+BzU3m@* z)6R35fu2Gor2mLNk^tQ|aFfPfvZ{FBBItt_z1g_c)#gVLv%C_|4mx|pk5o^P`DJCf^^ZyAe zOzZ~z!a)+nK$D~dfYezCMhp)t2^{-2Gz~w*5th;BDz(^ij>1vy>^eEn4$Uq?$P1Zi&5`a8M!D)2vj)t7;_kEW(wtF zU~i$C&847E^?PPHG|0rrz|6puYt;SiG;H)t+Try^Y*Knt8t`VAc1^z5u!5{3@ch11 z%!`{onPM31m_XpI-ymo+MR#hcJbssMKpif8_%dd0SvVr~#OE2UBgS~GtT)JpK1O!n2*Nl9d zy2SH!h!#w(0;*~UutXS*Fx_r5AGqwaT2LfKWQ*Bu0)nhq=CnyYPG_3`HiEIypFBAr zPzpysepI!_anO~u1Q2I3~+)B-7b`%m|r zu~LA#8j#D-s}2+zDIxAKaRQLOojh9?=lXGadWvD2RavAJ7Ym1VWCg%VslV8H*Le|I z52Nv&ffJtpZ{EjW9LFu5CpTfGAr6wbmkwV|PI=RY5*$w)|8}YwbH_!j)$(L%*n_`L z)=Fm1a|`wEMde@buJI>!!$l0N)QF8YT+)Ucx+qwmJH4wlH)l`Swn!DQTHIM^c8;~* zUv3_o`Hu_x)j5F<@mb+!nlr(yZeFV_}-y^5qfx(tkn6 znm9d1Z28P!6Fy&6F=iM&Net1kqREIeGNLw|AaHKUD*2zeQIS$bx2jeqrb;rA7MQ49=ir0wh3F>WoDyBD*x~1 zl~abCfqv~jQPQ#CIG*(Q>IUlipPt>E8P;=NyF14zDHQxWBKd!P9P%L0qW50}EQgtr zUe)iaGg$cF58XPk!K5=f_bB`MzwI^(l68DI12wSYM)y>FQx9yKL(~RvBAYnN6jF|= z_`jY~9&Jd26)-o+Pw*I&DYN0__Pf6Vk*-J~%^kXH4&!1C`AeJr8%(2!4n}fsQxy*j zZ$CxK4B*w_)=^?5Z(44a^v`H+T8EpTLJ`cL{uR!pNYaHcpq4B}EW!~+GUMhF!b2xX z0Gc{-0d`_?Nd{Pn6hVp(VfE6bNB-qNzcW1#? zRX@$CLdQyJB*JMS)zaYq-IW+qQO&C%-pIAGj5^E`H|k@YRtSyl|L+GbzS^qBJg4Qo byI&c0)hLEB3#{LhifBr5YO+<*W*`0^t2f$r diff --git a/static/img/rancher/linux-control-plane.png b/static/img/rancher/linux-control-plane.png deleted file mode 100644 index f054ae144da17e322032ae6db5345ccc03059cef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 84856 zcmeFZWm{ZP(k_ezclSnuI|P>|xO;GSg1bX-X*9SygaimqV6?(X(xW}bOYX5K$= zKAcZ|?cRIWs=8~fb*-wpYey(4NTMJTB0@kwph!!JsX#zL-9bP=_Q1pb`A4PMj_A)1 zq_c{o2t>sg@gW3+Fod+&XEhJVlPtJzI=ywF{;uWq_h+sw_$DTm@(l?}B2r}MmzW}6 zzB^Pb2p1~w!4Ou$P%!YEaY~r*dH3c~(b1iTM962p-scSE>aVZ+GD}JI_(V1});U#m z-_Nr6cQfK|#?v^Qd&?P`iu)v1n+3%aB^*R=hkGG>r4X3Z4K%c+@Zww~P->2-KJVZ6N>{;Dh@)*vGw$ zcFTn2jK{dK;lgN-(o=&t{t35+KplkW9Z>M!%0WR@GsI|~^p@z0`62=+j(VRZf?t(D zf@oj=1C@Vx!UY4JoMlT-tThO&(I_e0t7?WQKYLucrnP0_-`@H+j2%Bdl2Hh~g*UH# zjPRnX+l=L)2mKCF`5WhdNc@fPqjKF^jZpc&5YvaEKasRwwjBJ|9Qa?U`dCUv_POkx zUuzsC$+W!xe@F{L73eSMfNzUuzj7u&Q*U#2c5MUnqB0B-J*y5^-IbP?YS!(>%&L|Q zYX%9!;3vjz&-LDWy+1%naY(N4X@jv$|Scz;|jzvHHH6w)) ze9!}w%h>5wj;3o2uP2s!+Ye1R>Eb76?o zNOEoJD}K`eC7&flher*?&~X;`lh=#SFh186qnb@F2y5Ecq)h@ssU)R5PG^ohyQ&~o zZ62K|O@Q-f)biflDn zFOahhUg*E-G#OPb#Btjpjy=YwULefEz!%hDO=P#XFG^jO@|P`!i5U33xX-k7&8wZuUtPD?{hLXg zi(g3-oU`DAJ!90pGgeWXU4?JbcJRx0w}!|&#bh1AlP}TrjGltPKCCej6{JoxV#5wS zvhKvBDUt$W)76B`q~tMA9Fr*#kW zqx0K&8E;W5f$W*iD`GG_lZFji=Sqvc^IgAIb{=5Lk z7ZQ)lN1W8^3te5`S+q@dBxo!ONI;XIuT3{Au>wt?pMi=_x+aSw-uG>cv6g{vVpnE; zeL@v}$)lTpt3r9ni)aXiH^}N+#aZ`+~({HR3dV!x^2eN zM7C5l?8>N97F~U8(yD*&nL^C}Se#+B^cFdOTmr|*Tgl#l-n#dDc};oIRXeePP%r+= zr>Ta@)}QHti%~Dt5vl$wK8ZWv19Qy$xPo@K36T4`4-Qd-MyKp(hAJOH|2Un()oe;F zR5ll*zvl-xbxsxhWhGiGl6Hs?Ejswn&^?y?IpV|a;dd|e(?br2RdHZnA{5Qj(+;fB zq~SPiA2-Vr0ll?fxFo$CpORp z(OQJHN-n<5uI2K`$!1LpR5=)#`JH`)|I8z5cw9K{XHAVA-rDbz4z~Ug5uIIFn_qVQ zncK0@+U}d>?sElo1w@Kx7AMRu_v3dHn>({VGZgqVU2Q6wM{>VN#_vqM@m{Nl;$xm-N{1l_!$X$j_ zgj8idS6p1C)Cd%N=HBNFcW2y=m{Q5{?#up4J4Sbx0W&qx_rG@6ja<<=vdD@Gai;DXt*vOkaT2I=f>z;}qPya+yegup^qBRM13 z+>WADPO_gKT6S#p1A2#UbsT%DXvl!w2>u!*XD_cs9vhEe911NeneEE-@1U~1Tsivy zoM>2}>Pp96j)(2hdz1O(hKm8Lac8BeZ(2xuCf7*!Tcux`qtYPl-I0=k?>ze6?s$7D zH}+m{2#o7sl+#rqm-?&~}E zWCEH!xk>#WjAnwX9k$pcznh_h&fBs4!JDWv_n~oTmAU4_+5(R&#w~R(W|7CNLas*< zmB^0nkrPAbfwLMxCE0$6%SVE=w9FFvZnzdEjI|*doAzsw>n~3-pZI7DH&;qSFWeo> z4IjJxJ7@11drt_cz}HVe!`m|j)5ep7uLT1Jcd*o?9DpQQ{fzl|#qVmj9eTi-g#;mmee>LZo%|l+U@9KF0dAKn zj=t!is<7CK;INjI?M`L;Dhu+>65(w3K2IL+ULB8%GaWXIxg1B+rw%(hb!YhT6>o+$ zOZZJZjrH&ZI=OO}SIf0lQva4K_7%5&!H4U*6yxWqu*=vK?hO#I1$q7HWl*Y0XJURe zwEw&f(%;)BWHZvpNE-wIBUuX`f{%)SvD%9SY|c%p)Iqj4-(arXcVIoNjugPO;An$~^y;KzX&VRpRS0 z(h&EIae^Focjq_G?*&7Fx>tH-UVDBm)lA_A`rb$iX`C@2y@0V|J@8$m?B%^TphLO+ zowrOu`+oU&@~a?hd)wVU?eKVDPzC*V`<1`u4HMp!t^(@H$Pb-sDCVYS0 zj;1rU?ad<_UC&YbI14m~&~Ft2F3Qq*&(ZiZy-X5r)J~>~om46MQM_1)Mu<04AEaGi+A+-g!sKEvL+Ld|S<$#~|{0-+^yeUEp=OML^6dz*G zw@db1R-PwR!KS@PsqEfDZ`;@V8{kGs3il~pAG=LPfvYL!A41RAiABo;O|UFXoqO6=K^H~;y=%g=wlrz<925KjLWuev+ zi|b;Nz|Bag{BgOVT(W=$dz3$qYir(K){%gjbFn)c>G=k>~b%Sr*w1+VYCc`5l>hyT{2|=2x$7?#F>+ffTJLCL+P9UxnBCF9J_orVhcQ#By z;U8gm3H3bacR~@=DvVEK?HTADL$Vw&Pz7DK2kGcU+?qfutrAduemA&qPMIrj&Z!?0 zP~&rQe&tVJ%U&*Cw?$72Ipe-LcH3W^hh=x9m1G86)x>mn706s5x{Ew@m2yk+dRHZJ3PMo zVdS;xPdfHNDKgxP;#D2()ODKnG9#k7Z1ibaWPW3?^G8)|@qlW3THKD#(lfpMb)sof zV(>7R6uZ5dGQZX1%p&o@J+rjr1Mk%QH`ius$D1B4?A|SkURPA?Z2r0O67Oh~m_(PI zLdcLbnvLq=HZ;&W(e19eXRo+K*@=}FbJ>0ji^{@*0-sAx9{*H@?Rg&CvDC|139$c0 zmmxyS;cl^HOLF}Q^7?yZ1anI7j}~qS0EL|-Vkj%=*+&afr+#_iZR_*=>Qb!!#1euU zRHuYr4u7TqzqirYx@gyknj1Z4C`Ib4AMjW;svw3R7p=7l8?uQ}+=iFuHM6Gj;mCjE zl7_VFXZbD9ruF*gfZ-m<0D>BYmrv$n?=adr8C9FnRN%Md=S{}UsNr_kNHtb<;F(X) zJgx@y6!_Nct?RvmrR|a6ffw576U{Jr^OKYy2MMw6rPkkJO&?+a2C;;M)g|3aAT?gw zMeDh-L@|L~ETaNS_jm0m4n;mfq8xAZcb}~@ManNGxgDZ9pJ zRweoF_w+BjW6#R#3ho5@t5TcZ{Y(vc_0y6KI7jZXunMm;J~nz+*x5U4`_#=yX=wyf zvW~fp_36pZm)rpTLRfJ0R#na`;+TLV{n_iZy~8vKnjw;VHGCigZDQU z)^Pz8gXbxNo1$2|W6MoDzSy-_Jb~*zSQCbEbi6+1$N5!{gCci_Dd`+B1U|hkH(i%Z9A#M*uC6t)b6%sCh^_}e4;-Ck z60i;|sYAS9^@vxFWEc!l4zpe1B0@G#d5RnV8%SZD=6MSo4G)2VN5Enz@t? z%5m18X1a`sjAW!nhMjproFyXgycRCzFHTlDGw6Gq;mkNg#K)^f@gnV!Wi=z*x`ER^ zz%df5xi+}vW+4@tAt~2zpp~$s2f1ha!mzYd#k4(?!j7w<<`e$iF;UTofi$!HTh>BTmi7e$NoP5fzZd*7EuzqTg*vJB3Iqes0lI!u~tNs2;h1<9yD= z(e|T5dY7fGz4+tG_(uQwBO&o;Aob`w^4ocHH2Bycc4Mmnmy#oT&MUIB^g5=uOxjP| z_AtM@7B}-1MYluG_|0|xR`W#(RTtaGNPm42s}HT>30lT1jD&fD7}LWy)sA!heQ}qT zz7b6k_^!z4{f4pEeahwSy@8s}c8+DxrP1alG{nIeI;(eA&h2REw1q+Caq+}(DfN|J zZsb={9g*|+BVXHN(KPzat@zBSc8xPdu=TiIy%GXPIeUp-@EpjgqmoIh`iVCU0gcSb;fR?3`FVhWZ(|9 zO%)kB2ul1g8Rk~QN^^KWB!Jj8-_W6SAzlykxHs4Q3n`QCxel&fC=&HUrxkKcYWF9R zfMNT|>yg9$HzYhXq@Z8Sjp#WqSMRyg-VCIhBw;y?EN}{AE5VKSekt>z@6CIJQNt$u z18WauF32UyK8}LlpW!|NC@HTd|4M)c#3n!pV!^(k9O*1Y5xwzv+|L9QJgW;hTH!N7 zz?GmYW;|KO1}M;5+S_ujm^e+TA|E^4Kt(d}CDnf7cD^*`+Q}?auS*TI{89SZR}afa z?Zq>s7oWQVSpn4mxdF@Evf#G9JTDz&bv!A_eYBF#E{AU*BJ0K>?wKB+d;(=s5Ykvw zkN9QwHWSOx?+)8^e?RXBD*!bcG;ah(93VaBLOi+KgPob>%*_C)ox0%A(=%R&;*dEZS@`m$pGZtAPD3R!(y^#=a(x}#i92jpvMevD z%H(!h5s;(*iR-L2J1rxuD<2BHVD8&$=K^lDQL2Vxu1srkPE4ZEd#dbbXZyNK+TS*W?9-H8@tJpSbbh^YM#~4 z3Ncr`f-3cn69;k{ARy#}XXQ1aqC4DuMJyQ$O_-pt*N2TW8*%%EA(O>Ew!D?urLHzn zce-TG&Fzn0rvGE!$dPeyy0T$m_@62WnI0Ouc8RVHU$(u{pNNkL-TBdwE>1{qepInc z?FgdSVb;b zFNqmWgLPeGAD5vCtR`{oA2$0nX?jwwh~})FIIc`cL|3AJ#9|RFE~fRN@>6S1uj^c~ z`nir8IR4q!I?=|`kN_Xv9XeAn;@nL5Fp=lVQYPzl9dr$J#$R8L9foJ;yMTvky6?@P zxa3Nn#SzG;M4)~@>o7?>O+rlcf+Up% z%HOfRCCr`r!nuY9@sSX*&R$o!echEp!RID6M zlDfI5VmO@mIOUX$zCBwq=|R)c$j+kkvHxo$vR1&O z?$S?Bnw4mNHqXgMp8J^sOHaiSGTy36WWqvd6a?b3;6{r#+j*ngdcK`Rk_dp$`S3vP zlr6nc6gn3yq$u+lkhRdSFU|6C+w~xp*xLxX0+uAv2Nuo>>p!dqBb;b}TGb>NZ{PLj zBN$S+2+wFEa1!Nps!7aOUUPO+)5nC`fY0Cg&o^F2btZ49C-{M@ckUY8PWx>AW%rT>q=JfVG zR5gf%e-(5b@X;4^K(BsycU#ir>Bo}e7sbl6tqudmW11J!+WwOWp5P6zz>@@EEnjF% ztf!Sx4FwiTbj5DVv2TQf$e@0`HoRG;Y*9250Ud*R?ll&(XI5fr#&;WtDBi06zXc_H z(7zoGN%h3kYu<&1yR-S)r|m(v(d(*Hc3lI?)-9b%=*j?ColiM5|yA#GCElGF959~evuE2Ma(brBaEUGpmKG_`}LfhFvgT3 z|IR(hacR~6uAm9S6QdikAb_4ybRk=gZ(3t{&Dx!SKQ=MnLVrzzFUogt;xrM`Yc{e z-eAD9K4Z3-@3ZFmt02#kD#86-=1S_&@$ISYjc*Jd;={!JKH!b7AUdD>Bau)bF%^IH zS$q8A0LJ}c)TBYw8%99vAzY(}=2@8G&G4ohlb2S^=Gdv~7=YP{=RlI>8bJ4) zyJBebaSRY=Hn9$8e-7_!_)ki!g~eg(w)=lY|_~i@j7fcR9b-6HgByNv?%JP`no*S zXh{BI#nNxl6kh8(-a9shtNhD^O0%S$7}I^-%-j@btr$1Keh{jehv5UkiT{TFkN!U;hQI|Vx zqIA(OjQhuAOj9abuT{co?*|%vZ#dY6PmjL#R`79~ld>V8W~|hClIbwX|D`f9275 zOc9Vvf+ZBq%+8%aIOei2r+Op@M@ZcxzEehdP1~{V;p#RRG!%*QYIyls-@Cun0UtfC z_#4;eS7SzX+;ZCr@G5GNBOj49yZla88ljtywNV^b7u8}(I7cgs!BN+AZfk~-$xTM= z3Im2<_Tb5-DMV)(YV)zofPCUH%a8I_l@#Q_pKcmXhTHpPpFi<7b|!#Nk!RecLJIbS zB}EWIeF;FUadR7*-AUeLF^*X~-7Y;)f)9JDulsP!1aGr&IEnk>M;`(^Ep>=aiCd+X zTE?e?^qQ@sGBj?->!lhow|bu=N8FHS?t|D#+rXCvPIb+72+ce^2`;-8jpPI!(C+#f*gQz`Hm+b`MAQPbL~) zD2KaoxBTZ8QZY=1iL7J@gM#AiRQw5uDIa~Ed>)~`H_0|rSIf4UZ>)Cg%S2LGc|NYz zIBS#}$>E3N38t*XnplLDif*|+Y5!|8MKyqeTQPn&nv8@WWM&krcp(dG)jU57pk%;P z9jc+bpgo|yp$a#vnm^sM<2T~bW7ei%dfnnS1(V)LGxDhFg^IiX0P@=g*B+>=&y(*+ z^~WbLY&cyjn~L&q`Hzm{lFvlqYT)Pyv{Jb|1^kE2ls+$#0r#S~b>jf1O5e`V z^piVH0~k1a!JewYxA9D$vzXz|XJo&8dI-~oA=Beu;%_#T9vA(%${Qyz?n#&UeM$0tW1$(bSMn<2mLSMX3EuqqJIP4AphI{*B>M?7m~FvjomAFf zEeX|=x|IQjt_;0fm#L&4!^6OkUB@B|lf4_YJ(FDsO8U@1p{9_DqMjbe+!==CCS|vr z{vdsSbkwmvo~)K>mT7$A;DVd90H=#Sq!Hjzaxa%fBL$-xgCUU_@JjnTt3`azC@o)iPwkegG2i#%nfZRA zU<9~=Q)4Q2{e%+m-auJA0~OU$3>&eN(1u)y$NDjwkfM4<)**ki zNw*7<^dJu&`aDO|y=H2%&u=O1%O)ajC6gQlm(7GXQ+!&@7$qek4PR433bYb7=dI0+ z+JcgC+M3?6bJERWr$E&0q&C)VZcA7dHi}doqED`ZOqX#dp2i|+Hrt+0S(T#zZ zVf|;ih16!b3C-+({>s-J@9ueV5q+thna@qj52;SE(JZ;#R!YqZZBx*G{dr8M^h56e z5hFj7$=nxIGo3I*1GP9m8*!Rc*Eb>=7pWAi+H=%X7=bgO;GADmN08(y9~$>PK(*(q zq_`)6)8N?pyy&m5OieA2k-ivY>YDP{%x-W7&bbq-p(I~WE+TNvpM&YTWHng|7td3~l+5ubtcdh`o3B1p>k!mCol z>UzZ^Hejz|2HmHa5rymx6J1yL!}`=*OKe8m&~c)!kfI+QNa8YlUaDyD@Q$gPTZ;tWKsn~brOD%CsXXo{5v2Pu zy_4n>*%7^9dp{$DA&~RI-E`Q|5n-*1x0ZWxuTMGgKw9DWRo(h<8me}Lw@10-ip{og zMBrpE&&&R)W!^7MtY@<2_?|9Yq9M%~sHTpH%JQ-@5gOm4a$+A==sQSM?9qxm|6!i=~M$}QBH9lxQT=z42K4S(`CHo zNxjt9rXPjKRF4EF^Ay$vpN0BYZBH$2wh3X2+pLb=5~F`@SOh#i3oH!XvnODFe_^L; zS6NuJKmKLyDIeP@HRW7rW@Ic*@ZgvjYoo#%uPB(t<>rz93c9pqPOcFM>Io0G^G{} zPMDX^lMl$yQj5ImB2KjoN%}m1+7wO9)(Asz!yC$hgf)a@Sa9oZSVsTBrZNf0$`7r$a?I%Q!9cP37>v^tTpzvu(_Cm zX>wlY=jhP0kC1szZ0RV`*3u zT|Rt`F|L@s9(*Kgt=Lz~T8bG#Q=uFHCnnv-RNjgXT1idbuusfrcbdYaQaSJil^akuiHZj@SY0tyJmpuz)DuxDC0L4Rug{yXo0YTN;0)@K!~-sq|}LTVSv zog0pk|5paDXb1a~cNHi|%-S5XIBB;gTBPq=Y2;}tn=`w%_0P$(Xa}-^&cxwReeFT_ zFV(B6Vr!@krs+~*Am(bUfG~eD1t|cY&xPZf;8Hapva(1ng3D8RZK37~9neQU>?@3I;drew zhM}qQD9JnWOsq|Hbe8thYSh<~SRA;WtVAD4;89m~KMz*37)xkL(^XHYewjh*nA7-2 z+9aSmyCW6%uGTxRurMxvvNO~Le>^LZSwD@wWS1{iy&)#Xt=q>gf0h^X;4@1}m0qoz zvhfXf8`x&Rj#^n6;Jy-`v!^Dg$6~o39AbyHiw)WMD5z^Hdu*u3*+lnLthiy^9Sm^y zTwGoYfYKoDR53!Fh^rh$ zm_H&hk6mGKagQ(ObPeK>k~Ko07#MJH%7V7N&qprmH2#1Ukor9t7H|4|PY#7b5Zl1Y zh7!nkus0*^9&-~VpzY$BokA7aq_h{wmLMem3{z6Pt zV@aIJyZF0&hZefj!|y7sruuwgA*>5~sa4PAdDH!KTn!OZ?Tzf3+ZsW0hAVQ2C3+lG zf8YqATdg}eC3lV-FD1p}5>LlAvgE)r!MTuxO#!fvWykrZ70j<3495%V7k}qnT@=uW(P%)tYC&jkINXAeO z>De+vnX$J=LHAlr+}j1zoy&4oZz7`qS?ELBKu!SJZ`I7h%8-mnnPEr1Rs5bKYO4q& z(aPUMOoFXaqr-XV@ujZXE{7ICHVz`K=-CC8X>tE$5yV(9gM679w(Qm&MFn0h4pG;n zTqijp&@s=Z1Bon8|aI}E{U9;M(?aa@*R-o|j_VG5dE?QKD(L`KO4z%Fy?-rh8y%yC;` z5_YPcgaR(%Pwh#$dt?hQSVUc;nYxC~(Rev(rap?D?axywjQRdsl5p9g0#@Lx0rCjz zOqmuTb&2eVIq!|70F5&8RRbqp2dms+6+rp2)(0wKcP#B=!st3;@kMNn*F!Yj#)jWL zwuL!>#Rw$HT7fQApK)(qFnfMnbJ`haBeoCpZJdwk!0eP7NL?}9jtVDqwlx9dX-%iJ zZH5)kK%QO?-W2QQ#HsF-@ac&LkEkwL<&s1XgWm#|f3X`xFrnJ^?MsTW6$~Q>B(i4T zwLN-r$kPSQOb+m;8@$VQcKCmfom?+O7NFagcX^F}OZCvZIqGS5%&s!IB8bw<@gPay zSeaPS4MPXoRhJZeQ@=1>QbE1*f2(5kKRkoZ+3aL1@az-9lz1M*h{#FP2qw7Mw%>$k zOtW@B$~Z~obIp&>c1%*1C~fo^cMy~|ZnXSJyK#@*x*Ub}6O2#59C@Yx?;>*met@X( z0!>5F%LD(xoKXox6+Z`S-lr5`-%DPhJrl|~G!leKN<>HHG=+{@T)@{R{P5onLLnJo zL9mr{dERkEPVx-hO~`3J&YIY-R?u7rtDb+)lVXuk_~4F;LuH4as|eGr<=0bTD}CHA z0ci50@)tV9E{|1tqKHjlhT*`kp%AO^Tlps70}AMq%(fKqZuJZ#tOISzWNAlF`06fP z?YDauU*q)ZgSp);JK+HJr&qV!eA)~rW+}WZbL}Xm)VLH>14W|rbixA=a18&`jgw?7 zEUJ%X%tw1|Vk_U;CB0NByaF`(um{bODZVpS?z|#~@GEJp0Vh}`)%igECPr+t^KPzu zHI=lRce}E4VQWd;d96Z~Xl3HbR+^Bu`)5osIdfCIHvNc9}9}EIegMiW9*|}!3 z?YoRSp1nI>!#A@wm$XNzfE=p$LGmUrJ_k*vUe)!rrolS0hByW=1Hy2HShL%cdXZ0`@BS*g&7 zUA$iN&_m0g^=KGOjcVE#%aH%un{rM$Hv*iz%6+11$QRPqXI!I*3B~4yAWgs+0^(r8 z+K#+dn$-+CyEE@D>Xp1tcWM$gok;3X*AG0^g#dd_tDCT5&nBa4|e2`vl{=OMm;`ijQ z$huJ24X91JJgU>Y-Vp|9Vc4l?P0{n?h9RRS^C+6<)!UV;s>QK@_%bGVa*l=$O;G%TJtceGW|Z9Y7@v)9`yxL2 z0GY6xZ@dV0wSk*ALzV3^Dyq#+#klUqh(G%RyK|mPFIdHde7`T6)Wm|?O0p_+cz>|# z4?7jW|Mlqc(TZ(|j=!qVbdLauQ+9ZGvbi~Ox!W!zfrITcq6Ws$6fg|wyLroRS)C!q zIpOd+s(-rxrC8v&x^Pfc2ADy;gw145vNKZ>;G;zbG~|perbczP z(tY{5E4S1atrKU^LjY(h|F}mDATz;@2Fx>RPax5bG}tdoaFd~WEEHD{D@yl@VVhB} zGl*#G;7+;Uf0;t_hdVyatpk3moDHGub9SuX>GDe&gfxX~5U&nN zaV&T{l>T>Zgkx^Rc)W;5hj^`J4vqmx!oc=7fasi8o}9*xq%M({F1Qt>2THk3+oFR= zq!4sG%}7_(m+4*2Z_A{269&m=U1cdY47ABU7-rochDfzxURTnqHFVKawjRg zeKZynb2NPbs76J6nZM}8eSgC+jPS#7hec}$Elg)Go1Xj(;SO!&OMy*L?cny%L5}#^ z)NHAYELk?N74zwPd)jSuvs}2DiaB}IQ+3qm_M94II~ZhtGk!e$VkJgYlIB6|HhA7f zW@b#WZy;9om?}5FrfINe0rTQ4brNn5HX`yNJ*Gju$;|{NvyNL6&oX(S+Q;fF5RbU2 zOfZ5dBmkQ0d3_(h%D@ z13ZEUC79bL!Abs2m7QXhT-h~=_swUIcMNw13_bQZDNH{Jgna)fF5`3wqN+1L=D<%J zD2*7&J_1`Wr#twkIk?GTHH<+Es2>TK8Z?t$Z=BC>pHKkjF4{5M%Mmi|x6aX0+>bJV z1iy?fx5RR4IJiRt$ohnyBsZD;T+t(AGtWN(hLdZ}`+a=UbT3!o2Q9bFcs^O7shBgn z*vWZ4t3w-LwFMwHrBu9$>o_ z>#H8!sa`fN(U=h7P=wZg$!ntH?mQ|H-ppi1$YIe{5PN%pU%^U8Y}g1s>r$E&W&aKd z6Lo61n(6CMR3ZsSD!m(7Ul7v#f-kpNQSDn6b}U*5D9!?r$xQ7jzrTmCG|A(5gw0>3whc)%l1`u~%&M}bN!Ed^;|Eq3cA zcXM7VXZ>lBbZW7Wf`3l!jRkf^Y@=+4CHFr;`+M{n1Arg*cT@EJGzzv;0-Rsxk-gX+ z(t{lp{k0`BHPfZ{;fkp2sq8-aeLDB>*B{JeI{)dGfPP>NLdo>)z{c}O{$CMX`jfJ9NI%f zY~esCx`@UU7H_VSfpVcJz^$u)d9!_4xcRhARYWj4AKnj&;zQ*FD9UD2>3=#CUhZw| zX}sOXYG(CY1KXi{?+pkPV1#7@cq|fu$^HU@jr5nUpOOyN1K5#SK{)^(8cC0AUwxr| zN6^cLQ&gg)vDf9NBIYt=yiVRM_B<+2fW;h9B`yH*o+Wi`b!pkKEL9h=;@|?SLdYP`NEqb*onvdxY ze&{A4N+0P1i|dY}>=`aunJi z7&~u#4}e_Vc)0Qdn_OCNj|Xk{#P;XFwmg^|F_fgfF`%g@1`L>S?RC3`=3OF4;duR9Uxqa@~@Vmf21cS6@^1y59}$K z^8T|d{viCPl@y2`FY#Zs_=22oh|iPj651kv(eeMtya<3%Tkt2Ni2jS1^N%=A0{Ca# zg7)az;J-*De`IbzBOw2ATyxbBTyY`BzwP?Bat{meAJ;vT-TBThZ@NyBbh54gOAQ&r zGIS}-JLWLx#Y3w~t?#I@Nlli#e-Xg{sL^30OD5f!AxEvrgsWMe+>INquKS;$M2SOn zKP|-eMp~x**Q=Xye_+{MdD3?O+spvb&_C9T7Sq*H{D(DR9Dj@qb3V3S{SPsy1b;9@ zODmp<{I^~Iw1Rl-4^)7$^53o+fA{tBn8N?41e&I+Fy#O3R0p0vy}SNA4Q+FJe=ENc zN1ogD7H1_>9{#uEI{u&H|Cb?-HZCZP^5??<|N0g{B#g+noLH%yi?a5)e-?8c$Pj|N zjbNZ4x5c*1j7m3e4h4NMI-UA-rQ=QR zKW55?67|I5V#LwW*PEN0j{R$bFRpx91Ao#|o}Ro@Q&V?JuVlEuJF$x8DND~G$O{xdtl4EL{Q;ARZ}#vPH7 z=SkOxGYh;EZz!)2O#C328Dk(U(WwLT)e+%_e-7$)I*w6`KGtVFw22v_&ZT1bwvjkXhsPPWy@Mry2-&%*XDCq)X zWB(9ZfI@fa*Fu<@I!G@^N$5+@5G72H#&2)JBO)Yz8;T6wF5_(5FT4nQxxokO8PIOa z1A6a;s^?J$?`Me}#(ZnGWl8d#qabtXOwU$kK#3g7fc3~d&Rr3+wF+$iv~>l1(|?^qz4 zkZ1FsCNdJ8S;pFT)$+Og9s7DFEMRfq6x(ds3j8?`l_viD7ENkt-<@2JLYwPKzq-@+ zT|>igt8CG7>4t00=4WthQ0O2>Y@byQ9|3c6?{qEn@Y+h?ha5f<&%-;vTvwg--uh%R z+^kP%I_rKPj&;f(MhHN0gbe<}F(@9cr{*JCF0jQo<~IfkkR4gZm+Ngs6%F`?CfV{d!Zkx7YI<+P}x#_ig1 zGSY*9q}W}>Q2-6QP0>#Do5>sH+OTmmPw|+H)@e1NZzUR*n!> zD<{!q*Dw40x*8(XW~30TlFcYZCR6PrWTTELAOH#S)E9u{HtJ%4z_^Oj**6DogOD$T zA4x`x*h!2)fli!ymUMo}tbGPpyx7E@wKKS;uXy-F&OO@<@0^d)v45j%dn-q}C}{_R zvfK2*8SYz44E{0eYtPsp=f`Y+Id-4FhyUbqSE*BH@r7!5Id*iQz&BFluV}x*)V+`0 zkK$=d9tB@*z4!iq)Scy5T-)>J(E!0AxCM77xCVE32-0Y9cMI-88-hCoZ6LV2dvI?w zxHmrB`t44vkp%gw7E*yfE1Op>pv%z5^Q;`h$dfEw9e`Yk*A>ST#Al-` zE52jw%$ZE^#0|27s{QtZkEmbQ#55|sF}02SNEiU8;%*t*n|M#_9VcZAF}@JRINGyj zSf2Gq4!xiATl*ppnAt`hX#Q1V2ey^{obe(NH?hN=ups0cStMdEn6DratI|&e@t=(~ zQ=XuvILPEBB%VXYFj)Afzu5wj?kbQ>hwU8+c^**h!LvTGn68fsL#xtjwnZ6n(WV)7 zO;T}MyGU9z85(4zR$!umE46gPY3WItlA29qDp-lz`Lyo zWnavNr#8&ahpS&{eK5Z}{LvfqX*cJ~1LC4$pcw;R`yW346$?0GAVr+D!C@Zz5M5qf zfov97hV1z)Toi=vjBE$;llH;cyXc#1Yil|>i&1X+gpTw3@dGhs*a^;8oSv38$WgQi zAomkoVwY3a@0jvE14~e}og&maV`ypjBtFYtB7MpeBCyU}tLm|20Y^lh?)MB#KipW> zJ&#ERTPzU#ZwFT#Pw7?fvJs!}$(n8m4FUpCJ4dZC-?v-yETE zf(ba`x4kRcZm@ZcSqh!5efJ<3v8Wc~{MJ=+?u3c|B>U7fl6TJ#B!pFZ7d)wsJNH zaH9kAeVvebRNvQ0Y1=P*4DL362tAu9+JAAM*1kX30uek=N2fl$Mz=(|T(2gqS&>@-P8D zY10T*i+8?YZ5h4P2+vb=xL){(`v}V^884Jy#!ISN>}Xqo2)Ac=Ia@Ztz^*N<|XTkm9n#r{VQ|g>MC3887 zi{%GY1Kxv_C9^Quj&G0Aczed*Htsp(32(cPPP>u;BM+9YV4yw;{g6x&84Pw?HkxZ; z31ur4kAKT+bE#l_CzvTHR*HC=_Q!1$80lD*n2UG zXlEFf*7-J$!O6&29n@0D_qwQJH-)|oP=>vAe6C|uPZ7=XRvO9h*y8TH- zDErrfuX#m^7|nw$g*Vw-JBYL47c%C%;qzqbyr-cRW)C10v?1*cmS5PK!;U}MIJ7vW z#qDW5k$k$jUtoLLQO=_?pL8}`JTnG8q%~Xps`k{J{A;r*XrmXia6dJ_ zsS%ZEV}rlc8?&v|f{~)ixv&=T3NI^0WdV29{mjoX#wf7N%UZ{?hpX*k8yj+0erB>K zTaw?EHpiB?T?)RKEw38zyAuwy3AjhK_1<-W+->t96jeK?_Z7Ge_?g!%0!G z0eNz;kbMPto1$)?wGcWyjRYoI>fq7a9rBg;0;7NeGfIz!Yi)U&JHkJk-D*91K7 zMBGnTL+t}pP+r15(Pd{nE%qA?Uh%|%MDs-9_;8YV;g9+OlN~Wi)npy(EKEMv+^biR z_W*sx`|oaNUxJN{9;81oKXLfG4ac8njIsv#thqGp#D#B>WO@o>`)U1s=25|Hhf#JP z-JH6`**C5%Qd=r(Ja?*w*Z6Z|$Yv+%k#CvN6@W^~gdYV9u zwu*=gQBsxwuQ3@g*94Ep7$Zp^LWD6U{)O+<1hTIGv;`da|mYy@ZKvc)$v*({8^Ht12*l0=|b(+b~Ri9$MRIk7GK@|oFbHfbN48&LB z{{Uevat6)PWSk#J<)-o!CWeBrX4KU&92Zd;)r)`6IFJCLMc<=d?oV*_<911b2VeQU z)^6``!L%ZI=G0pV!HJ}uP4_H2OPQI3?lV}_+G(+5EGxO8AT0qr5A!1YRB!z)VuPn= zhs_p!he4iHK@|C^__=F}F+O|l)x?O&Sbh5^Y~Oy`EoHoC9y8`@mpxji``vNK;V%#H z^r8C2FJ<&IBSO|XVaC6h0U8xFyXVk+N@ZoGW3vIJ{uUtgt-I{@);&2n`52_LWS-=7 z{ML;}>&z5KN1~%{rZhgN>S75t^ni^^7vdvFZGpS^LaA%5>Vb>B7EJ6~h6x-B5*0_o zE3@D)2u`3!p6sm-*c*s_Z6ez+yvHYAg%XQlkyPW1qbl*w~7kI)m-B7dh?vZsce6+aW@2yj|KDK)1Sk+qLWJXo>mz z5uuTQtFfKD#>@v!n;ErNno`mCv9^05vJ}tenP)%kq8GfoM->c!^2@frzDDc($<0ZN zw-*?%p9lXvJ*B&nOT3Lh9?#$~{RxEcxPkQ0c2Mjl%*l!Er2Tq3pvTqV>P!zLFvl+b z*gM?cIz~(RJ9553De9T2u$YQf;mFEncTvoKwxeXF4!ts%^zZ2J*a3zD!3;0QRLi#eco+Vl>MOekQT3aw=sJjuaEk4ENJ zT|K&e9M6u!otxvK81jkTnHDN3WJ5k>IrTY{DQJicxRaVv zGm0%vMGIk8`rv4+mYn2EmSAjz-no%Z>wy^6`pI*3?Hr*AS^u_cvv5)zZ>reB)!oN< zw`VEp0!Jnum0LI>GFuzwQ7$m}tiLVHMde_pAU*!i-%=!ge+kj`E|Q=3q$1ku;z+?- z3RoBN*vn9N{)KDxmr9%!9*T4=d>uOIttTHr>f+30e?KdODL)F|QY@R3+kN>$S~*QW zV1xPWtYmNeduGOT%nU7HVJW`)_(vTUZ!*$xWsUaiQ{E~vT6aqp-&zO(yoDerk|o8> zgzM_d$66I`;6#G+Qzk(dXcx&MOZKo-Eldmi?*Zg<*r2<2Vp<*HegD+I^pZ`06^@i2} zWxwhx{)4#58N>Z0bq7@t{vX6Gxl4!Qjej!zN=?=LcUtx)CMfzgOhn`Bn*SQ5{9jfT z&Ck^SPu0o)QIH72{A-xdF{FQ=3je})fXFwiKy!L}TK{Dh%-b+21E+icYm`iwZ&s!1 z$&dd0PqU;xz6}$O&0FWcMoIl<)u5VL6F)a%RUyW^eM7`?yX2azfCwqHzqO54J70 zKm}9f8}Fn(+>m=Prgq*E z{%Cm=u5ALIXkiDhA}@XY)oUS?b~5%d5EK>ab=Uu>Z$xGcid}k19db4Lq7O+gU%O<{ zs#*%c;F*@Q&+?O%1^;Uo#i~+ywzS;3eI&fXr5hOV)kAWB}tO2cn%ji2UaK1p~ zAI%xyMAYH^WCnrhMo+*+AU8oL?YI-Rb+D4;C03*u!`j~gg8P)S!imQimVJzf zv72=%{2M0A-{dq2<|{YipjdfUGSh@TpdVLsdA*l;KVmU%uG0$90Q8t?YCS&$=mWYp zUVP!5vz+6jpV##VsorV?|M&C>nwBzl)jyWB%?S2NC*FwYAU!{ICR~OmMy@sftsi$cV6pim>;1FdQ;x~M#gv_fREIjTBr3tTP# zr<=_+vuk(jKlyLUTQp0QvVPh~yOt6u3%z{&@gQXkMjn326Hhi_2%K}@c!CNwx08Lj|ID+r^fD3^2Ld~JV`fQzd@**Y93pu7GM#+{Qj}q?E)m$Ax8H=mvk4Pa}@R-qU(1USdYey1d4K z6y3J|QVNWOJ+PavnZ41!caWQyw*9MV9Ny9uKj8IhoY!L7iP!&CFJ=awG99GAfB257 z#o?Qlod5zfxBh#Oj_vkIn^Mc~MRg<<28I$-K*N>rM^a_yt}Qd~dJc8#!b)s*f8|A( zrh|+P>9O=^V!d#B#5Q}pn{6if(!xP5(_~Gw3m4p7h6G~<0!e<{Sj8bL`yVgiBeg3> z!L8-Uovjbv6>Zx#bOrsIw&UD;y-gWr^f&G!Tlt;ppJ%wN7comxM10=$hK%meQ^T@0 zVw+$O&UFVxMvwRlQdVd6$QulkjD^WG!72$7;bpnt=kJK+<6Cb;R2x3Q3p#ILdk*H2 z1y9oN5}T~ka%Qp=e8@MWaB51A$DhT87tE&jL36`co3Q=1^W3}=5KVOE3rFjB>;lx-hv4tztiDgC@QD)5~6tOCh)#DoyGO=P=he)!q}g`b0tO zeJrb^yVoP+u@PT09?z`29(*LwxZRW#C+!uK1EQ)q3@tgoMrO?mu=+q6Agnb*4Ib)6 z3k*MuNO|}*_!8%@{3&YN&J!{W{9f}|^OQ^Jv=j8p^EB@fR91$~?E!_LHeZ0Q*ApZK zV~CnD9ZQj%+=*(K@nxW3vO}&is-OHlMT(?q@lS2CAWAKbjL@Ew45Oajc;Qeby+y+g zDBKF2;Kt5p#GOZCjlEhfgJ{J)PBEzx6>`7(Gmq^S{nxnaFXyB!ZDVa4!}X8)joZ_M zITAMd=-b3}n#^C~z(aL{8_h8!zO9 zcI)7ieC#(NO5Htb?$xN3*C(j2@q9!%PeZyEQ`9zmG-zm0=pq-cXmh0~NjA>DP|EAC zh+o#`B0xG=@ck*g$BSUlS8M7s*-LMc(~djqxzk3%aT~J1hXFLmm7LR#Y)S6SdOQND zH`W>~V2HkKVAwJG)Y+u{=w zdOYi9q!?V}_3}{}d~oWykfuD?6J_QO3xD-ScTTO4Xmb;KI|ja~P=!XBmpd*G)8^A{ z?rg^Xj)w(30JHnlC)*>|^PD`L-#eYFN|V#n(PLv=NB=W{YpSspEpdE6DDfWkQ<{Yc z;l4Yj$@jMPGf@;-ZYpKi(FMngpu=GSr(T<`?!oLpVgzO&J<;>&n?K3?kyqHs24!u& zp0AYq2Z~hM^{NgM$NK6St~9nqJc1>4AQL!?EzOv!3~kJ@s6#&@pl&=5zjmv)5{9!?Ey|$VxBroD+K=?utd$pu#o`Gk zTbh4ilHkx+xo=2vbUelHc+4PjJXp~J$B3uSz*}89I&&MZv>-Sg-uXvGv|>qpUbq{rXY9VGts-3n2)}<2WXi&r4!N6_wv*Z!r1>qEm3+)GCyP@` zN{9gvyUMJ^pf`en+P*~Sb_au)(xjo62CUqUj`s^IXFY=~%^xgtTt64asPfJ5IhvmIo(u`?ud5$d${QFxILieY@RU&n~i94$q$rsntxcic4Bjr--D;~UzWp2Is|EJcgNRpz{M#6dO# zHj`+{0_hafn5zY2Y#iE=rTq?&n+^bHpX20L=}kQ!s*Wz&b2cIbO1b>6Lv|h2>BsW0 ze71^!TT{C!GO=7>7Rh8TEG&=J%DEA^I;uQGUwjdP z1`py-hY5g-B~J9u6#RGjGcrt}*c0tg%EFCkJWt!&i?0CzfiRb!5SST9BvlxlGT zE3*!gk$Q(tPuCI=be&bV;&$xPf}TwnO z;XlQ}qy+|^b;56KoI|PA=dWxRc;1KNZPDom-L>EG#t6SkLv*H6AzB|;XuXPOelJbj z;3|dV(FSbR@xDHnbWJ)F9SNfvy^QT&%u(7n{mF|yp#9_qVq-Th^*|hsK#(tg&wHN6 z9Z`?9UBa~Q35g?enmp=l+NmYmaz#s)$R2X!scPNMXgd8<4%!Q3R2?mYLpT~pgjMR{ zc|8J`?$}B`&mucs6p3`d?E9etGXwZ}zw`&W@j)isj@U#Qy*^@FECtbmkBpkSLY5vh zNO}z-VTCWS+17W&8EyU}GhfI0B9aW} zR{`V1)p1GJ;d6M$Zv52{7w-9A4CB}Zu5{u!BOKrLna|(Tm)#Y8rv2mSZvc?GSh;RZ zx-mmj9`w?&u_>VaCH67L6Ac#Nw6g~nW8|9{)ds><&%?>FRn6h)?7;0UdfdvaQwjoh zoRdGisgF^SIW6nzsOv}I9SSGqQc(Nv$fFf%`g*|+h@12^2S??+GW^ueWm*VjX8>il z`FaNP)kU$i#zb^_o7Tf>zaBW(w*a@J@xF-SA>oCs5KhbD<>HJUP1SFi3qJN-d7g&i zu~|(@;uwbhS!n;3rqj^q!KU0GO3wm`SMFVZ!FoBn^H8yWFjFt9pVbpttdA6!z6Ot> zzX;&s-lvCOyXTvaq75url7#bccf@f|WDB-;5QJx5`)A5{c_?P?y+|3TINL7 z61QZlV4|Zp0Bjr(k+oUG@YXD{IWL9dtDJaJQ}^>s!2B_NWq}jqtb?ZKK2JlVthxEZ zF@vODFw_n{JpR7ByE?i*0KPN(i2P1^^NOBFw}a_t{FoDFAu9!Oy(CP7iM}E|dBT0X z8A$~53SlNKe9itXVv^IGAC{E-0DO{RZ`qmZ&8`Ba!QpV03^Po+Zay+zynFDC=dZG8 zPP7Wi)t^@oP9;hDPY{q5OvkE$C#*1&kTLu*2yx&bRr7~-NN!VyI$^q}EJz^^kd|1% z)B|w)+ESol!b7x*pwc^0CH9 zb1K<^*F@TI7X}V17_nsA%HK{%YQW`UIzBU+qBF~!=rb=?Z_lT}?PP3imtxb?paNOZ zf73L7b%lAX=>L-G@7G_1_zu>f27Yi0j8JL3L0)UJZ2_19xPhNSo?nJDQa|7u~gWtB8-7+@^27bi&O9^vwG^R}7oL;fh*ZXzLl z4AVkEvgli@#`pP=XoJQMc?~SN30-q$6RNYiP^TqzPe{D>*0R8Q7sA9NBHBhLVHT?X z`E>z0Mdo)m8iK9DTuHP&PCqu`m(=O3CJt1W^CU;0}t8P5l8UFtQ zudlvubHOwxA7`4RqQ7jAERM`kJ5yxU2SeC*JyNoV7yxQ`@Fyr`Kb5JwACnQ_va;!Bb~7(rRDIQ_q*s$H#a<{H!EnO)G0)& zre@(-PL>!rwPxK|*Bj3mfAqaof3@L*>y7yjK4YIQMJ%kes?_GcCuLY%l3U84S98kJ zd0Zem4{tT<31_({T?bh}=da#K-e#cVB9!s^IQ8+7^$#iwevb~POin6O0k{lT(P&_h zXe@h3g&{HzIEXv~bVfa(pY|R$R2uiX!V_>blATl?v5vkhe)FjKS#&uFU$AqO`_OTC z58MLx{C>J5oO23Pe|@UM=Y6EBV*XyQzB)b_X~)crPrO?tzM9gnt)f7(8mejeBq016 z1h6LGkM5J;O$|yi8JqZAhcZ>$tQ&0!pck2V*+jTlqy~bO@2dLy&jeDDi})yVIqU!i z`D1msZ+T}#L&Jg^934GdcUyrw!&N0;>QTo(?Bz~38!v&Kq_rXweC`2toC!_4Lr`iv zXLfdCBm0B3UsG1_m;Z@7{$am6|kDCmF=l(4uoFI-Y~f*N${t zRu3T%=|fYg(Fbw_van!0c&BNesw{SlY{g88nXsQxYP>zDp0}~MnI5aoA-tnhXLO>b zD2l5}^QWcR%%$1t|KtyD$zfc)B#yBuqNpE2TtwnL$n=7U0(=QrUYAfkvjx203LW!P zw1&f9E`5B#iP27z54dwoM!|W^8IF_U%7Bm&hk#LeQdJ&nI8!rU6_-gWsbm(tsyyazFy3B*&YrveXHHlqx26OWtWI0_XQ)zI?Us(yoIopvItHvuBOB=MbnYYI(5vQ0ZqhBu9eG zr?L*16R!|j6)~Q8wv?_9;7jeQE~Idh2p@+R9Q%hAZ2Y_%ce7GFkC(murW4SDBbE`G z<`2_Eu>suga@?Q1k3|x!~Li){t+aosi z1EU!Yd5t9qG$MZhWLPQDQA2|i@;YLTed=7+}B`*0hv9`d%Q#Wl#%WI%Yn zCapS%<Be12=%| zns+hF@%2`_1a_31wgZ{A@=L_~j{Y0ilFqo+s%B#JH3b`Mu9!b5O!jDA`n-TCuu6U6>yLa8##+lgRs9*HlNL+{0c&(uC zE;7TB`6N3N*`V#Sh7G4cTlXax-_UQ1@f?@5b9l7o@$q^|UAMz8iY7aV&K{5P5}LLa zn(i$(22Z|-SW+KoVj@%OHjs5Zo&>8(Nb>oxUJi4S9CA^M?qS$?UR?G%b%$>RGgfy- zBL`U9DS4lFytd)1E>xcbjb0H0IwMznXTFidEjwNgvh;*c@~8Umm=L=TggcoS!F4{a zR5tA-2yEq5;eouI1dRw&y-!tnbx+y#0+hilQmO{=onJhtPuqs&Lo+TD)K~Rm9ReJv zqk^BtyXUUOZ(r{q&jxUIn)0WglbpfVcRAsMMo)1|?=D@)1mEquh#lMnG?P|ek|1!f z4Oi-f^`ft%BTWE;QS8_654zKC~TAhtT%q50<`%!<{bV^(1)-PIJcr6fakt zc)4AQc(fB<5NZ(^8keCse*XX{dwKAlmsfNx>*iz=_Q_}bhc((}t!;_IS;_9Ip#mrs08q;O3GA@V)V?+Q?I_O>r<{NJQ7{rVT2 zuosAi;^aaWdwIUzzi-XVMOtz-;^^26rE2vNd4?4YkaCvi34cEMVZJ zgFUloV)B~u4!n?nOB#^k;$^GbU+<_HlJH(S`K7n$I+BHcWPhX!-y_4)_i1H)M&T|4 z(a^%TR9`3jgGWc?bW#80no}t%Aj1EuT?lsd^g9dP?k*iGGlyIU)0bcBpd%~mencbZ zltI59`Q}A61DEXtjFuIF1JiE1SLbhZ`>8=<43ZS##0eMdb@;!Pi$=_{0tN;@*OCk2 z*nIVTCz}|}EAHsciex4gIcilRMinD!XAUExth|k9XV*VR3oX3s3MNdg zTfpt+MWFCcmH#FO;q{7A%QEa&-~**XLUp+hWOw%TTRNbFpZyM~qwx`fOvhQve@ZwB zBg7IHQZ+YxUUwJdUW~4~wMWBBLc~qUZEFjWYqf0=e|6(X_1j$|o@zF$^HZ%gZwNiY zSoOsV;v1}$amKWxQ}B{(wu~zrTiyA!#x_ebfT&&Af#>$Tev zD0^Sf2A!vZ@qkIPHv{H|pESHyvUeGq?w^$yealQXWb@di?@{!hVyp%isYiX@g2U!6UD;4@-`;CB(8?i(){-YGg@rjYdT~cX2vF6I6mt2GGvoV_;i}s zn7P__qFfK@`&1PXKeQ5dS|UZR1h7|qhkgy8r?(L(eiDMJ!40tpPk#|&mgXNXTc8ql zrU)L!O8XJUw9bXhRPv51W)@|3VYg#xhTUAuK3Pj8t)8iPHa`=>r!VNNI)m+qi%#H3 zU?1b@ELOT|x~V2+@%;TvchJ^6(amdMA@X6M7PHmk_M6s`g-iS#LADHVP~$C#Ac!e( zvV2mjm^WSG!3n!jTtBth!2mLPRY7{0=8J4;l(KW8s0Z@eiX1(-K zuK&%&b#U%lphjO(_h_y;Bgf+&;(|qo3nA4h9@$pRrD~|KLuGvOK&IDP6`)h?h6h% z|5-Z}*pKq5@^shPz@J*>RBSkg6pu3BIKA^o;3=nD*T7G8`F19e=4{KO)a+8sq=skd z_pVr?Lgb$ma*$s_7t_zX3_SI9f4!9bo)UD{Vzr!xcOxGBU<9Rm|bAr)6zJE2*Tm|}S3gf(_e>))f&&rQnxOKsxwW`Hv zy4u&L7xOQ^j*3BEPVo?Qgab#`5&y1UKM{$?1@V6t#sB2agVv;s)M5A`33T-)^B$Ms5eY|{f^ z05r^!+lkS~)*q78=d9Ak@w&&Mg>>4rC%fCGXUTpocW~y@`&b}0DJclI8cn9Z)Au$l z%RO?`jJ6O=xUa{kJ!Y74@fQ)`REj=QRimLEZMY ztMe955b1}1KUgHY8jEqR-OWB9<7pYo8OJP~3h2>@kw1-mKtF}=N@P><%i{KLBk@9EzHL(qXF1%6qJGmAmI z#KqI3WP}nnmgqQQ?%7=T9PeHHDY7FMXN`&ryVWm!s(M?v2`v6(&3m;L3fv^#n;Qa^ z2|f&WMh5TC%)7KEcx^us8&RQ+E(=SV@v%l;#qTT)C1OhTTsJo4mQ@mQhZh2R9gWDA z%a~^C7%1!dGWvxW{hE!ovt)RVmUr%5+m?W}of*8fN;1jV;eF!)kuvxvCx-aNDeA6o zS%PL~mBeSlg~-4+LBIU#(8zj)wnHD9G_&xOGv`UJFW9?)Dn)Y&18Ia7P{ht8r3w#RIr)>OKFAEo(MREhw3NXf7nMuMm{Z%L!6s?TwU}F>+5vIC7_?1S?Vl4*neU zbq(>d%I;{9C^l+xb8}owVKmrU7qUY$i7?!P0agGaEe*{OOmY5 zve5iwy#ZF1ru`w~p*zr8hv#y(#qynev*qXPVQ%d|zeWN*pzjw}-4nb-3How|+DXJ;J$}OSR-32u;KAhw{klP&G5vx&+n0R`6`x zxej9OKo{PS34RIaT1K1zrxCLlwiOl{P0K)Ou;oy<8PhLe=M<&tVx<((9%wqBeW*VpaMfdYI&B=Y_^nJOPIA3U?^<5fDSq3al_A)(YNrC$z@2ZiraB6rU|72pG! z-v_7*>%vocA%_l(-&T=U$HS_yt}$TY7r@(6^*LLv)%j#r5TRK_-K3s!nOKbVi`fLa z>3;}CvN5J%<*r3!Zzq3YB#rOcr-EfvoKM;EH$h1?WNEV(=q(Z0vPxqy0Jusz6&|Gt zs1I6*oBcsTkOeT|fi~}Tss)qPC*=K-A825WSx1-lZ_@a4%t#_fnXpEEzAuolpgTLa zMMNFp@4EW5?|=cqx@0|0i-u?+IwfzZwvXzxljuoKSW0lg&;_fJ=UXZf^UA7;#OLV` zGPh>pk>0I@YJvh7ZF_79L-ml@-B)H;@C-!F0&KREhyZs{|yS?0I;r)_jCLytEQ7AGr9JG?qbN+oO*|I7hO&x=)y@D&3>nL67Wfy{Bb}OI>$qc)~l+I zE!9*2!_>zV@H}b$)ML;y%E`vj#~pF$)fOYrbsLnPvUCkcfT~*Mn(-NsN&C#CFkbTV z_C9T6WsDl{U?I#q`)E!jb3VBvKfUf+qJ9O!`>-%6lo-h+I(2B{eHxPQ>q-B1W9qd=C=T|8wv(J3?>{4t6*ic;Oi@%>V9a@He}q0zXxypz${ zaok*P*XsVCmr@+xKJe>Jb9{LB7+Rl^ zY*3Q;%h3eYAP@RFc9sf9?Q?6%9xF?74%UBUDSsVqhzt1;g!b}ZA(JUu6sLu8gU69-cumXUyonKI=;%Y z0g_}-vNC)|iCrO7Sc=TY*)lFHt$*JSO~n7e=V+SEV^=BdH4dY(%je}l=`B@YF@;f3 zyEQS~n<)9|oRFHMfC?%40<+%zMnz06FX#dfsGU1DcwOpiSMI>}K6tJG?&xW|A6ex) z*kq}p093F*_tX7Lk}gA1cw3;Ce{C}xl1l(Kvnw|Pky^Exg~{~g?m4aaVr?aX$=7O@ z5uDwRRGm#I(Ke%OJ0*LG|3?cza4~wo-N{4l$d#SJ$e%%8mBC)ne4bZhfmy;FgQ;5T zN{~uN*(?{lxw$wY#x?k!81Ai@5>tz*N-V_5-uf#~6d>`v__xV{ZAs*W48p;IN@kg1 z&R+3%*sAkcp>0|}_6KE*@EW*1ig7v=ngb7aB0kQdsk*kV{Fowg1MFVHA3CGN8-t5! zJ|t^*;}A*7-#NAjnGidAgRD$QzIA+PuwM#$VtDIfk|!UkEI}R@!mQ8(4fQ3_e*#pZ zqTT@HZA5U-8j0`curvNNnhxQ1y(nNOkPB;%(@~N+*kZ(Hfpyw9dUQX`S@%S@{6L&F zHBiQ7VQA0@^b?zd6SDe4)a^ftmw^ZS9$Z}MD;33{LITBI<39=&k50uXh(K8}8;#2< zL5^Ump6pYG64RMrzAiw>Zl{ttSv^W-wpJ0kKx(qQf?@vr{V78X_DG6)rTXXgW^$9+ z_vM9^$l`3aTd>QK2d7^{(M?8USGG|Ug(V7VMM3^%)Rx2_D^xzJw(6Qj0Rl?2c($AVxp|KT>CS@=cJ2UGG8aM^v zr-mFuHj53Yk}01`ClqU+t;E+7%^hQFUmE1I`#6-6kVXdwT!GAG;8uO&1M6KTEA$+K z)GWGA4x%5MoSKG>Q09_+#jhL$sm{g$3r)XBO;U9eNrLFkxWhAGMF}Z(_)H(SjhicU z8ZhYhOaRgK&0Hhr&9cjoRVLj)UxuaNwUb3DAW<9!#8zG(RapI()WDFj2)C_bE9Ssr z&8(xS4O?_R7E<+~hnb28VpU z(Qai`3*6cu=HZh3DaC-3RMHsDE$f(;)^Intek`fS zLS~3svKyG5h${ktQc`ow$GDjFh`WYz^V@ji-+$Fh_2wQZztay<(+ia{gl5v0d3yz2 zPbr%zZBCTr)Z$!N2xEAZ>L(m^fp@L^DwDN{aMtaBvBXzn>rc2f041rx8WS-0^$hjT zu6|yyJHzK_`f5hIZi_*iVP;A4$`17kIW?(ZaTyiHKj1mfnAAowh8}w!OD3yN6+ef! z+Us8;VTR)349k!@3Pci9U6Y-4$jws4wsV&yY`%mcA&8WDh6J~~vn`lO1DAcAbnhbS zlVgA*4M(MHH(Xp@h5zF#m|1Gv9A(s*r4Uwj{mIom*Y(CZ)eY^(L$^{|6ubaLm?3p7 zj|xFyRL9+3g7^E9f>h;+uzCZwAYFM@9o8?L-NimvTqnom{W}W5DTicaqZ&lya(QFR zwZ$eU#)Tvla-ds99iVyQl#unJ&xCcAa~y-091ale}&5ZnR;wZv?USaNnH z>jP&E<0ch3Q%blQKFde@Wx{W9rszjdyX`vGtRC^$Z~cfD`{1mW8x(9PoeMRJr|~0b z&k=p?wDcftpC(EBh*C1z!bFvPxv?SNfj8u557fgWLaFHRM>~}9Eb&r38Oi8L?>a0cP_Ce;*V_ zpBqmWEICs#g|1AwCkMv}v@C2aal1})6O5aNAdd>c#sF6z^=yVw$Vj3AnxGZ$2pbV# zg_BU$Ci|1oT4oC@h&u^Ei5}#`2H!Sy zgD}ITxS2MMP=kaS=R{V`2e!(#{#=DDoTe$=D8|E5B#g+k9t1rYI-4{3GR^1 z-k&MIiVc(8bTW7&j`Ma!_ypm8FpuRfj5Y}N=+fX>5)}&n$$M+R%ciYyV7x8%1Lf5h zhNK#{$k$9edGVPKp?wWhKZCEAOR05{uc^D*-&2izZwjC-@u+({?2EdA6AQxw%E`cE zasGo$V~ipVm9)SMu*b3$wRt$Fs7KQ3)8}O1P6paRV+yjiu^7N_Ptz;@cl>RlxTIMWt(CWB*ILrtg_1RbqSR$ ztm3btLTmh`AFu3LEBkhn)mJG>6$_%?o4pp(#7uo)#pT&b)vBGzs({E#Ewab3w=d&p z^rf*9{4e(2Dypt6>lO|W+$FdZ+}$C#yL&cHaEIUy8+UgP64IfdV27JN%**KL8KBfmE*U$_A1|?_pynM8 zAKi!^3QiJ1Q%c+zL^QHE@nA?d!%V|(s3+SeY>^s#nl{OPQJ=nK%82bv$@i05Sl z5G2XLLW{F7VI_In_uxbq2Z7KM76v;HM*y!E`EA8mYK2WZe4nuJV0f3yzd}dUSxJ~M z#em!u)%1XCi1bzvJw>O?w-hqL3OhjHpT$5Z(E-^{p&wMqL zDJvT>4`tHBTQQv7mvt)&nxcI~k24FYzv%co#ZB+YpVFC%b6rP#dE6=1 zOqw1l;GGKH9T}Hs42{{#9+G9r`ql$PA0hRwN~$?Kq8@Z zDA-QmOY12hU!S%gu2AVwcpJv-3#A+(vriG$M5}GDJ zsf_G)7i)%v%95t2SP<2Zyt@~c#HzPW(@YN)o*{B(uX*fL%;d{Fw{b#T`LgVvm{2j$ ziBb0wzmf*%x4bu&zPRCAtU|cK-brudp1|?is26Dqtc(dW4svd)y6*2r&8b3Kq4(pY zxuHc)^w>a7Kai1vjDVC2>5$V(yddkkX3GJblD2w8q+HvA^$b{X*69sc(D?R7UC5dAYB^Su)9FZqeHFPhidi-sZOQl4e$)C+UY>z2 z!kJ{hl2}g17PaEtr5m!bY_po-?@#=Dt`zb9+|Mb>h~*9&h%@KuXu%a0%#qjx>Doh0 z@UI#6w3XZC(r${vrkZB^#41E?VuR_rF#8sZ%mD)N_ZGs^TZcKpk$eW?-*ECBi4%{n zSQy6Nl`q*LV36G6GW;SY&9~4SzQRt3G&VcR94ze!BO_vp1OzPfLXJDLgacrWyov&3 zA8D;qhyGx2X}J%t(7S3`$cGU>hwP|q4fUF|4?Cl0HeT6LB(vJQ`LocK)8yi9W8-pP zkL0R9rLg-+<)FEy?U!?ER~I~s?=23p*e4mr6qa+=ES@@9Vj<={|&Pq&?HLl?g`bxL5aM>=Y&V1mRCr%6;oU%gfjaB}_x zAgYFzJ?gZC6y5X}H5u|!oT0MRQMU)Glhw8r(XH+{EM<8Q_1uV^oD`bGTMX*YWY*G9 zEDp+XMDzAj66AOIo)P2%YHQ+S`ou3KLtBt1&DJ(|RozjVys?@OMg*8}IV>V48)`E# z*)00>bR!P(gBVkta{RsLoc|M|Azz=8Yk5daCax)d!UjrkcwJO(}&G4tOZ_1f=L@40+0TxTd=sc zy;CNvVO2}2*$3r8_r83G^G z$Jmfg~86!{4Ih>F={O%FyOqHo3dQA#yk@Hi;BX!L(XD zlEWnHUzDo1Pew>3p)y%~Y-GxbJd-m@5L#h@I`E$*+VW?CBegoIg=;<#HYsM0j!j)e z&@v;2-xxKNW=JrqHI3Ddvoi5j)==pKm4722sSdOlEm|o4@~zpx?lfpuoQ?lnT!fJ zJrqv&`If1pf(}b-G_?R;LGXC{)A6?MnHI}Pf(WhQWad_V(`x?*mSkh>Jx(eb!sWJ8 z!(c6%fcc^>z>0*_2%cerau1uT6>p}oW-!^a7=Ea8rv0IOEsa!>i=$yJ# z#KFT83S>ok^i=;k;V_yiK?@@A1d8#9L)uDW4zZ4t)Q1I>=PNUs@dw`1g+#7gFRtA> zjtqD+pnZADC2=Qw+T4#QdWf1pbxK+&ATab03Th6mu_jpIrr5j4iNV|^t{9_6+R;9Y zW|%Wkl3zYpBeA6McVb6x3Q29JqlmA zkEt{_aZ}4yqZc_{XALXexZaJ~oDu1O>5xaT#fldPd7e>CQ@m+>xD_;LPchT7E7@k; zZVV{9r5l%LrLUM(0$?IIKn2=_(d%juyJIGgkJl59i^~%%oX8SVo&$Q(1jCvdOVmuq z3nCsiQl4l(Vuy{I%9qLaKU2)oce(rhB5GY{qEA4p-dP2L&ZHqGU-rwjm6Tw)YY56{ zBp{blxA=&H4;Zjb4b-&sxwv}-y0zk9`)APS{{d&Hf4~`iS;I+mE0(s_B4$O* zXnl;GrBi)s>?=)v?eWV;Q#6PS6XD?j>1T}7zM(RKGb!{lXOLN0rdDo75LoO<`Mnb4 z5r9#z2!k^ji3!s{U-j0I+6J= znB+a#I=%hT!yI1d(1+P$gC(PO_7oMG`cJm%4kT7?I^mZ?$(iP&uuelrhzSbimGFlm zt%>c^zblED7{oxGlOi2Pmt7d?ZHZY<6ok#Fbma`ijFyyhj`oR-m|sg2XaD?}^jQx= zIk&fmJRp9JeJ-t%qr<4E;D87ve%0VjYrb5vw4HR#kmkDH2(6yk7)OOaaP6qeg|Ka{ z9(rJtShT=M(#Yo%^i^u-{Kk_qRmv63a3dvOXsn2C`pOaFFKljZNjnc7O zzCH93acW8HTX_2kzEbBZH)(_>W~ek_;Yox+X#)GZ<7A>J(o9!1ei6|$*xnR**Fco# zc5vhkw+YwqQSL-3!i*@AR^X~aP+Rga04Qx3C;ce=wDYscQi1?$rRbXf2b93pZ+ZZ^ zpu1S%1rj^p!=t0CbXo!#g^c!oKH%BNpEwRiOjlIY7GJ-Dvq_$hu-5&2@|_<&Ipy=K z=5eEML&_Q6BHwfXezU#ZjM{MYd053FKIA4csSUC0!R@NzgYnhm?ro7RIMqP4aryz~Q`kJ5L>dz)pv?$SiTxbpq|m zu=%|rC4BtZqK=VnlrzKs#-Oq&U0Xs0o&FSb5a*(R!zV2h;Sd&Z@I(|_=@w~JGaq(+gizwZK+qMT*BnY2eG?p=>=Z1Tr)8<$yT z#dPC?5B;`h!q3LS4h8Yn3K~cMsOdpT#*LPN!e|M)bRQHxVeBqTLEO@qFzL#VVa*IL zYXa6$o^1aJAHlu=*p4zZPJ1<%Y6?C6qZ@L&>PE4)yBo0 z?B^R4R^w1A(W`5We}HgiDFB<+YZKb?U_rmV3H=bW=L{Ik)@Dc$A+^=s_QjeWg?5_iSnDgpLR z8ceKIf)UnroK0QPZm=I{M60ssxPQm1yGyLh4RT(RJx!o6{&LtE54z=~hpR+eRmVSg z&ZfNhy@f6!S#KCKzJ@OzWTyNSQ$KrzT!<_)FO_Sh8wENyB1pW;=&tJc)y*|8X0JNUz3BS{`gc6m$J#o_VcB}~>q#Cy zcb5rxW-~a9ZaVqlb|D^74qfq5qkOzPNcDQU1o|Q4bb;zYDQIIY)rbjJ-fk-TosTJY z$;=}$@~U6rWqD^yQN$NH)y74!wJD8b4;rc<)9-JRoE1zm59?_sr6KXa6Y=`hwo+IX z`C&myHw(;=C`DnvRu7oqG12@6QFc&WqJ=nh=g9)s?IMy;7Tag!cGC^z0~1gC`WqXS z%1;anQQbxT(oSO@j9WnVi~4Z{c~;bvz_QRkf2xAopBWe^%ES|DQ1Whc=4U{Yzq8ec zm>m);Fct;nVnq@NV^uH@+%2XOtU1Zg^Ag}(XJAbNrIR7J<4i~~+1-;*mqzQYrb$LA z_$I<%jF!%vWT=2O}qO#LjEY9eR`G8H>wEVhg3VTs|88a6O)IC``?ESwnf70=>c zly}Uy;*sM$EE4M3$+YKw9F^jipSN%3RHjfGF7zya>ErI{6dy}B^ydt)GDVX<!!$PNNtmH()74-0~Xr7 zsOQObQEefsn}R@xY0enmh~YDn>!rOz)#+v$4XdIF9Vn=rPh$FhP(4$A5zhJtCOLrr zFIO58+}*DeqE!zw4yZszPi8*;MA@9($ZLcJMIu7<7kqiIZtUKLyNd~&!&IaDs>h(plXOt=f2dOXyOyG6s=T3+l_JX@6F)Q3DQzf`z33j};mS=YBXGT9!fHbB z#rh|fF}hZN$n#VW!Q6{#r3v1S&3I8T0oc=(o^Jd@XFWJ9;~In7A7@@t7|v zxK?S0;S<_E#Tl^W*_ewM#K)#NVOAfXtQuN*R zaYO$+BNlg;2T{Jfs*QSwhr0P>%fDX+xEwO^R0)^$4LFIyV>6xE?&?X{#G3L!ee;>fP#iT?Xzbfan9-)wB zb}d_Tr{L}NDD!CLH*^>o}Rq3Nzx=!D1@%7_1jKYJz zvtT~+>){>-YZMuX;T1t|u^9~VXTD{HX7^+87ojRr%=os7`3zr|56|jT={k(-!?a^5 zuN22u9c4U>6}NfRqOKLg%Lb`{U#IxG!T*K3|BDdrpEk|4)rudZq4I0^^zn2ZJg7wLzxc9#Em#u#*CSgn@LvlZkZ?*h|3$ZD+L|L>zZ+*g z{Ln%8SF8Ud*7|3z?T46elSJD$SR%eM!LDQ1OALRY#;vrru;&ZgZuJAO`E9tU!6;R`|`{^bpZLF>Cj9* zFeQe9KEu-F|Hbd;h^E-*EzkDzf0V%gwXmZ^9}}O*1}RJZZ*|o_mpbFKYIQbxr2c;` z)OCn2&E0izxvKJi^-KA&*!!aSSpRDHpEK?J7(Vdz{|*2Dt^Qwz{D1%PY-9-Lwby-> zqllMms{<7@{ev3yUq+N7-r2wI^1N1ESY{}Q__p@6xX9^iP6w5)2h>6S`{(J`fa|Bq z0vWv=3Eb*#i(^+ixrf_J4g0D>z4Q6Sj+=m$@#sIQ3jEyVzR5OBY2u^eI^56Y0$
  • _o?_X_~*TLVxS3GyN|!PS34}2Xu#h=0HR;x}JpL z85m&3k0cQ;T!U(NpF0%I9f-tj_j7S)@->VOF;nYWhiv`%AEcz;f z|F)%d>cs!mSdK1qN!5E(E)E{F!~+AMQ%Fuf;ps4>)igz)YY%3I-pu-(xE?8bb9Puc ze`g^6-E%(UrYuG!#X5szUb#juC2NY{)s)XB89vMnA#63(tY?0U!99hah!;)a_uq(C zzYCyD_SLjBCH(9LtTZ+e+A5a1Dq3O{dYd6Njr2W-7&5;U7D609L2a%KRq>*~r?-bd zAR!4-nBq`ukveH(F4(FK9ych`3!;LRU3e4>B!>De^YT6wv2wkk43WwW*vT3=nI zG~M8FjgQp_BFg{sly%48cH(kkfYK{C;9wiV&mD~C{iuVmH@C^U-vQ5{Lsv1dj9(Sh zd?~20?tj#?7Ish6@p($qFbe;4qn7F}7EIT9#F~p#+yD3M7gE&7bK*%C23CP&`Y;V5 z9}FMw4eHkVCY=0;@jWL%ALt9$ZSA)G6)J6N0~Z#pEoGKPGQJBmG{HBzET&^(d?e^J z0}n9dj=6xEHAgguwy0HB4`zD3*S{Tb(b#%qHWx>wXh7 zVc;7+!HXC*#o>7jBHHrtc_)rTnm@Tz4n90=!slpxnuTaQY3?v0PID=9SX5cK=$C0c zo0FJi#?E4%iE#m>=?$OMEVtPvUu6-LdH-8k>g@|`NuM`o;#066Nvn7=GFHXOGOsae zMfjWna@{?Q>u4_PNO_3nS;&?>-{MTj{hTWHee5YBlxd_fXNFVD%HVCU{fMnkw1|c` zPT9z7C~z`CVMW`xO#ZlP26&q1pA|8MD<78GnkCtby3g=!4nRf(%W0473Mm~*?YTr^ z-{daP-`I%*UOd7~R%sz5`xB3_1$w>Z6bIjDJmezrT3%@KTsV$F#6|l`L2#GrWw&{K z<7#~sINS`$b$%L-x+@wmf6By)G)}juC(D?0`FQWpkXN51_wYQk{V*!A2G8go*v*W8 zKaRW+gKjiP3nRNTHB<*KuLE?Tq~dtwvJQ2C>RuY29ZH3u=af~H3OI{v&7*YcN`vu64`>(qUbc!A~{qU2D9>4Cx5EjJftP*7&a2n1a z7QNR4OEqsawYM%EcTxz_o){iqwVtV>Q+X;9!D%z9 zg{ZgLS`VLiK~cNu(>dQSr229&e*~B(+=i{B4u1clC=y}kygU%*x%WP-rgEa~R$7wh z(kLN8w}Gt>iu(w1Ump<qqqr$2%#iar?BO$=lM!S2*e`ad4H6!ENOug7?H3|K}ukbj5~)4-h=IadD!s|uVxzvA*TQ1NPVM@kCuLt zRAcXET+|ZoJVW><>!9AHQ;+d}`#vtZynVmW>Xu3YPV<^wlmJVSZ zpTHz51`bnQy<>yU{q_eVzUFG8vbpkZzY)vHsxxNYhg+iUK8kVRsNp77nYU93yybHb z*WQAW(pket;5|lq8hAD_@WE;lF;`J>fP-XIUV+oF{*$)dZBfDgzF&Y&r-?{?789__ z@6#ie{D%Fz4xxt-C*L_!{Z0|XWjxO&NBjPHCt>pChqw^Y3 z#EvrLvWCbYXj#8xU`uVJ+VqcMGs^8osfNzx!di(v@;pT3|L9tN9MlW<|JY&@rs`vv z2g6JDoO*J_1UHd3ZjKxfB9Xp}42P3lvAiAeN*W|QQy}5@T1!BI&(QDk!nEr!3_L1V z{29muMhm>cRlc5{+l_*S+u7-x%1UBk=@=q(v|V!CB+&J#tv}OYChw)JI=sEs8rdy2 zbcDP&T_WK-_4z1YzS5pqN^V`*dc&UcCCph64mryAcy&A@w!6=4kK(<~t872a$oX_V z#0A)onPiK8(9j>Yx)OxEzg@Z7LC{}8dtbiFva$pPH9m+!2Ltk-M}bR*<5{C;^}>G$ z6CX{eB0Bt;Rz1OQ>RfyCN_cmSJ>LZwv3+?VMEialF-!VEGcfDVpIs^kODLcKn$1hgt-jTC28(#45z&mXr8#4<;<(g$NMcX@7sec2zAa?fV3(3dApS|&0(`~ zCR)U#^n=^$o4<}h?X*@%X8V>3$X6pyTlW2#KIc=UA?c64J-r%|UKE0g_>QRPu;rEUUTLYK63rRp>JDTDU9pU)wKi{rK^|;^6Q! z8$@;IPOkaIZu`+}&hR0E{bFhBCb^+tlk!86Z%Tybc0-?tq`OC}Ee$2(rw!cC~bWOC@uwU1#kXSwb)4#DRQ&jDax(w;#R-+$87>#s*_HV zgi#&kD8p>%Xu(^!@xrS^C(+SLE<&0E#;GGhnn4kJC0O;@$IIng#$1yPQB}yy73bh# zEXI;dHQGJJ3`xz`}eoA5gC19G&JMDix%7~hjspA$ML3n5AS`~aYRSF(LP#u=F1(a z+BwG?5{RU45J`+$VY4@Y+9bzfBB>Y%h{cYz(F%t6Xc#Oo<;6mGg-HjgtOBC3JD|6q*O2oZH~Qccc{HA2bQBUX}bXe*UcZ?jvx?o_s5;AaE@KiqCzhAV-LXT(re9eIQeu&5TLF8D`Te@!$*tJNV z()67HbIp#?=3yJ+0rfs{Lculf;#%QyA|zX!epU6WcRV|R83PxT#>y+5&1J9MT9`zq z2(8=Tc~7ufI+N283Dw}O6OD~Y_)w3$t}i?%#`cGzNY@;qrQKcznGzEdK^^(><%Mmg<7KNxo|8K8a`5$Cc-99=p4Si~uN|tj8_SfxrWstYb<40oMYhGt z=3yA_FiqvNjddX1Q@70OV1#gB4FWfM@pPX#%mQJZ=a4p)DYRe1%Nv~-6tC!VJV5-A5cgLPu(btv6inD z|BKn({3QT!|IOOi0jv-JT!r7#(Pdj%d7F~5d}oMg^T_#1kYCj)W9iYnJoUqZL)QTm zyfuBE8AR{nh0B2DnxEU4X+Jk_uQ%!kt^X5;h~Z~u%b@6?ve71dUVCKtINzMzJaq~W zdV|5)!1~)YoVR<=KE?%GyKZLpN| zw=A@1HAP#&uqsTW8!NDgAUNiB_>On}2*M^9!-DlaZn~g~5s#Z8JS&vc3!T3NjxM`s|sKu%0^tvi>fCPS^1knfbj+ zs2?F{CeeRXwH-gaE|m(*_1AucIFvGIC4;VtMBTuj_Z>8w!X2X*Mt6sydv)40Xy-_b zdZa1w)bKZqVe7LjMii`97lBUNfy>5*Ot9+teUV@51pmozVEpcU3 zy{t5frLFgr?0T`^VG!+~fHFK{*_4y~m^UeZ-5il@D1{u0Wg3)veg)F*{iuiDGwmF8 zh9nXH%D56IqEBbC`z^Pq8Or(AiQX`a)p0tti2p5*UZ0HdWQ(hWJpwi6J<#H|_;+mA z@&H|kr=A4)U7|aSUwoIffHGTJ^VHdT)R4&_W`zb zZ6+Lf&NuUM7MITr*O0P?!<_Bg=P2~6NUm^Dmq9XH>SPR*fHUwJm)`gK>1qD&l5mhe zm)SXhCoc9%2TQs(J6LwdvV<&evM;rL^L>>1c*bt56?=;iS6eNxml=&+gO7J1y(5c| zdo#l~SHVA*c4_S^0Nk$bF@oKeJ2MON@xp6e1omh~+t|kjh6-b&!rDo*wymE1%Z@sv zph;53?LE;H(U*!{GeQ#?`36ozYKz1E`K_~pJOLqTpMT>xdLL>q>t9m!GbS9lnY)j> zXwLH209gItPg z&l4NnA$zA6s{%5V7H&gkdq6m|L(J& zQtdB=k#W%y=$0gG1`>?hOl%vS8q!Jz?iOAM%Nn9p_#LZ&`cY|2%yvQD?Zw$>F89Z*ESPr(^X_GVgH3I_} zXi)C~i;xln^3Zy#mVW<=CERfSwVi&CY;L5vT8V|kj!zP{UvCp@FEj2_KHnN=E>@Y1 zE?D>0RP)j(xoQ2|ZjkWpFWn(2rn}w&)fPmo2*M~b2M_`>F6tgXGgNq@ekH*-pQqng zJ4Sq7$7-|ZVYpLVe?u(o?EZr5JaV&4jz@maI0&XbH+HBf`w6!b5r2bkrvq6NNL|)6 z`i15sU*q7T;14GY5o9GIA@`J(tiylFSNgZGh;$Cohx&I17OktWI8T33ac)&EY7 z_+62y>NPne*ppMZN`vOT$v}GUO0hS#kMd(4*-sBg%aN>whkL_*_8)(Tcl{uuKE#XK zbWK2+yP>lf+Y)hTQw-`)1YguH?A|>n`&v)Dh;s3wtZYmFEk^K&fiuWfR{l14G{H3V}hw|_N4s}fcmdc4wCN2zmZp(XEOe62!Fj}KlP92 zI!Xs2dZ3ZYpp?0pgC41M=k0aN> z*ioUd`uFgZ+45W#ccm%iX}a(D_#G z#f2yg#E(Q4+~3Ue;E$Tm=fU?xC~jVL!=BTgn@VzrIYNc|LreW^xVAz00ARnYN8!)3 zV=Hd${2_5-+s#%mHarI+F>r)8%L(I4OMB%-)?Cbcy>)IKA2?dLuMG^_xgQ~nbM|qB zz{S&wYSTQf*8F^Hj1wVxZ%AX16de2yNbbf5+~93!>K%t*mK=lZhmjg2NBMH7TG@P` z&s_Py-03dH!#6#5>iUzC4UWv(Mnb!SuLA%p+NEHEU1tohwgV&t+{6a>^W4Y?QD1h| zWFrwJ>UHhb{a`8PJ?0^3RqW)*_!ccJ`6GFZ{c(V={qD!z`-oP>(3d6d0~k%yfB%L+6Tn zfwxNDu6$_gsoehN_w4WHk-t~5^19I0ondB39GV!o%?EClU*(u*acv!l`xk!-#7ZE2 zGW0XG((FL}GX~gm+;_myVxCSu-||FTv?&&aSq!C+vS^+LO!avqo>z$xx zT3}UPleLm*ok&SfWh6B

    frE6kS@6P&|0+vTxb&*^+$q;jtbx;9eWe%7gQN{O16|fpi4?s_=HCZ-0ZECRK+g&1aDBTGtcKR?W^ zIJGB?m`1|CnSYIdYR?$Kg6Z0H=sCXa6uv}7#`KE@;Cg~-mLs_}t#_=N=AK5)UHB5! zy~qbf#&7ab+W@HqMvau36=w6Mi2VQbGg%-QnP7)itqN%XO^HU;d97T+Q|2FCKdBeT zlO`XA^uQ?YaA(l7_;2D_mMN{{2Sy$i7P4f=MVqJ0?TEt(!?}fjDYYmaC7T>=fDMP2 zkalGCcR{`;)o2jx_7*IxOO>Re6G7D^K+@C-ZlslrztjWH!#9kK`<`Ai`jd;=YYfzq zF{7_gQ(rV@Vz4mhmybCS{kVY~8VgQP{oPgJb;JzpF=dPKn>h=}j&QelVH(ypN%*s- ztezVqS<`NmHmdWya%nghkiE;fYz4!{p2v;i_rVR5eEZcTwy_(G=;*NMOVQ;*&r1vc zXou1zg|^uu!;d3GEUIYEAd?@Z&}2kb9tb)r^PNx7J=G_KSZ1mPC#}Sf-}%O@;9Zi# zZ-<{)R{BV-SdlPcj1MFdPG`?94LPui*Z#!?Fe*uTZ7w1w;_$iUVU#W1g5S0vJfY9j zY+2q!kcssjHOp2sK081s9+KJ$%O(WUyFHMhpJTsjq#`jjQhdW~xq(NoD%Hq5t`Ya} zsb~12$UX92)5)rZx&ASs79qmr=O!o>)zAPXIHyI1%)kY!W?{=qcF8{EM1tGbg6*gW zu+wK%ORwMi^f7hjQ*p9Ww!?fh{aNN^HxV_&w8j2Yq~s~&!r!i=$zREDamlXxq2{

    z`43;gAAJumx^T*q&2y-J!2?Bo+@B^A3BRd z;eu(IoOY;o+(xNZK#;q2-dve3qP^=rAp~R}8qj{0;kACOmLf6 zxS*+N8Y+qE)xJeAIJy}zF^S(xb;4n@27Drhwx$y)C|^N|rKk}}Lr*)ltO8tf1j=FT zj2ih~{$zDT?8hvcNkT_W^)6p;gwzUvW3u|rBi&%#lLSZ9FNYn%=7EvUX%k4zkK8k3 zrP)x5-P0c(e{z2i)7LuY?6hoA!VV?x4L32JCL2M-j`7xvYqg>d1%FLs#EX!SV7PMu z{y-D1wAWxX-3Sn0vmE?sWDn6VhadTC+R(~qy{hKi_g1}eHPGKbcW_M7V%??Bf2`~H zXMH?u{6J1_9=6VKdSpE{#5(b@gM=7;e-yQEyu0j0%*)*Td|nQg2$LGflMEDjo(efzHF07NGVC7otmnjJ@2&@VvpT?wcj8%gH+L)V_1M(T zo14&!@7Anw4aS3wneMr7YeVQgC_~n4!@}o2TyHNEvV?ueyas4Tg|B@<mCg#mo?FwL?q_spdRp=TWmg=M4uJuJZX=v0(B@TVFS{ zVmA>6VNm#2D3n6|rE)dZYbd7;ov4^~D7Xj8(L9!6=fy`&X<;9~)NF&=r;5GW*?q(z z34PP%a<=}XEeAJhJBgirY>50}g1!Y=<}{)3db$%fe57tL3?;T^D#-z)ZC}5wk}Si+ z@H~PNY1e77d{pYgMQjzO7yzj_?oa@nlmR~O72K85Y9m`C~P5RMj*w0t2i%%dRSo7a}nDUbLN~E>s(b|0`A-{G@^wM17JZ9zU zxjhH8?DM*>5<@0m($%*Da(_zxEbN%${kqg(o1Dt4Ed+J>&$jsREPh#H~FH>X3g$YB`vk6VQFcNG-zry)Qd-|x%`ZF+mSr;4h$fp zPC4!$C&(W*7i1rj&tN|B)gB>@Q3#_7`762KcI!%8IU>PHq<8n7rc6G21LKLMsU>B~ z(##1WTAl;BxR}6eQ@jqztzhPN7Qy$rxr{HirKJWsSMcE)sD3n7#mJLkcY_6NM)g*4 zzvxOc>q=+@VuZ!NOK4_&@=~+{2y$Ry;($j-(Fg0q{N@hEue4v#7Os{Van%;bb#MTE zH{(K8I7K3h-U_E{Uv!Gi!Hi3jl_56(0)}cD%Twes9>1pvU3zSOucRM~i8W<~wvfyv znvlOt=XM+R51-*?iLq-gXM(iYwK06luN6lg-jqdNRmWx^W5g=`!fu{pDON=tTAslN zGy!^=4sYHOQ*t6Ak_*&x3Z`*mv*-jY{7BFq|tzi5?N-~lSB>4m6P%9Q3F5by+^GAPR3Q8as~85&s!0alS}5Q76&EP&SI{YeYE zU7ic8)N~R+Hst2$#mKuF$DnH&3tDhAE|(Hn$>`IAm< zB*FsQeN!{yKlE)>Sus0{-L&c4oiT^$z$+Hj+8voC)tsiVM?;;RPOoqJgvb3BD>^(1 zDii;J8;}J4`lj1?&XvL*=?c#|3#H2O$!iay^2(sHOT;x%fm`6+`<^cweWYlm`_w+# zvqWF~U?LiK~ZX_^Ksm^$|`=iAWv3TcZXYHiD z;e%}aNQid<=Xo6iVU_@vC}O{d7X+fQO*I-C2>rr{7xS~#@=8US81@=+wXAL9({Niuo(FI*Y;C$&u5 zpIG?A&%{5+eP7Uz{(n^DuN4T@xynHAY;MP=Y_RYf>nm5n{w!-eeTU~rycA2E&o zy)PMk6)@dm{c-zeJ!&0?Eml{BY>}_ge6Q0$@wCy@M6*L z&D^&b4!D%BgE9r~y|tYKbZ<0+B3Dq08bPIE=CzdMq=*>fTDp>2QsFw>dKd`zFlPld zZOu3qhx$8v1-Yr=Y7Ht8A5qTq1H9Hq8yb1-H<2!i1hqLwFaSj`5`jNPT0UOm#Y7*Z z4@GlnFBj9`*tod93x%HM7QCJg);YO}*or;N;TE;(xns7~VD2E)}bMFutUF_2donM+H(v4A5S>n=>cYL4qQ4 z=^ha5)s2?xm9-lxFnnx)7;qFoBGy%ZWvWV(uCipz?UfTc;~9efk-kzwhCBL2B_I>z zj;~*UreG?}v;$ELSUiaf+Aazz?!6as)%Z&-0$v_hY;LcKIHAsT!I$+3u`r8Lf@!Cz zXiqayzWL3s@0juoNi)`w_IOjLx;ywg&&UTZb&=UkbEKIyjHwn3s)@<@32%QuyT)G5 zUtAJqah(D64xN2CgqLRbZoPTweT%r-UDQV^z2y1vZ1fmF3#Z(;zBv#IXOQ(E04~2D zONa-n4j7(}pv!l{}$EiG?` zJ+#W_fOBmakSpU`Eov-b3qRvgu9R&yC>+ia73aysuXsEqCCdB^SkF;x7<`KVgmntF zaK2^OrpK-MDIfntg76B~F}A+%i0vw2Sd zmf}uvO({iMtT+@26bhwyX`#4VaSa~awG{V4p)FpDy9IaG0KqK;4G_ZNxBuUFcK5zG zw`Ytq&Q&fl#=GXbGBekj^Ld^*b9uh&CDx~7S?lm71@bT2qky%qF2unCP{)q+Oi}~; zcXg?>wvy(4av!l~e9zgzHU3M!qJCmF2get` z`InZayI)gdH5$_(G@eWhY^@SgJ@s+LCJE&I5YbtdS(UA3R<&AWxiyw6oTN3#5vI{h znL1`4=F(EVd!MN-`r%b<%;ifTxxoQOr3g}LTQUxpQO^~DJh zLny7-{87*KH&Ww=DPGyOt+rk%t9aNwrxBwt#J|cbpXmW1@=gCt zCfghw2SSuOqLeseWRh`r35i|0c^f|BzLVL=Yai(E@3w5UGG;ZZ{qWM4V?WA)fxo3g z_V?%SxNdW|r6S_^Xb*Hj@A4wQBqfzgyc~JH&NI3pCTB)Q0pQrdY@@4W9TIU|2$ah zwAXiP$Z=;@7Q1;pcv-K3We$}Be5tLtg{YF>yKWQGL@+<9{`8~%f!apb z5J60%>5bsJWe2Pp`j6Ln{WtQJ21; z4>njfI$ktG+SOeyl!Y(!>sRr`NB)zFV$@E=bb$ z^{whM{HAD4*O~9z;F_?!?mm6Y^U|Y|WMX23|4ooTMe zAV$BmW!3Pirhb_Lvs_9aacZkZ!kI{%BPpfERJ{JLqFAyKT8a*gG+SMB5S$w1)qvT@ zknarrlL!PG>l(6ai`B;^+Fh--G-=sR?lwyQ5VNFc&T`S(#(w))9xMQZ= zyJEX+#?sKAj`)uq>uxR)N;$0Ts(X(|}p1fSzq{<}*K2yQaP%49b zBgFd2kv7v-z+1T@mF~1G_Li3*VZ1SXM<;<9%s+T9S-zxzH})P_QFi;S^l-C~>l}PS z%VqE{J~s9uw~6|cL^8b0j@|=b2jK`mdK(gN)V1_ygZ0X>zx0oyO^v++x4p&NIG|zc z#d+#m*#QP~Fs>7)68*BRxznPKw>%wp;=2ZOYFa>gL=AKVZM<2k5oF}D@Hl&I6aLsFi6GCsP``xB&R-G2R$txnNane z{m5AB2hBfdc?)(lY;3x+C8(obbg;eIF`+A)y^L|!qit-JavoN7hkn#8+fF)J@>c!K zzl&Na{S>SBkN%-D9QT04q@rBZ=f??gn6-zu^kwDPa@an{LelyHzrKjcmmqjmyunuR zbGJ(a5bcglJx|3xRxl52=V@?DOKY@s%;a*<^fKtNr#2Lnden+^0G-w~t$BYeGWKHhp_mCuxC)VeS|AjaIhZjq# zZc=ghU)r#`fQy*$AE1E3@?G@}1Yd-h?@mj3?x zzn^>?a1SB+t4Hc${*5f&!+f2Fi~ph6xGyl_{8L~GemC{>FZ%93&!W6o!2VC8q=8TJ zI$HrBzES;`I_yW~tnhysb^Y-E0k?UNYjFR=uy@j-Ew%qrj{Vz=F%sM#m2jNoA8-Ea zEnXbd5V|VppLyzpoDiD~3y0W){_e2fB#4%b%jZhWxBhoRFcIaYWPZ`?zjx^-H^BYQO2&0e z1TW1bPH44N{7AY5MB$ITb?mVC_O_@mJks>O5DL1zg7=AUN%-0xJ&W2sKB5fnl%o65 z35%Bu=uhkrwUgs{+9dSpWk=9UL*xykr;jV2=@*R`S2VqhM^nnmxdMRV5iz>jPc-jC zj)(`G zL@@%NU{&K)Igx9X8Ak5RL9$D)@Mg0=mD=Jhd&g?Hk(UZ{mTqO+@0HEElWPYtZIf2o zFTX=FkUL!~YLXEvh>AuUpZCI7j}{%|4UXA-w>c-t@WXV2A~MN<{6}$OHS=YaeRi+I zdA*Zz!&F z^)x=cf%fZ;2g^o7Zs01Gce80ug~RLi{CYISlw^jo^D0np@y=}IZ#|k+TtBlX9WOna zf}QUhlj`Ybn{L*~LR5RTNA=r%>1cawibq0W1Aw)zOX{_(D}~N3Pi`)1zev(=$huFv zYHCCPLaaA1karsQP<&5_`jZfvK^}|fH!Si<)kiyue{Jc3+5MJY@*O|oZZMt-DHv^h zPy?5YZM$`4M!R*zuL}2a3@idnoh#=4P>r@7^Vd?Op7;>_#v$sBG!i39QXtGbmmsX3 z4l6n-^W1H)s`8#B4xs@-^2XDA4t6{U+*r#eh;m_Vqpbn<->1(|Rm`9<+$^{2-L#in zvk@hJdxv*X6Kzt`N`C5=)SjXSHXJlN9Vhs}Y`Yy(ii@>u>f8=-K$&y_?*sa_T<+yn*RCRw19i7QlDWeqXiDV+W~W z(k&1GaWinNn5LN``{?> z@*QrG$~C2wr$4h4NA2o@ooXXzQU>PM`=Cni7n>yxSQWsW(;ebXa?BJb^&M zxZB#L!{?n`fqos4^_x+H$K6Szurb?K#{>Pz^x2qYOUN%)wY6WJZy*k$TAG-8vlZcH zJ0J8tJ9OrLZ?H-rj^6pge(5=(`xV*;=FF-DoREb#&bN&5>!B=Gt3kA~x}1Hl2k+?B zq#_2+x{iB+DFbX~NzDnI@ZC*m zYP5N=L@9X~Pb<(n?~Jpr&B=y$!B0Ejmn<|@##{ZTFQ3e+?7v!GxfS}PJriITPhFDA z(-~dS8kCAWT{)S4JM3g?Hg5SrILuh}Pq46CvjezBpP5e-D4 zsg!AVIx|LrL4IdzqRulW5!il1#Q?N1jb^+!7R*(%%CbkdTeog$!)3{uT)3h_S}O&I zUYpBicyv)IwJR|vYF*{ck8=AJn}^OWIcL>>5sdCbSIr!pVBq!%k#oQEMhxVVrwLaZ zeeLLZ{8O--W6y%jUUXGN-|)Srq`vyXRvr(PSL!4I&SevcGw=$MfOqs&kmo}z^U*C2 z{Y3XpkXgZ<{qcpKzUW|2t$p|-1vTz~?5jh&i@d{ExBr5a{?92J*rImN6JD`ea(qwfEVY%U zc|44jyM9!R?qYPdOM4qm4LVXcZ^}mQWM3j`%-CJ5veMSD&0z1RM^ktMfh+{`^IkL} zOVPbjdO@876~>-nL>*33bCgz-zwa58)>H;0)$EL7#Pmz#alO11jSr}bX!DO#9)^U9 zAIa6b#(vuT32l-vN0b5w7#&}03`yQ(dfJa~dLj|jd{>s*yge3!<&fTbv%7Lv*NQX@Lba1mi{X53+b^J!k1~ZuuqTI|BREXY5fxoE1 zOt}BQRq_Y)7<*CGj-r6dpK{iW@lln+#JUSC!d&&MrVK*QI31R^F10SDvs#Rag`4kX zfA#wh?N$tMRDN6f>`enmrE$%0y$e8{KSriC^eN*C<#{;D(Dpt{_To#O?c*(MIp#-)jKr7+Qn%k?5C8&DvS`xBLrH$VsiBG2`?Q)tR@pR>>=aQD0 z5%M{^-=kUGrB6uYozrPk1>Ma`bhO$~dh8%cHnWl)E4#RJa!=jL5<@rt&f_V58a$WD z+uhSqh_jN`>g^l&>fB&!Ag4p)!^>qK;L#0?dnq%g`T@g(jhI)2ZPz29m#-$@m_Y5i z%|@JU36QUkuzl1~PK~x?i>% zvKxPU@cH9g_t-O_$EzK1sW;d$394F0lG@Se=$Op0DDU!pPc>TB0`Xb2oAOU2eCGwr zqWX0Pow}YuZ%?gdp_TdZrj|a%Ahi;!#K(>ATFgc)zkYotjdKQiHtu?AX1PTo=x@3* zY2)jcKh0yy4kPwALe(uZ$ycT*=0H``-xH0F1ah0}XS&yC)w;7YU7%CcC_VEWgA{{^0b=(zW`X+v-zjf+>OWW;h{$<;@@<=Y;sZo z^90>~wYqgw*1-tx-kMJ9724hKT~&xK`s-;i$F2f8<_h8;*?HrM-W%leD zfDVuE3S}2g?z%5`)8G9%mBAHQWPTRfP(SG=x_DvLyMILld&zZWPrb|jm;av8Vl;Zz zj(!NWl>0BqyVU*VvT0OR_Aff-efkn8B`Y23m-`ccIO6{{>R&0!oZtO@4wRey-@^#~ z!tPThDNV`@vcFcnzaCWH{6lV)5-0jgi2P3ib4_@^u3ym$L6-kaaE$L&c9l>+54!jN zY3Kb5++WR=KU&NGXHwOE^bd9P=0LFUKkeKR_$Mz*|1}o#?>ovrD+MmI=XLsD&fC2G zPdmq~{>h>QKIYT@TV3|Am74yE^GDT_3IAzl-Y9A1MS9k~Inn@DW7F25lX%p@dIThZ z27IQD;gca9zsS63^fl5}d}&fB4{;8{VDsRI8Mc)Ky#plq+?JP5!js$m?-N3Qp!DoB z5(W&Hq*Qv(H%WM{FHe_~>$inG2oiRqIz|jB$tiVamWNSK!yIK`$oMVOhsaN1UiV8+t!$ z4R_)s{wtqznzH4bomR+e8OA59d1t3ks*BVoaKy)9wvfV~pvhkS=3XU$k_5mzif#Pp z%VGvu%B}L3#a)TfchpN)zG|8q?lJ8S)yzXuWQRp+XHVr@{>0z^2+&^6x7BrbxP2;3 z%nz0>t0>_V8RMjTd#ZrCrFt$t<&oGm9EA`*L6#YX9!UU26=_Nf>gj7Qa;LK?jR^S< zOYkyzw9?Glj#n@9pv|sO7gOL&^u1FOWU89f;DPV@qCRd~BIkCR_ALy3 z2z!ZQ*Vk=KJQJ4DChL2@1Xv3dT`gN-Zb)5szaz*ov!kQn%03(z&`P|7TG()a_KC-%zM-;Yi^zSa^b-J&Va zVT{wm@cG2S$?Y@!rUY@Osb;*3Q=)FTh%2CSSNl~^IqMbub`Dq=LOinII^$DdphsGe zcQn$ul5{{nGiJwfW|qL=@Q?V@J`y2ye^IRG12kNj zIbVBiuP2OOS(mRw-7q0>PKp7MOEQKR;>;xq;Ac-@9S<`5p(#2D|0*mVy%@jZ(=Tk; z{iYjUQKO+BtO%j$RJ-Ht@#Ko0IrgVXhdii*R45i}?YL1HYCVY^-sM^{a11Lcf6X?T z>Q?H3qjd|Hk~lMD=DF(mNR#d$f}NecT^e1Tn_L)L|nQZo1JFti>7mGd7xnv?z(%@$3lBb|(&c>~_Qu5BB?2Pc`}A#{0!N-HMAn3rTk4~f=BTfb zc=z-5XM6^k$N}@J4x``r;Kp-oF5X{7?eOMBNEh4dn!9B_LrwyVd?AH+Db;|(axu)V z_wd3W@BwS~!?Dj%Plm}H!-)-VY@V0h5OQ{YXAkeORM=g(bm~z9M-{K=$FrzP(a)l{ z>gvyD^qhC=MqW>Dft>f-m}E7l7I;SD>`O}iysA}8>JL(v#XD-=73RA3q&F~{8~65h zn^23%lW@!@P??=kxtPc!v6a#bJy29wo6_7eTR|o9!RyV`Yt|T1XM6jIt2perQms#7 z{O|}KjhVP@amyw%9q~JV?J76I?_f9)1|)_CK3no)2y)w0qMI04Joz|qmMVW(@@Vhk zA(7Y`llPCFA!5Q~xyqfER76jlyp(p@V|Yi3y5x$tBcGwa?Q<==a?3@SpU#K^Jpz&$ zU6nr)xb#7LvAwRO7K+7S6RovNj#^G)8Hf0|lo?Kn+$*bF9cQAqevyzS+_*pD7Bh%^ z-fx<)clTwN&)1@vlKNI8Xdw?v3j3>!j3Y7U8%lN*Er7e!lJmfAjykswcbQ39i@tQt zl1m3g#g=pBSI?*_h|GXhKWx@nq?w^es$}kp?NpU{jE@bQd8=#J-S%Fer1LDXb{yZ_ zqS>246tnyEd*YFZ0a2ISRJcxC>ZqW}f-wP)|Etb<7J>|$2Kdh%(nLo4xxluSYjz4T z_VsvhD^obNIem&(I&+5a&YGzI1s>AV_4!a1!o=)*fMt{UHtz2-MNe_+RJpm@$K|gq zYxTt6MAdht*-(*S!wxlI=)UDzyZ*IR%(}|J^J=HYneQSsbygLW z4V?0J&TWbA&$Ag#WwseLW*Bh7BG4GZ710$RvL8pQaVuF%!$w_bFbYjSMXbh+ALpr-XV{2 zZ%kCO&oVu)+0~3U3U!%krYnQ(>krqs~1VJ^U?)7K-PCb`Ly2Hmo@*Iv}% zwGXWcqt?p2iPIP%$_^ltS5(rNE?Q_@Wv1Nl%auC{Y97%Hp8Gb`x>cC5Ig!X2MXKiW zi}!*#?hNne0CnIh!Z%fd`hqr(m*J+kg43(h+qvCeDCt*WFO0N53&*AR)&ft}3l3R6 z#rHBblgN@}hD+FDt>~hNo0C-AcVQBWI%~R*9kMDd=l4BNzO$zJZF!}Mc~Ri7X_VeM zk)dx6I5}*;ZbuLW_cBIRk4O<=={!FmA>+CleKeONz|(c zvGqr_O=Abcy$53K#xok>`Id|CO20W(x{oQ;!oBcquwXB(Mi^rHV%N)|(3sho zY1)~ol})XRBLd9sW$|(1o{U@vYTFi~(2p{xO#=XTREv|1&GUrNlvCarst$f*x*`=O zWhH$ds2hyGD#q2a{q-Q~7d1MV)8CCqcm|_7E;BlPlHCO6qqerKje2ZbTV+4qXwb6e zDglDq*YDPf8xI0v$yFur9&x$X??Y@6CkmOd5A8o|vF(TvhA#$X1qQE~FPVTPsoKsY z(7rHANnp_&@{K{_1PFT3frV(br1gMeE9AuPLZcO2Ao3J*B>-kr_=2T?a{=^J*9Ou;<3) z*wJ+IpXb_amde>7Q8fT#@|zO!VNZBVJfHD^G6U!YuNhR)PHi#lc7?Z|#5$OmC{9PN zu=(VZc2JW8k`H|`XWIuDtp$RJu^Vp>ShUw??wVt0h+d_rv!t}0K0RtaXVdqa%>Fd! zsVw-ohAO0`t7CtL*N1EtwP$&N>%(U`M+)<=TCV}G4U{;_mvKLG-5TkMVPP{HHoe%k zb%4xdJm^ZVyoQk+&l!QkIl*2+E4RMn62dw=izm`c)kvXQUPWo{3!}$**g#R-J|eD3 z84&eK=Kdo$=hb2Kl5D`w;L`dn@JEjGri7!-r|m1Ns~>y|s|ZPe$GB{{h(}8olNAVg z08mxZ2HPLelDiI68DP$i|~I${wsxfEKU=Qr$F{V&_!r4I~-Cx*k1o+P(=&nXZGN3Um) zpJb;<>ubHP=|OJalCXf$b2)Oa`VB!*o*3z>^223}og?x- zn$X4amLMuwUIQa8Pnc01Z2Bp{0eNbW=Gvz&`yp*a;t@=KDNGN5WG@;O#qZrZZ`bPa zw<5Yhpd{xW)gyO1F z2+{66-W~$De~5spR1noi0(LYR(;pX+(Zp85W+td( z>m!OcmuZX8&q4iL-%Fw*d0w=P8i!Oj!{Vi|ixgHme%0u`47}W(c5}>hAD|$lhjke5 z1FKxl*_72ryV*;$O{NY86Su2O`pF3p3j=KWKHJc_i*UX*8fB}jxaU})bqLN~B&z~b zXoIXBgE?d_oFB0WH45*S$SaR$6-sd!KUu{WG z#p6q*sdh&;$|@PWHQc!gz2nRAw#O@PFlNGO7p}c~z|*khktJ%MRns2{j+|0kk{IyaaF3kmihzU<=n$o22X=fT>gzlr3S%8S+bSJ zM_f{YJMR-n_uLqr#xa^K4_yk?(nGI$0dWbr0{AXCML%d==c>|#b{wYI%Hb+S=L@&; z(!WMWo}V_gn#wr)5dwXfL!NuJi;#fUcGc)B>&Jow@uyb+OQFH#9P@6Bc%@wO0f&S3 zA{mRS8j*VMhHIzi7%Ep!s?}tE31Q^&O5q;6Xs1^&h(7}BHe0qFrMo_}WD*WN z9JLw}6|-~L*z~UKg33XCbY=A}BI8}yp2)R%6)3*{6nbcw<#NuNM!?B|%g7sJKlyze-3+50=K`{zeYVG94$CcoYwb zk!AnQ>2e!grTQe)!aZMjY{)g1gNIXo+2)a zry{;l4F1%gvnQCM6VR3aR9h9%j9Ip+$a47J@C%E$qZ=qq%*kD};Zu#pS`P9@_;a@R zr%UoiwgiKRz%rgfmnRGtuFSTV~fjn1lfd(qF+91DJv z^OZN1W`8+F>OuH~BYK`>rMtvJqh4P5{&ws_l#Hb?B8uramT~u4kmx9@BaPpL;~O(@ zuikhjt81H3)3GJF8lbbo3-=iG$bMMMWYa`!SDH&GD(qXukoY@hMvDEA&$aslAwVi^G|JP*y=W{TdCDVca%|Ku{JwnKs!5%Z zB&FOgqa9GJ^(Jw@yeB?x^rg#nW@?GX+(sdRYA0S12rGfUFiB*d!r=?hW951MHGOr% z%Xr?Ae4596#s^HVohdin{qeoV*R-zRMq%+OCknZ|eOPJ1tW~-gr&*-=6|25IajhHc zwTAN6tIjaTuz_g z`WEQzdofQ%I6zNCVxY64b3$twlY?U$Gh;O(m40>WlUo+zH)rzJd17yw%5OH8rU92y zfSO>yhwioF%}Df1VPdqfGj(QAe%CR?N2%)Yn=9XoNh&C92o?Msz}0nKgd0bnGAQHX zBQt5x`MWFjV235zBq`q9ipg2>^RJb_G8q#8ZrTtV70neJN(|(kC)t2;(bklp5$XG*CmQV6w&uS|5K(-|EqGwL}(GF4=rZk}E-QU#h4&{{Db1 z+Z!*euqwNHRIPus3r7hGnfX;=>Xx#cX7PKnuocmzhIsQ6uNr5IevxPJHm?Ty%z~Gp z)_6pl2lA#jrgOUOinBcb$K84SXlVE-o})MR`?Qe_7S*mzsOZQig(Oex$ic*e)n|`1 z#HRcN@IC|3KRR1UwBszx;H0Ga*(rNHEr3~O&hNwyy8XF^1clxU9-}+%4mMa-#hb8Z ztm@+?@Dc_ml+<&tD$9HG^>=AAq8SIS%}2(N}tiGl>THRZ@)OxjJuUT~U1IT_c%Y!o3^i>HL9Wn4$m&;sEp` zxX)z>6>*CVt@IxqP-9R;n95vuwjfWN+}&vNN9%aQW<@gBHurh;%#V*OV(rJX_;FK> z&;rIM{dP8QSv_kVp(r%@D$3 z19KaCpZH6(H9iKmTs1}v&u>|LZ~JK?$QYU>PWxDB)Bkx-q@0|LZgoq3)L9$NN=*X*KU{eir^at$k2Kl)l`yW>Wr)xCv5C9VG`f!G zo6f4Opw+IuKS+(j+z-;N)MWe8`C1;Xmh3p8OvnCR(=-Bl9 z4V^!pjdp_!f|w02_m4G4x(>6Xn$~8-5hcI8^?iol&?Jas5VZ2+fR_CTRPHF#Kxg@R zu>qrbx^@e?fnD)H;zzqFEPldX!ki7t*A0$j_jp9zo~-L+IPO?lAeRE+_gGWO?Pu&| zLJn##{7)@g5|tcZ6wBL;zm@7<-`d1r^OCi$TlmJBP%pp)T8TG4C2TKH0|v43Vq_@_ z6`e^27q1@AyZ)f-JSI#Jy63%7667{f1O1kRlXzN~QW=2{fz9a4KIE*QC(5y{i=0A{ zpTKyNtNm(HHHg!ZtGsnnYsm-hhrEGR0-imA z+YgwFFOA?xxMTNVtBnEBzo_?#@^c3sS}Dv@Rbdw+%F>qnYI=i=N+Dk1qY!TJ9YGHG z+NSwxBFXb|vsf`iYR9+aq)$-+wgB+W*1Xlqa_LWw@CLLCjNa12QSp)LX`=ktt0(jh zJwYt&-DSIfFo}n(GL`n8^66d(;83=INoE}YT*UZhfp=#Sv*AYVAK|SLn!Jq+MnIEi zC)gz4njTm^(LM9}T8^7u5Z`@Xw;XbVK7WGtoUCDZkl9e57)=%r#DTUR`s+Q250Vp{&906XTSlF(<6v8! zuH{R~5F?{=o@M6x`Y(Du1LYDu4Ekwlagr=a7MrU-YDy38-p`;+mgEJJsIG7!3?Mpx zTM!H#&eS!mWCY9E$l5LF6KJY-nn&uyXk&mf@;z9`fEQd3ZP;AeQf@qwnt6k!SIy}! zv6|~Q`muSIYBi=ND<{@gUwtZ%%o8W9fUA@#X8X8cuN@b}y)KlXB*&jqgU62cHvbfI~C# z24KnVw{OPJzjh$kJM;W0=R5HFb;c{CXUif?XrYPFpM0h}jqg(|ubUc=_KB4aA+Lk* zGNWl|D(z#jjZlfeE$k^5UjK_1=H^ze1k&X?+t&{Ze3w%`uCQ@eb>B3UQvR?2reHOn ze5s(o=X0*uA8&d6ZQLyWal$V$O1It{Es3U_Cg`(kno&hPp}q1hzX_)T)B0S-o}L<5 z!<=~epie3aqe95CSazK`2id2m#e&v5fF{6D*5#K> zb&1gI8&{OxZ5<~@r@rC!X0ei{zp96J>iLcYJiX%dwO0qO2%T^D76!LkzXvQp8R zLvhiY-{}ulhZ|%}FmGa`PrL;Tm(67;jl@^Htqw?&C1|?WU8hz#T7@H{OY6lHw`bak zA10wG@+V(?G7b?}`#B&f?(a&4cxuB&+`xAVUYXxCnL>;A|KY1{KZvGL_W$&(b06NS zB+WGO+jsq{hKg(9^A-=ML7nW+J3-w`t9y{OG}3K;y`HBb`>g2e;Q|W_Rn<7+ZL8(B z$1Gy6{LaC4R?;T-fL*WzKhtRWgpU)o287l64b$=shhY zn3p_1Oz2rK{!MTp^L<~AmoIdWa$R6l(J`Ouo5ba`qZdPVa#aP@K{EHm;W6%qWL2gO za1HSdcYO@gKeNk}=gXGzZ67dh69OW9uE;L?>TjF&U%xZ@N^8J(PYq8zMGJ3#sCu99Jv0o=@cU1G!;^d1*;f272G2hP z^8fGf-2aQ@;V*s9UIG4);|}^yR>-}C!2WNd|2?PU|CbOvWc`1X5d6QtwL2*R{pLX^ zH;**sEuOahgKM7u(J@$ziYO#Cq?!gc58aV;!ytsY+7kB99YkQ9N`y0WV zjJXvyQbHtIT(|L&Tt^s&6sGJNZz>kP4f5CVR2Rt_Ol8yO!;(_UBPqZs;7$CQ$mwHS zp57z^KxtS@0mhlN=KBG1Czx{{; z`#>ME?taX^`bf-J0&`OXsqNu?k;hG-d4~CgG%EN3EoO8_T20{j!%RsouBHG!`Mz+w z%9gEwVdtlPPY6tyzdciW&GBHs=KXe7Q{%5jmj!rh8+vaq=P0M$S}>zQ?bp@h{n$%h zKX~hnA;~EF?6cLu3F8%sk^$57XOTwEs;bh>SrQD{dQ2WQF9*#(t(mkqayIW3Jk7)9 zz=#UC|H$gV<){J%6Wm$a&$d35)zSB3~X7ebykyiSI?w z?bFO@Y?0gRTeORWmQ+^XxVhrV8Y|mTl;99%;4ak(DrfMNo?VnxEL*vE|2(h#(o}Wh zf+24Ex9@)NU+*@K%P{g|#9CDFl#{HFf}#GH8!ms)p@%qkL=ku_osmubo+oIAr{$RZSUmX~c+or%n@Jwj8V=}2S3O0;d!gYu zaOKsNrXvWEb~A%aktPSmQzg%h2M%`~B$Z$%e6ayNXf2Vp{%^B>%bbwq!=bgGH{h_` zB`<&_i?it4a*)0g-vYjkXg6kfQbgxEX6sd%p3@4YW021t>5<=#vz^bTyXRu^_SzVX zgdYGhHWmJSGQQNBeC0_nvhT2s`6FQG1JL0H&FxtZ4obpiM+Lsn_dL`)h74XBUyqs9 zpWoCKIGPf_$+*M(^}2rV8npUbaxr0eOS`|J^*tuV!#C1o>X;OP0<;gO=W_eMgDJdt z-zOcEz#+M){w7kdvtnf3;!*gdaQ}Uaj6_copbI-1)s@?xRG`tkHPABWb8f+*EEP%* zL};Ma6Pb`ddg5Z?z1!&ZyY(3yVw3Hw)b++$qgbt8hSrN7-XvtvliGc@as_y2F8EBI zup3o>(kNmAPfle9UOjU_ZS)?m21foC_T@%oUkUnq&1V0Q-1p6DvS;CGMDY(X`r@ix zsL+))TJIJ7X}jaHXgJK5I#_T`PyF8SGPdn*UHc`asw-{n_6XQ5(gwycR_$@lOCW}I+`u8T4%Y;zHgGfTcqzHcLjXH9u!~*Fn_ON~ zsD6*gv9m^7KWeJa40*;5j5E3%Y2Q|c`G7C6mJod}d74qW&HnJ3x$*gk@eYlRiE89^ zDli^L;amOL!mJs*MmxWxKe{#l`NBh+YJ-x4^OpbhVkb71Jh~f!hO>Bn_`EWmI8P%n z__zqVo(a9ByU1#zr?%(#$oRR2u>ord<#-p?85fPX8ui0qtPylHS*q|kv^}oNMU$d8 zjT|AN+qbMt=yA~ThOdwVs*~Dj_b9ec)69>u|DXYSgDrI#3!o98cIr9;`)^xf8dXsn zU6+vLN2c&So~_YtqsqPO!#NHHEX7IYq6F#_MBv(%GQz|1VN6{WIZVB_z~f?EjiEgP zo{k0;XzwyeG9r4k@!^p#_T};gw*>jmUKJyhgrT1Yy~XqOU$zw;N11J5qu^5oj#mb6 z!*7nW;b>Al9+af-1urxnJJ+J@D9niof%?owk%=slGgaYsKGJRLxmkHu|ra_&=dhI#j zVt^&VJddhmvcTi_bA7U6-=5ICV{R1m?adkFeY0;5EU>{JHveLBHo~f|Ng{!Y2CyVm zy)9i-@thx$$kxXI}Jp@j~^*UjWqqp&T&ijA_}*0oQ%784kCA@Z%mKld^v^$JzrhFnq1M%d9~Quz__B$e$jf(T7Q*Nv95Lrjn_Vy50>=d zY2S*oq_D1Vtkg^Q^3(b&iqJh|y|8ja0Q|P1Lm8Hc^p0CeTB+}Dl8kzQcRq}V2g?wq zmW1JNpSYfo9-lVKiEYkougOnHh)iz%e*2}~=k}wZ>+|BG*whKfv*$og^c({erIu0DOriNCHs{*}GF^h3Ry5`O(;VPqvZ9N>#fa(f1>*F|va zU&R4Ce4wq=j(3ysCbL*1Yir>Eh(R5i0DZd%g%I7rWRbVF7cWbNG%6=&Oa3!z+t%*Fzj#_a6 z*WKW7HPz9z5NYCkvd-+m35w9-?mq0f zpVBJRs>kI2;dnUzIG(BwKwI^6N`iWTt1&|Pey{@+q2Rd}`KaFZPBh+TgDf_X$aDXE zc2xj;^T@Y#AdtS?hfyt8aVm6HB57lnjEkll10E62acdI=|0ZRcR zVGq0k;0TY?Is}O^!VYE1L=0jq2k+A#ry8NOmm+XinlD|ZuqFD~sH))UkLIrSI4f<< z{1gQY(^)@n3Mej}R*SFBqg?boIvl31qb=qor;3dH4wLKQj%f1uGc+?#+u9+r|L%&= zp>fyMb5tA}6Uz+rX7YPbw{ju-EP9D_kTR@2EOk9ryOj&W7 zJ9dnM@A=V}b;-)6Kki%n59r=vWZh3WxC(2jN0i*fj8b&gqcaB8VITnjpDGjade*FA zY<8A9syFqHDxHzH4;+EzY$Yjo^RK9RwzdKOeHsG?SI-EAC{*q>EHr-wL zZwAh6`G;M6Z{Pp?c}MiDZ^o}J4tUM!5=NEt$_pKOM}l{fG7uLMKJTy@vDPlM4CI*V z8$#ZG%X~CK++ZC-Y~`Wyc(c~-y(h8$>3(0e8OXK2OZ9bJ<4q4vEQv6A*m~HncWXz& zj8nUN$*@H1`hv97t9pEoFAaZfD(~gIs(96Pbi%2PJ{2@~Q~KrkWUyihPUPap!%PY0 zbP(A6ac*v!M3BOo@Aa!{H-CXr=BXJHLs#$xTaWTf*XmD+tqlfQ(^P2Q#kkO_$tWA3 zYGzZ9QdPKI#F;`9(fp$DEm3TwXb>6mp61xy{-x{L&`GeE7CkA=C3~5H7X%%;L%ecT9lJ)Lp-$nktS=ZUIuQ0m_Z~VWU zpc-{l67cK)fbjps;_$LNvatbpkHlW^-|qhVZvXe_jyiwP@Hp_lPw^kH#_8Q_@e41b z%v8|7)%;`q&xr6p(a-;<)`Lk&NGRm7CEH`*E09J(wo2ImVlz~1I$gz+GhyWCr_61% zxF;D|ox}?nS&z;O^750|>u1je10H=e;tC6j-xJAf&z_5ZcZk;ia;*yUJ^4*bck!9 zRK50h?evzU@MFzuS8^gi&3;$8$B3xO!GVFG;y#VOkhJ2Tk1}&A9CCC^)!*=R6Q@K= zhj_$@d{2wAro>>2EJ=FKb3x+$h+LOG#`B~mvvTaRD5h1+Hx)EeEe zMX7R|jg^>wZ;erJhhE0HT7T8BrkNkbK561)cj)9Y8TZ8;!`H4Q!Sgm8bi_@%e4He} zmF%4vF2e~DieSAkDjBX!JkoY*e^ay{&fpqt>tz?D0T78Qh*(_$N>mJcBN#^N z-?Jindvi^qMJstP$giU01uVu1zAY;XSj|AY^+4y$@t4JzH#{sI;p%mU$*$=$yA-uV z_LhGMcwEGjFA+?^iHBzu5eyBcYxrtwHM|_-<|G^?r^hEG80*O$m9s9ili*y#d&`E~ zM;mDl!m_!eZ7?IrRx$fN&35j34^ln#=gv56S}ftAL9>+Ya{|~uZMV97zV+~9w1wR{ zM2tdq-xrMIW8rf=M+CTVIHwsfO+(Mdspu6-^vScL^|kIwJhA;9qE8_|8m|lskhwycw zsbp0Kyy3n+G&@lrVVe#1V_&AT!h)tNHtqGQ6#vJ^dCg06QHbYx?!^k!sz;Bs<&J58 z1~q$eJgNbj;DfJ4J9E^QnJmYdx38D?nR}agzdCx`lku6(&(1%(i=gK;c>6ucJAVSn zTzhR&Ern>dn$Jd&3zzou0{6889I6%E)h?9ZFB~U~jaUY1LTm0Cpv*+*$cB$O&xZNQ zk0t!j5r@xsmbOdm@}0`wB{S}xiVoeZrE@-Cu?w2n8wI{o19`NC@a6CdSdQwhw>lgD zGNp8R75n2C7EW^(Lb>1BDPFA9uc&DnvMd<&RJJkG9I#ubMOJWE1{Z(aTDM-+7G|TH z;UJ&i3%~zhgN>)Mwd!~3$vm)fc5*x~P$6b6c&}J$kgPeb@fk9Gshtsb;5L$MAQ(5% zQi6aZ()+GoZLJ5UmF*9vTdKRUmf$&VZ{kc`y0LN! z;7s)$ZXPxl?_}c-FWsnhVjdpeff}p_t==XTrt%Cs4t-<3d$Y8%xGUFdnJ{X~9y}^V zaPbk@!4b}_K=)4ciAUo!LEZy9EEBTYW3nd_Ls^r*pfLrV5IsvAr< z)CaBd`RlB*W|2CDOKm;-{eby)1j68%S)OM)=2kq zzq6@pTR?9y5B+Jmz_f=W8F`14p*j{7U-<1C95im=0K4~?C}?5~_c>Dhp23YPB#NvQ@JyNk>PMH#I?H_uLUm2`zoh}{6YfzDzzq)CGzymv-|@KU z6clxq*D7>*+or*hzGfaW3*S-L&h6cY8TZ|rO7)(M2~Spw%Pcbp(#r5JNUVC5dZ}2u6*$ep zi+<bc#VNpSA{RACa0}Q;93^C%B|4_Zbzk%B!Fmh&l|D!p9QTuM0)74ZPhe`pc^P zLhc}-?%dq-3G3z8yO843_Y}a``59DpmE|1o$`2* z|0Q5Miu|g{_#sB5uG&PehTr#npfmfh#(CZLs2b&4>nH7DYgk(M(1FE0=QArwu5|}` zGSKFszWoELCOq~r&ZBgVMgY(ZlXz zetJG@Jzs&m?B$fF;fbA-UNDns6nT1wWX6*v-#ogu@aisDGT<`2klu!IH>ZoJ|CGpL zS`Zk$dvlAuRH@Ck;IFhDl>OX_?jf`w(qHJ!UHVOS?h15TJZ69rI1O;S;NMTKWLfT7`mP5Zq zzMqquE13z%FX(=IWmZID2})p+(wqKyPl9sqO~5U6r(tDpEh8clmmTld^X3uzR-<47 z4F!en=luxs0~el3VOx2D(yg+=zJ$8M5Tmv@16W3;8iY2yVT!Cwo?j*xIwxSWI*QIk zo|i5;CmSSL$i2251}`R0q@hF;*R~4Ti6{(&XC5*a|;50bcw5yTpo(scnmsE2Y@ z>+|AG{4DUBQU)=~(|F6W|YKbBBP3UCgJ@GM!>nr~AR``id@sGeTN` zU56d=9l_Kpx({Iw0r*A1!9U6bBjPt$PZKPUh)Afwz_Ab-XL`~DYxhrx8rkQB3OGbo z3*uy8>OmnGv&HQ8dYnmJ5xWV9B9?0giocSE2xqQMwga?>)JFkC2e$-iBFwqbvf>18Fvf3v886IY6 zRmVLM=M6y8Smr&;YI4GZO4+_yw@~FcFoDcWXA!n#<|i?DJg1kisxPb8FdXe?Cx^zz zOzuehWdu&h@+4r(?^{Umam|LIjnhF1pb$&)?9ruBSo24-lB#(O%j8lywBOF}ouyKd zfXWJW7))85F3Yq{Oq*fk@Pd~L)JsIp9`Ccr7z zmKr=KiVB0!dX~4*q?sK{0(^xe8PM%vQH*&ae7mShOGB00Z@yT!C2uM%Pw-c?>RGp$ zn*V%T6S}3y9(1}SquHI|aolxzt{9kHK@BYjS(*LiAM|sLw-+7;OD80;j>)rX$k1IS z9D+XOd*E;_BOQ|+zg>Uj>PCMlcfO8R;<5M{1-dtVPC;9@N%HhoD|^jLhFIJc0V%Bf zw5*jvpf$oY6eF;ufH%ONCPen4pdul>f2o>#;2SI5DkN*{hA1<^7TlSZiR0t!F$P2v zCN3~>y) zU5}FGI9OA%7in@f{oNPHj*sbzqu)C`wO(5X9<{>KAkRl08IB7?ut{aPiK3LWe}hMbjQt^{rwMo6ET_>PHB^DQ`Q# zP=h3@8Lqu))JI>;x8Ga@?`bGsmD5ZDDL_8oRTeexqi<{f&eB9D^nSNLOTIy5QQ6zW zcz@q$`gaG=?%`gvd?uY8{O!(abvCdXlg1t2nta6r$3#W$*M_x9C(&G!ukf1mB6AW> zEH<{Wr`%3v8H3k&x~bTpH=Cn#QPSB%1p-AWJ>q zQ?&4aFPi9vcpp-JB3<*Mio^P1-}FY*#f!8;$G5tyLo3OL8TEbd03R&|kaZQXlvE{t zX00*8zE@QcJj>H)3G}kIIvzZ{l>>oIT^Esw1tnNLltvDuE#-j&TvUtR?9<97>4?lr zbH<(RosuUT4omwar9F2VcZurrF52{(QvFTo<05>qkTU(;2N4GB;m`rnjb(7e3byL&d6{ zYOIaUo_`7d8(OVwwHrclk2tKOqZz}tvbBVqR}sGZVyKiL;?czK1kFbZv{Ct5Jc*ti zaD!Rr;G)h!Xo(42yI`mmSq_24R`F-aU;`Prs)Y`?0o~cgj=#5JmmlDc4Jq-Z2S_YL ziIrbS1UiVHnm}b)Z?UQs%mp(}X`EG4ow&MK+Hj!RIz+p)z*we?)fCnRPeA`qID-Er@0epnUYgl?*XPA+t$G5aJ+z=My@ z#R|dT#6Pnl2h{i%E>a!4#r*?++UnEi9b>9thT~eM!BiFU=WG!N8=wWN*-vzA*Gi4P zHKLQ1H7uaAZ?123*r^*`^QXpiv<)6ne844y*V(0WNDsPJ8U^LQ4Va-cKbz)*~KOS+TnU{JKLqXMxzaCyKE&mG7(%N zj_f53{AW~Fm>wsZH2*x|;>JbHzvgcCj*iY{l`uLZ?E4JVXl--BFf_9sxrm8nR07vV z;;T)hu9i(PNUP>BQkH$+RiXmBi3A}N=;fY-(bT-WJ4>Q0QSXLv$hiih0%sNfE@+FR zlY3lH!jm3Ylv5-7ee}*RP*=cqLBAwgu{^R|!c`H!)O!Sskm$swPIqvwp)m6mX_mTWFSQ{wNzpa zSL4piw-5?pNG(a10JYLCsBZ_9w>dY^5|j{imo!9}M=;m|HvDW%Gp!Q&i5lWlym4%( z(GEgnM&+a$yPkL@*g8jP*PQxTRD%}k5-e0+kjO=x!b>%mtgIaJmwVpXv(D5-sAY!F zlE<>>*e}X(kP7GsCe+8cHhuGON=_1vV_Fw!s>MR_@fsvF4ygkA zgjx!4C7YSbiMJ#Oq16occwc4{a@M7Jc$%@T#Z@xZNgL3R8*msm<8KbFf>O(<1Zki~ zpQamet4lbQ>sBpwlP8Qc!-x*G8FDJW4XcJTFq>8Zb-clAAumzO-gZ`~4f@dY3j@ht zeD^gQd_fg7 z_3evmOIG1^eM}13QkwcPcmaY(W)GNCF}(h7>y5_a7uApT&y52Hzcbr@oBJ^~23D2# zL3Kr^TbYS)scnC!Jf#enl(e&|hC<>N7NNOs5tg@?Eu1dEg+>bppxsz{bgT7w1s>sw zZPeNZdl=p_`PA&Co4%x3hrM;8-%!J$g+*UWD0h4q-AMCq({u^y-j>QTu{^cK+Trwt zPGn2d!5p`!`!T04UzyY8lMlrx6OU7eb%XOzPp%#zsVCUVtMe!0@&~Bv-D$;}CmOqt z?}2ekCj$uTrJaA;MdgljE#EQO{6ZfBVe9|cPvPb=R#_9WoI5RG2nidxV7(x?%G26| z=t=7~(7uc}UK`?qHgP|g`nRW@J0Ge(3^Ch$cuF7su}JRj;J`;w)tMHf%VmQEb+SJS zfB_`aXc#9XmnH3!rFribZ6bYJS7_IZlH%i`@5Hevq>#BoKcLAcpPe+WCZH!YKacP9 zn#UwvANWS!wl_pUY=WAL5*Rp{Y>=?$JLS7;4rLZd0cz+-rCv%KB-uX^fdo^HB_%|P za)F&n0+MaD?$@N`l%u9?LA_;qKA;&WQtpO%ICiuvl^u<>F3 zWKI$dx>AdI9*~o@J_BIy#402?B7{~4s&zk%ku4`@Gxa51V3uDiJn_yIB$XToQ7bZewQg0znUitMrx0Sy}JCmm*h7B_xNto^K6A&^Jiv!ZOJ$!ob8(d#PGk z+>H6a`~IqtajL#FI-`GelaPfS52b0sBv&`(&-Z=(>S0ttz5Md`XXcB=CNBw{X|UQ^ z3y|rV#lb}4PSmV=C~Ymy7GW*>P{U<4K~0DeTYR}HUJEb79$-*WsjV36oDB_ljH}(m zpqQkcpjKF)BeGsU3Un74l{?}ZAWW&Y7oL?n^$umA>Ee~8IcN!{a3>Tr3CBv$&e>=Q~D65BcWt!s8T*q&MvBOYXPA15#&R})9I6qBT z+$^W!ph5D33N9;-=H*Lgc96`T%2P3*vc3h6+nGnq%TnIf7xGebpo*Zk1l~(P`(kEyr-E;P3gE zVDt8fwX)F--q3Q0ih4B&h)1{2v(c)lnzcdj5XOL0RLU&rvLYX&His|cODK?@0@I6h z1*g7moAh{Sngk*YXPboH7VbA*rSuSU4jlYdV|Sg%A1;`pwc~ZfJJm_HATo2Qq(u>R zPVq|iD7>fL-z{At=j+uZe+mMy0@^q9nJ+YjBH`lHb~UbulrtA1VL42BZ{sdmz0lR^ zet5WYAf9@@u`tGbXWyMh_M#+0XaZZtILwA&{)wBl$m3S?5$^ZKn-Gj)>j=Xz;Ma_* zat<=L4Zq#t7bh}Jq)s5CJQ&ALyOnhn?e$UBWV2s}CQ`c%FzYFbq42@7dtqNAj<^b= zHWm_!H%|dm-wGGoQ+K%W#$ltfmvosUhypgcZlh~5y3{|b_L-H~DJ{Gktu5BLN;k#D zpmu`>zo{oCR686UDDwP!N6eX9 zG6UHnsvIAV$2wD3 zoP!d4IXK?W)JM)MoIbIh?v7Zd{@Os~t3OcE;bMJkA^$$^sl2GAJMU*cUu(th=@RS~ z5R%J6rshC$cHpxu)A|M|}l-8`o2x;n-D%-w6h$ zCl+a1zXjN9#6oh?Q+jHQhaAR?+AVVul}jKhAV#7qo0KLctY8Zx)PZ_~$5!}{16UIfIHBe$rNC9~oq5S@eJ=r!NxD#P$_YvN$Lq7sAE7B2-j>qT*` zebgP$!n{lvXijURjA%VF-AsK7O~A+R`zApjd%c8J9e#}&GdCFOe;i`J(I{A58u>I~ z{*{pqT|iOn*bh>;EED1L@~f?emOU#5Qe(67cT~<7d;M#rgGx+XeYa(KWBJiHd5Rk_ zWL#kf`%N{iLzgC^iYsF3N31e0IX<6}*Z`ceVT&~bb#!r+D&M~WR`7zYE@M4)O_-;R z>jW_!*&jIG?NJM$Ms7j_Gra}-%*~D%GPw~yoD;N~_ekjJPzHXl4=nqE=yfUIYb9ly zxn7&XpNY?VxDDPFN(j3##vgghESC}|XXD9Ed96=~vP7ZMyE zeCA6oQ{iEBQjiQ$OX`pX$f<-(PnFOoRWe*EYcWz{X4m8V7_NnqCXvNjKtArxU z`bdb2Z*0n2Yp**Kxj|;Ds{~)#OartyaFxN79G`NkCy;o4If%n9DcpKuCrpe|%A5!q z3rt!wZzHa1!LW45%L`5_>9YTMB2@|+56rkPXk<^!Wwt58t0$1K6K*5UPqP%G5?PV9 zuaCMoUqrK+rH>Ocg)x^f=?;AJrc_=Vn(7l7@Q=+jEW$jJSlK!#gMgHQfZ*o+{L_MR zIi9pVU??)qpmF{6u42UlfMG zBIO=Tbq`N?<21+qu)}VLfrq!ah?%hzQRT3NXr14~sSq@9iKf9_s(MvDB@#FgU^w1l z{9ypIolJ^bjiR5#*Be4qdFB{;Qv=!hS`~gWGiNGT!Ay_LG}!Ei=!)(5n*7E$h@bjz(@=tZyHY?# zb@rm!FS-G~7JFFfPc8>TXigD|ph;lW|V@8 z?R82cmD0XY6tev-?R=Aj57^irM%TPEw7caJJ@k$B-Q;Bnd^*~fY5Y<)I~g6DSx+<; zrPNc^m9ypufv=cE+h@L^p%t*DU1QP<6vTs~d-%@2IkwOS@;jYL1^PSYzkfhBxw8c^ zp(ku-BhrH}Ad^n!iR|EYH%Q|?#mN~8@US+I1pF5U^&4y)o)9@%N#^n&*qx=ZcEymF zl^2-e^0m_lEOgsTflW!Cn5(n+=BHI?_E9q_Fip`a_uCyE3S?Zr_tO;?YQ0E{#END6 zY|`1D@3A=6eYGLU=)DbqG9koOl4?OZ` zCtA*N$^lou?|c)J5koLrSwJI zC*U*AFTy6A)5H>Oyjrx@xCyFqB5#!Yd4zdKaCrz1!(i5)`6%dLm`}Fq##r0PFfxp2 zcn&>BZ#ePPC9V+qvh4!u7hW>Wjmw*~d+Drs#9fFwrIGC@Iog{Cqo-j##+MxDV;7&< zHA*L3nQr9x_b5p+2diCYg7PYaT*hM;sj$)V7cu3uRP6bYLk|rC21J>Eq>D<(4QZwULRecI#-F{$V3oIZ8Yt@lVZ!3LNK#`GB=1 zT5^oauvLA*8xucP$#n*QF0EXB1@~C{iK1jdZI#uedY|B9tq)dvA~)N~ z!OSC>)hR&a23Vpo{VGi9uF_iX#7KF&v)K;s#4~%bK}6e-jnrC-;b-!@C{2_qF~iZ; zMS4SkURc}vd-~%FPYC5OY)@iWI zqb!oby&9~zxAERGoEn(G;)$I;|jd(ly z>#?=pXw*rKf>{RM&?&g?=Vm)36pk&3s6tl>28mPlmNPrPe0-*Df=!4y$8it(5JRn;3-Vi4rT^qbIH z(@!8*>&Xm86J@9+#`2^SCk3Zd!*Z!c+G6!=?$)O&?DW2i+|@go+(+SZQroK<uL|0{zY8Q_V}e<5wFtMOMzjgsui}k$cFTk zdZm#+(l%2E*nMn8Kl%GyK{OX0Id6M!&wvX;b)p|{eH04#y zXnSgO=~m?r$7Sa2_xCIf^`#Olmy9n;-nS`9u<`aD3y}v&T#z)*>r6o?!F9xF>1Kx3 zF#VYb0FZN9g*tv|A91ezPP2RE6mTY}+{3FT zclK&be<)mngL``mmXZ8u^8MZCSmsW)frM&+dy@#JS)e~F(@;Zp4zKFU(3ESF={Vpr zZKJN#i}fXLs3zPM@b_|4-Ze~xefQBE$%LZcnb&!hg#7eI!FlbX@=SHK`t<7j_`wAG zPmiIf5g$84x60)No(|s=HDTQ_ZlDp!Vc$Std{F7w- z?7;jo{b{R1n%jZ;e(Iz+4M*x7WW_q{gBf>PTl(^r?H;S@N;3Af!{(+5t{{0uRU_Uu z4N1cPqd(HXdL?j|=_ho8ki5BY1f+kcns{of@T;IRD@k#bBK!+Sa_3%NqPgX(#(#5S z|5L(5Eci<8GlC&~-DCORGPwUDJq88f`Bb6&8eYN9ss_q2i6jtc*zt|D|R3aMUbNwj8kR(~4K&3SD^J%l9 z5W}06gG2t)9+2*`ik`a1@_uvFV{m2hAMIT>24bm~P~SBa5YSf8fRZ z1|pvVyal)EW3@f$UPOk8aIbb!v>Cp>)*TF)9S=(lOKK}inN&efB6a6$a*^<|yiG?x zRnZ12(cpar=N%^@!SKpm{U`qVzg$muFTnUoVL=>@KR=w><1@4RXZ*c^p+xHB(e>$B zMiSk%L=%RTeoerzfr!ODgj}EBI7B>O+{U_!^RlygIsBZ(5AibwuKHUeFT6H<|A>;r z7ORXFoAG7ba411At!sfl8Ssj>sk>Pndqz{Z>MnTcy6<*Pn!i%>lUj_^N^QkBrYKM-StOLBJ8JMG$MZa#9Boo#*_Ow&H(`XGq+{DBt{ zOB{IePN zNGXnb`_5i|#LQ=FFPCwLJ)-rx$OdFZ75_#yN4St-Mq8bM4O)Np@q=fM3i z{s8XSMOclIfHhP9!4T$Z_GqE+p^VD5BnG2r9qYo_KuWYBO*LRY?#`Yb|2!&@tJB+8 z09jnpHfb%Rx;Q1r;32uq3PkXGCUVD&6_cMv2?^#g^WMf?U%8Vh?B_h1%Om1WP@Pwx|eSVP^LqtT1(X5 znYx1va$H6J|X_yF}GXPdXu zvhk#?GS6Ep%R%kG;P4hS?ha~(XS=V+KP{oOULQ;F3q_&i{T@-A_GdytNIaAx5}gr= zotp#WJt92uxp|Ix9TgU}RcEVZz`+vHFfikan#<87^H46%d2{nuXRf8B@Irgqu{bQV ztN6M#!L=C8W^}>nGbk7B=pK7%*kZ8-8I02o6$fy`ed$5i6hZ-(-f{_t5(ib^hKA*O zQh=qsJ0uh*LmH3B@vjWFOO(2{sx258xo2e(k@7f0#zPxD6a^)|!l6(0$bQ7?ub)Vr zKMB+D&)bK(7{Ffk?-+)zy6#}ly&dX#2+gg-r@SVzBM0ljZeU(t!LBtP9M;JToT2v% z(#j$UC#(=7a_coX^k$->woS^FUi9(=TVZILd0HV}e9C=RM6Fr5;^qY%p3g3H0SX00 zK5vVXoctJOad(sy!yUp`6^-fpiMsDjtFs-DmfJ#hTEHAKf_#2Gi_q-BSJ2{*6Z-*W z+QDfrqmPt#$#YhKce=YMJX5au8Qr~z{l@@If{JqcyQLC-)XCYqb>Z5h4Fgo2PH*M= zgWzkQu@ww&`2o*+7LGw!L!9y7UdHx!Emsw??L`Y_p4S=Di@jy#i08&;+QQsY^YkKI zqcTSqiyAYgpV>nZ796b|rMZW|a7a#^XR0E%AOz)8r{beIal(;_X@5Z*m#e#}{YNfh zVti@h%yl8Bmo{PC>v<6_{y1RnYYtG8+YY7T_5#A1_VbcaC9M6qG9Mg8D0DbzS$VTH z+%t1Ez+CPhPnxZcsz5~p%VkCBZ`Qp#hSgMjvOjFf6~C`ef(y$3hhzV*dIr!KDlDB+ zfWb7dhxA46j*Q))%!{x}cAVk3Fe!z~t)BO0Kal!qPGa^6fOmhmtNPCs{wr?(M-0x^ zM`UhmbNb{(G|j%Td3Yg*?kGM=3fZF>pz_$Jp3bxSC0lWJFq4aTuJu103_!Gtr8M*I zpZijQZkhI{e-|^aWvso{*NcgAuvTz9FW%d^uEBR8Wbc@)gy*Z)_{(D0 zJ$^NNwn1yhXMFY^B{Pm_BZVhg|H1-dc7{kzx;E9<%TY~7P^fc*H+bITROxzzs`m{H+IC`_qotj1O65HSevcDjSU z^YOxI=3w@lTb$_fY_va?)#Et(pIgj($!|n_&|&rK0Jve`+3}g>nI3&&Qf{=v>Oj_v zqg249iSI`0SIP=L;=f2~{^Ozdg5~lrYsuy|&@)<8hwJQ5&{NDem&YfXE`cuE4@s8) zZvPr(E^%;NI8wzTOFBK* T%662&y>4Jx6`5)& Date: Tue, 7 May 2019 10:39:45 +0800 Subject: [PATCH 28/43] fix typo --- .../rke-clusters/windows-clusters/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 29f0aa3d0d2..a3647211b59 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -18,7 +18,7 @@ This guide walks you through create of a custom cluster that includes 3 nodes: a >- For a summary of Kubernetes features supported in Windows, see [Using Windows Server Containers in Kubernetes](https://kubernetes.io/docs/getting-started-guides/windows/#supported-features). >- Windows worker adding script must run on Windows Server 2019 (core version 1809 or above) hosts. Core version 1803 and earlier versions do not support Kubernetes properly. >- Containers built for Windows Server 1803 or earlier do not run on Windows Server 2019. You must build containers on Windows Server 2019 to run these containers on Windows Server 2019. ->- Windows Overlay networking requires [KB4489899](https://support.microsoft.com/en-us/help/4489899) hostfix. Most of Cloud-hosted VMs already have this hotfix. +>- Windows Overlay networking requires [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. ## Objectives for Creating Cluster with Windows Support @@ -62,7 +62,7 @@ Node 3 | Windows (Windows Server 2019 required) | [Worker]({{< baseu - You can view node requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). - For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. -- For **VXLAN (Overlay)** netwokring, you must confirm the Windows Server 2019 host with [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. +- For **VXLAN (Overlay)** networking, you must confirm the Windows Server 2019 host with [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. - Your cluster must include at least one Linux worker node to run Rancher Cluster agent, DNS, Metrics server and Ingress related containers. - Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy. From fd825b90f0b6944a2e7dfe342cbcdefbecf1c9fb Mon Sep 17 00:00:00 2001 From: Craig Jellick Date: Tue, 7 May 2019 08:46:27 -0700 Subject: [PATCH 29/43] Update _index.md --- content/rancher/v2.x/en/user-settings/api-keys/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/user-settings/api-keys/_index.md b/content/rancher/v2.x/en/user-settings/api-keys/_index.md index 6dbee301376..c83e9b70a44 100644 --- a/content/rancher/v2.x/en/user-settings/api-keys/_index.md +++ b/content/rancher/v2.x/en/user-settings/api-keys/_index.md @@ -25,9 +25,11 @@ API Keys are composed of four components: 2. Click **Add Key**. -3. **Optional:** Enter a description for the API key and select an expiration period. We recommend setting an expiration date. +3. **Optional:** Enter a description for the API key and select an expiration period or a scope. We recommend setting an expiration date. The API key won't be valid after expiration. Shorter expiration periods are more secure. + + A scope will limit the API key so that it will only work against the Kubernetes API of the specified cluster. If the cluster is configured with an Authroized Cluster Endpoint, you will be able to use a scoped token directly against the cluster's API without proxying through the Rancher server. See [Authorized Cluster Endpoints]({{< baseurl >}}/v2.x/en/cluster-provisioning/rke-clusters/options/#authorized-cluster-endpoint) for more information. 4. Click **Create**. From 512ff126627826998085dc729b223c97e1e4b64e Mon Sep 17 00:00:00 2001 From: Craig Jellick Date: Tue, 7 May 2019 08:46:38 -0700 Subject: [PATCH 30/43] Update _index.md --- .../v2.x/en/cluster-provisioning/rke-clusters/options/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/_index.md index 827cbf57002..bfeafda0668 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/_index.md @@ -64,7 +64,7 @@ If you are using a private registry with authentication for your Docker images, _Available as of v2.2.0_ -Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher. This is enabled by default, using the IP of the node with the `controlplane` role and the default Kubernetes self signed certificates. It is recommended to create an FQDN pointing to a load balancer which load balances across your nodes with the `controlplane` role. If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate which will be included in the generated kubeconfig to validate the certificate chain. See the [Kubeconfig Files]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/kubeconfig/) for more information. +Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher. This is enabled by default, using the IP of the node with the `controlplane` role and the default Kubernetes self signed certificates. It is recommended to create an FQDN pointing to a load balancer which load balances across your nodes with the `controlplane` role. If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate which will be included in the generated kubeconfig to validate the certificate chain. See the [Kubeconfig Files]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/kubeconfig/) and [API Keys]({{< baseurl >}}/v2.x/en/user-settings/api-keys/#creating-an-api-key) documentation for more information. ### Advanced Cluster Options From 071a663959cd1205d4b7349705e9a5a615b501d5 Mon Sep 17 00:00:00 2001 From: Lev Lazinskiy Date: Tue, 7 May 2019 18:58:56 -0700 Subject: [PATCH 31/43] Fix minor grammar, break out nodes into list. I think it makes more sense to break out the the types of nodes that we are about to configure into a list. It makes it easier to read. --- .../rke-clusters/windows-clusters/_index.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index a3647211b59..7f3c7bca519 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -11,7 +11,11 @@ _Available as of v2.3.0-alpha1_ When provisioning a [custom cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) using Rancher, you can use a mix of Linux and Windows hosts as your cluster nodes. -This guide walks you through create of a custom cluster that includes 3 nodes: a Linux node, which serves as a Kubernetes control plane node; another Linux node, which serves as a Kubernetes worker used to support Rancher Cluster agent, Metrics server, DNS and Ingress for the cluster; and a Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. +This guide walks you through the creation of a custom cluster that includes three nodes. + +- 1. A Linux node, which serves as a Kubernetes control plane node. +- 2. Another Linux node, which serves as a Kubernetes worker used to support Rancher Cluster agent, Metrics server, DNS and Ingress for the cluster. +- 3. A Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. >**Notes:** > @@ -45,7 +49,7 @@ To begin provisioning a custom cluster with Windows support, prepare your host s - VMs from virtualization clusters - Bare-metal servers -The table below lists the [Kubernetes roles]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we’re installing all three roles on this node. The second node is also a Linux worker, which is responsible for running DNS server, Ingress controller, Metrics server and Rancher Cluster agent. Finally, the third node is the Windows worker, which will run your Windows applications. +The table below lists the [Kubernetes roles]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we’re installing all three roles on this node. The second node is also a Linux worker, which is responsible for running a DNS server, Ingress controller, Metrics server and Rancher Cluster agent. Finally, the third node is the Windows worker, which will run your Windows applications. Node | Operating System | Future Cluster Role(s) --------|------------------|------ From 106b2be70737fe11524da00abd28e6ccf8a8e804 Mon Sep 17 00:00:00 2001 From: Lev Lazinskiy Date: Tue, 7 May 2019 19:26:24 -0700 Subject: [PATCH 32/43] Add required port for remote access to worker 22 for SSH 3389 for RDP These are required in order to remotely access the nodes. --- .../shortcodes/requirements_ports_rke.html | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/layouts/shortcodes/requirements_ports_rke.html b/layouts/shortcodes/requirements_ports_rke.html index c972bed77d2..1d5dfdbbb93 100644 --- a/layouts/shortcodes/requirements_ports_rke.html +++ b/layouts/shortcodes/requirements_ports_rke.html @@ -213,7 +213,29 @@ Port Source Description - + + + TCP + 22 + +

      +
    • Linux worker nodes only
      • +
    • Any network that you want to be able to remotely access this node from.
      • +
    + + Remote access over SSH + + + TCP + 3389 + +
      +
    • Windows worker nodes only
      • +
    • Any network that you want to be able to remotely access this node from.
      • +
    + + Remote access over RDP + TCP 80 From 2663f7f896fe37d09aab893796cf4e3147a015c5 Mon Sep 17 00:00:00 2001 From: Lev Lazinskiy Date: Tue, 7 May 2019 19:26:45 -0700 Subject: [PATCH 33/43] Rewording and minor grammer fixes. --- .../rke-clusters/windows-clusters/_index.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 7f3c7bca519..cb1e86c1fe7 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -20,13 +20,13 @@ This guide walks you through the creation of a custom cluster that includes thre >**Notes:** > >- For a summary of Kubernetes features supported in Windows, see [Using Windows Server Containers in Kubernetes](https://kubernetes.io/docs/getting-started-guides/windows/#supported-features). ->- Windows worker adding script must run on Windows Server 2019 (core version 1809 or above) hosts. Core version 1803 and earlier versions do not support Kubernetes properly. +>- The script to add a Windows worker must be ran on Windows Server 2019 (core version 1809 or above) hosts. Core version 1803 and earlier versions do not support Kubernetes properly. >- Containers built for Windows Server 1803 or earlier do not run on Windows Server 2019. You must build containers on Windows Server 2019 to run these containers on Windows Server 2019. >- Windows Overlay networking requires [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. ## Objectives for Creating Cluster with Windows Support -When setting up a custom cluster with support for Windows nodes and containers, complete the series of tasks below. +To set up a custom cluster with support for Windows nodes and containers, you will need to complete the series of tasks listed below. @@ -59,14 +59,14 @@ Node 3 | Windows (Windows Server 2019 required) | [Worker]({{< baseu >**Notes:** > ->- If you are using AWS, you can choose *Microsoft Windows Server 2019 Base with Containers* as Amazon Machine Image (AMI) ->- If you are using GCE, you can choose *Windows Server 2019 Datacenter for Containers* as OS image +>- If you are using AWS, you should choose *Microsoft Windows Server 2019 Base with Containers* as the Amazon Machine Image (AMI). +>- If you are using GCE, you should choose *Windows Server 2019 Datacenter for Containers* as the OS image. ### Requirements -- You can view node requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). +- You can view the requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). - For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. -- For **VXLAN (Overlay)** networking, you must confirm the Windows Server 2019 host with [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. +- For **VXLAN (Overlay)** networking, you must confirm the Windows Server 2019 has the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix installed. Most of Cloud-hosted VMs already have this hotfix. - Your cluster must include at least one Linux worker node to run Rancher Cluster agent, DNS, Metrics server and Ingress related containers. - Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy. @@ -98,7 +98,7 @@ Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/ ## 3. Add Linux Master Node -The first node in your cluster should be a Linux host that fills both *Control Plane* and *etcd* role. Both of this two roles must fulfill before you can add Windows hosts to your cluster. At a minimum, the node must have 2 roles enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). +The first node in your cluster should be a Linux host that fills both *Control Plane* and *etcd* role. Both of this two roles must be fulfilled before you can add Windows hosts to your cluster. At a minimum, the node must have 2 roles enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). Option | Setting -------|-------- @@ -157,7 +157,7 @@ You can add Windows hosts to a custom cluster by editing the cluster and choosin ## 6. Cloud-hosted VM Routes Configuration for Host Gateway Mode -If using [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) backend of Flannel, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network. +If you are using the [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) backend of Flannel, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network. - When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work. From ab66e6de4a537494e71a827210056c163b0a1b3a Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Wed, 8 May 2019 11:36:06 -0700 Subject: [PATCH 34/43] fixing backups for RKE v0.2.0 --- .../en/backups/backups/ha-backups/_index.md | 79 +++++++++---------- 1 file changed, 38 insertions(+), 41 deletions(-) diff --git a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md index 50c78cc88ab..a3301c1a154 100644 --- a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md +++ b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md @@ -3,7 +3,7 @@ title: Creating Backups—High Availability Installs weight: 50 aliases: - /rancher/v2.x/en/installation/after-installation/ha-backup-and-restoration/ - - /rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration/ + - /rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration/ --- This section describes how to create backups of your high-availability Rancher install. @@ -44,38 +44,36 @@ To take recurring snapshots, enable the `etcd-snapshot` service, which is a serv **To Enable Recurring Snapshots:** 1. Open `rancher-cluster.yml` with your favorite text editor. -2. Add the following code block to the bottom of the file: -_Pre 0.2.0_ +2. Edit the code for the `etcd` service to enable recurring snapshots. As of RKE v0.2.0, snapshots can be saved in a S3 compatible backend. -~~~yaml -``` -services: - etcd: - snapshot: true # enables recurring etcd snapshots - creation: 6h0s # time increment between snapshots - retention: 24h # time increment before snapshot purge -``` -~~~ -_Post 0.2.0: Note: S3 backup is optional_ -~~~yaml -``` -services: - etcd: - backup_config: - enabled: true # enables recurring etcd snapshots - interval_hours: 6 # time increment between snapshots - retention: 60 # time in days before snapshot purge - s3_backup_config: # optional - access_key: "myaccesskey" - secret_key: "myaccesssecret" - bucket_name: "my-backup-bucket" - endpoint: "s3.eu-west-1.amazonaws.com" - region: "eu-west-1" -``` -~~~ + _Using RKE v0.2.0+_ -3. Edit the code according to your requirements. + ``` + services: + etcd: + backup_config: + enabled: true # enables recurring etcd snapshots + interval_hours: 6 # time increment between snapshots + retention: 60 # time in days before snapshot purge + # Optional S3 + s3_backup_config: + access_key: "myaccesskey" + secret_key: "myaccesssecret" + bucket_name: "my-backup-bucket" + endpoint: "s3.eu-west-1.amazonaws.com" + region: "eu-west-1" + ``` + + _Using RKE v0.1.x_ + + ``` + services: + etcd: + snapshot: true # enables recurring etcd snapshots + creation: 6h0s # time increment between snapshots + retention: 24h # time increment before snapshot purge + ``` 4. Save and close `rancher-cluster.yml`. 5. Open **Terminal** and change directory to the location of the RKE binary. Your `rancher-cluster.yml` file must reside in the same directory. @@ -85,7 +83,7 @@ services: rke up --config rancher-cluster.yml ``` -**Result:** RKE is configured to take recurring snapshots of `etcd` on all nodes running the `etcd` role. Snapshots are saved to the following directory: `/opt/rke/etcd-snapshots/`. +**Result:** RKE is configured to take recurring snapshots of `etcd` on all nodes running the `etcd` role. Snapshots are saved locally to the following directory: `/opt/rke/etcd-snapshots/`. If configured, the snapshots are also uploaded to your S3 compatible backend. #### Option B: One-Time Snapshots @@ -105,21 +103,23 @@ When you're about to upgrade Rancher or restore it to a previous snapshot, you s **To Take a One-Time S3 Snapshot:** +_Available as of RKE v0.2.0_ + 1. Open **Terminal** and change directory to the location of the RKE binary. Your `rancher-cluster.yml` file must reside in the same directory. 2. Enter the following command. Replace `` with any name that you want to use for the snapshot (e.g. `upgrade.db`). - ```shell - rke etcd snapshot-save --config rancher-cluster.yml --name snapshot-name \ - --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \ - --bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com - ``` + ```shell + rke etcd snapshot-save --config rancher-cluster.yml --name snapshot-name \ + --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \ + --bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com + ``` - *The snapshot is saved in `/opt/rke/etcd-snapshots` as well as uploaded to the S3 backend.* +**Result:** RKE takes a snapshot of `etcd` running on each `etcd` node. The file is saved to `/opt/rke/etcd-snapshots`. It is also uploaded to the S3 compatible backend. ### 2. Backup Local Snapshots to a Safe Location -> Note: This step is done for you where S3 backups are enabled +> **Note:** If you are using RKE v0.2.0, you can enable saving the backups to a S3 compatible backend directly and skip this step. After taking the `etcd` snapshots, save them to a safe location so that they're unaffected if your cluster experiences a disaster scenario. This location should be persistent. @@ -131,6 +131,3 @@ In this documentation, as an example, we're using Amazon S3 as our safe location root@node:~# s3cmd mb s3://rke-etcd-snapshots root@node:~# s3cmd put /opt/rke/etcd-snapshots/snapshot.db s3://rke-etcd-snapshots/ ``` - - - From 7ac38a5758693a050c05437b5f01596ca3bc3650 Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Wed, 8 May 2019 14:15:11 -0700 Subject: [PATCH 35/43] revert restore to original --- .../restorations/ha-restoration/_index.md | 30 +------------------ 1 file changed, 1 insertion(+), 29 deletions(-) diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md index e1d0e4bf522..94093b8a135 100644 --- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md +++ b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md @@ -33,38 +33,10 @@ We recommend that you start with fresh nodes and a clean state. Alternatively yo ### 2. Place Snapshot and PKI Bundle -**Local Snapshots** - Pick a one of the clean nodes. That node will be the "target node" for the initial restore. Place the snapshot and PKI certificate bundle files in the `/opt/rke/etcd-snapshots` directory on the "target node". * Snapshot - `.db` -* PKI Bundle - `pki.bundle.tar.gz` *(Pre RKE 0.2.0 only; after 0.2 you should have an cluster.rkestate file)* - -***Continue to step 3*** - - - -**Remote Snapshots** (rancher 2.1 / rke 0.2.0 onwards) - - -Ensuring your `cluster.rkestate` file is present, run rke restore from s3. - -```shell -rke etcd snapshot-restore --config rancher-cluster-restore.yml \ ---name snap-shot-name.db \ ---s3 --access-key KEY --secret-key SECRET \ ---bucket-name my-rancher-etcd-backup-bucket \ ---s3-endpoint s3.amazonaws.com \ ---region eu-west-2 -``` - -Once the process has completed, if rancher has been installed via helm, the UI will load (can take a few minutes). - -At this point the restoration is complete. - -> Note: At this point it is a good idea to ensure your `kube_config_cluster.yml` and `cluster.rkestate` are backed up and preserved for any future maintenance. - - +* PKI Bundle - `pki.bundle.tar.gz` ### 3. Configure RKE From aef3e2a71415ad328b3138ea6c9f94dfd5f84c77 Mon Sep 17 00:00:00 2001 From: loganhz Date: Tue, 7 May 2019 12:12:52 +0800 Subject: [PATCH 36/43] Windows previous docs --- .../rke-clusters/windows-clusters/_index.md | 5 + .../docs-for-2.1-and-2.2/_index.md | 175 ++++++++++++++++++ 2 files changed, 180 insertions(+) create mode 100644 content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index a3647211b59..186b532c08d 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -3,6 +3,11 @@ title: Configuring Custom Clusters for Windows (Experimental) weight: 2240 --- +>**Notes:** +> +>- Windows are new and improved for Rancher v2.3! +>- Still using v2.1.x or v2.2.x? The previous Windows feature has been dropped since 2.1.10 and 2.2.3. See the pipeline documentation for [previous versions]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/). + _Available as of v2.3.0-alpha1_ >**Important:** diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md new file mode 100644 index 00000000000..c0c993f1c69 --- /dev/null +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md @@ -0,0 +1,175 @@ +--- +title: v2.1.x and v2.2.x Windows Documentation (Experimental) +weight: 9100 +--- + +>**Note:** This section describes the windows feature as implemented in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3 or later, where windows have been significantly improved, please refer to the new documentation for [v2.3 or later]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/). + +_Available from v2.1.0 to v2.1.9 and v2.2.0 to v2.2.2_ + +>**Important:** +> +>Support for Windows nodes is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using Windows nodes in a production environment. + +When provisioning a [custom cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) using Rancher, you can use a mix of Linux and Windows hosts as your cluster nodes. + +This guide walks you through create of a custom cluster that includes 3 nodes: a Linux node, which serves as a Kubernetes control plane node; another Linux node, which serves as a Kubernetes worker used to support Ingress for the cluster; and a Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. + +>**Notes:** +> +>- For a summary of Kubernetes features supported in Windows, see [Using Windows in Kubernetes](https://kubernetes.io/docs/setup/windows/intro-windows-in-kubernetes/). +>- Windows containers must run on Windows Server 1803 nodes. Windows Server 1709 and earlier versions do not support Kubernetes properly. +>- Containers built for Windows Server 1709 or earlier do not run on Windows Server 1803. You must build containers on Windows Server 1803 to run these containers on Windows Server 1803. + + + +## Objectives for Creating Cluster with Windows Support + +When setting up a custom cluster with support for Windows nodes and containers, complete the series of tasks below. + + + +- [1. Provision Hosts](#1-provision-hosts) +- [2. Cloud-host VM Networking Configuration](#2-cloud-hosted-vm-networking-configuration) +- [3. Create the Custom Cluster](#3-create-the-custom-cluster) +- [4. Add Linux Host for Ingress Support](#4-add-linux-host-for-ingress-support) +- [5. Adding Windows Workers](#5-adding-windows-workers) +- [6. Cloud-host VM Routes Configuration](#6-cloud-hosted-vm-routes-configuration) + + + +## 1. Provision Hosts + +To begin provisioning a custom cluster with Windows support, prepare your host servers. Provision three nodes according to our [requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/)—two Linux, one Windows. Your hosts can be: + +- Cloud-hosted VMs +- VMs from virtualization clusters +- Bare-metal servers + +The table below lists the [Kubernetes roles]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we're installing all three roles on this node. Node 2 is also a Linux worker, which is responsible for Ingress support. Finally, the third node is your Windows worker, which will run your Windows applications. + +Node | Operating System | Future Cluster Role(s) +--------|------------------|------ +Node 1 | Linux (Ubuntu Server 16.04 recommended) | [Control Plane]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#etcd), [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) +Node 2 | Linux (Ubuntu Server 16.04 recommended) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) (This node is used for Ingress support) +Node 3 | Windows (*Windows Server 1803 required*) | [Worker]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) + +### Requirements + +- You can view node requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). +- All nodes in a virtualization cluster or a bare metal cluster must be connected using a layer 2 network. +- To support [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/), your cluster must include at least one Linux node dedicated to the worker role. +- Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy. + + +## 2. Cloud-hosted VM Networking Configuration + +>**Note:** This step only applies to nodes hosted on cloud-hosted virtual machines. If you're using virtualization clusters or bare-metal servers, skip ahead to [Create the Custom Cluster](#3-create-the-custom-cluster). + +If you're hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below. + +Service | Directions to disable private IP address checks +--------|------------------------------------------------ +Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck) +Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward) +Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding) + +## 3. Create the Custom Cluster + +To create a custom cluster that supports Windows nodes, follow the instructions in [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster), starting from [2. Create the Custom Cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster). While completing the linked instructions, look for steps that requires special actions for Windows nodes, which are flagged with a note. These notes will link back here, to the special Windows instructions listed in the subheadings below. + + +### Enable the Windows Support Option + +While choosing **Cluster Options**, set **Windows Support (Experimental)** to **Enabled**. + +After you select this option, resume [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 6]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-6). + +### Networking Option + +When choosing a network provider for a cluster that supports Windows, the only option available is Flannel, as [host-gw](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) is needed for IP routing. + +If your nodes are hosted by a cloud provider and you want automation support such as load balancers or persistent storage devices, see [Selecting Cloud Providers]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) for configuration info. + +### Node Configuration + +The first node in your cluster should be a Linux host that fills the Control Plane role. This role must be fulfilled before you can add Windows hosts to your cluster. At minimum, the node must have this role enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). + +Option | Setting +-------|-------- +Node Operating System | Linux +Node Roles | etcd
    Control Plane
    Worker + +![Recommended Linux Control Plane Configuration]({{< baseurl >}}/img/rancher/linux-control-plane.png) + +When you're done with these configurations, resume [Creating a Cluster with Custom Nodes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 8]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-8). + + + +## 4. Add Linux Host for Ingress Support + +After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Add another Linux host, which will be used to support Ingress for your cluster. + +1. Using the content menu, open the custom cluster your created in [2. Create the Custom Cluster](#2-create-the-custom-cluster). + +1. From the main menu, select **Nodes**. + +1. Click **Edit Cluster**. + +1. Scroll down to **Node Operating System**. Choose **Linux**. + +1. Select the **Worker** role. + +1. Copy the command displayed on screen to your clipboard. + +1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard. + +1. From **Rancher**, click **Save**. + +**Result:** The worker role is installed on your Linux host, and the node registers with Rancher. + +## 5. Adding Windows Workers + +You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option. + +1. From the main menu, select **Nodes**. + +1. Click **Edit Cluster**. + +1. Scroll down to **Node Operating System**. Choose **Windows**. + +1. Select the **Worker** role. + +1. Copy the command displayed on screen to your clipboard. + +1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**. + +1. From Rancher, click **Save**. + +1. **Optional:** Repeat these instruction if you want to add more Windows nodes to your cluster. + +**Result:** The worker role is installed on your Windows host, and the node registers with Rancher. + +## 6. Cloud-hosted VM Routes Configuration + +In Windows clusters, containers communicate with each other using the `host-gw` mode of Flannel. In `host-gw` mode, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network. + +- When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work. + +- When worker nodes are provisioned on GCE or Azure, they are not on the same layer 2 subnet. Nodes on GCE and Azure belong to a routable layer 3 network. Follow the instructions below to configure GCE and Azure so that the cloud network knows how to route the host subnets on each node. + +To configure host subnet routing on GCE or Azure, first run the following command to find out the host subnets on each worker node: + +```bash +kubectl get nodes -o custom-columns=nodeName:.metadata.name,nodeIP:status.addresses[0].address,routeDestination:.spec.podCIDR +``` + +Then follow the instructions for each cloud provider to configure routing rules for each node: + +Service | Instructions +--------|------------- +Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute). +Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined). + + +` ` From a3df6e7bc504b841ebd82abea64e13c0eff93595 Mon Sep 17 00:00:00 2001 From: Denise Date: Wed, 8 May 2019 19:46:28 -0700 Subject: [PATCH 37/43] Update _index.md --- .../rke-clusters/windows-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index 186b532c08d..570d11cfbcd 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -6,7 +6,7 @@ weight: 2240 >**Notes:** > >- Windows are new and improved for Rancher v2.3! ->- Still using v2.1.x or v2.2.x? The previous Windows feature has been dropped since 2.1.10 and 2.2.3. See the pipeline documentation for [previous versions]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/). +>- Still using v2.1.x or v2.2.x? As of v2.1.10 and v2.2.3, the previous Windows feature has been removed. See the windows documentation for [previous versions]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/). _Available as of v2.3.0-alpha1_ From 9c3603e95f0a7f743934542f1b59c64aaf2fad06 Mon Sep 17 00:00:00 2001 From: Denise Date: Wed, 8 May 2019 19:47:33 -0700 Subject: [PATCH 38/43] Update _index.md --- .../windows-clusters/docs-for-2.1-and-2.2/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md index c0c993f1c69..5721f56958a 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md @@ -3,7 +3,7 @@ title: v2.1.x and v2.2.x Windows Documentation (Experimental) weight: 9100 --- ->**Note:** This section describes the windows feature as implemented in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3 or later, where windows have been significantly improved, please refer to the new documentation for [v2.3 or later]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/). +>**Note:** This section describes the Windows feature as implemented in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3 or later, where Windows have been significantly improved, please refer to the new documentation for [v2.3 or later]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/). _Available from v2.1.0 to v2.1.9 and v2.2.0 to v2.2.2_ From 454e390c70ba818c0f0b2576b2dc87e44c6daa17 Mon Sep 17 00:00:00 2001 From: Denise Schannon Date: Wed, 8 May 2019 22:20:01 -0700 Subject: [PATCH 39/43] small updates --- .../rke-clusters/windows-clusters/_index.md | 46 ++++++++++--------- 1 file changed, 25 insertions(+), 21 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index d2a59a00d32..c619e902fa8 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -10,28 +10,35 @@ weight: 2240 _Available as of v2.3.0-alpha1_ ->**Important:** -> +>**Important:** +> >Support for Windows nodes is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using Windows nodes in a production environment. When provisioning a [custom cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) using Rancher, you can use a mix of Linux and Windows hosts as your cluster nodes. -This guide walks you through the creation of a custom cluster that includes three nodes. +This guide walks you through the creation of a custom cluster that includes three nodes. -- 1. A Linux node, which serves as a Kubernetes control plane node. -- 2. Another Linux node, which serves as a Kubernetes worker used to support Rancher Cluster agent, Metrics server, DNS and Ingress for the cluster. -- 3. A Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. +* A Linux node, which serves as a Kubernetes control plane node. +* Another Linux node, which serves as a Kubernetes worker used to support Rancher Cluster agent, Metrics server, DNS and Ingress for the cluster. +* A Windows node, which is assigned the Kubernetes worker role and runs your Windows containers. ->**Notes:** -> ->- For a summary of Kubernetes features supported in Windows, see [Using Windows Server Containers in Kubernetes](https://kubernetes.io/docs/getting-started-guides/windows/#supported-features). ->- The script to add a Windows worker must be ran on Windows Server 2019 (core version 1809 or above) hosts. Core version 1803 and earlier versions do not support Kubernetes properly. ->- Containers built for Windows Server 1803 or earlier do not run on Windows Server 2019. You must build containers on Windows Server 2019 to run these containers on Windows Server 2019. ->- Windows Overlay networking requires [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix. Most of Cloud-hosted VMs already have this hotfix. +## Pre-Prerequisites + +For a summary of Kubernetes features supported in Windows, see [Using Windows Server Containers in Kubernetes](https://kubernetes.io/docs/getting-started-guides/windows/#supported-features). + +### Node Requirements + +In order to add Windows worker nodes, the node must be running Windows Server 2019 (i.e. core version 1809 or above). Any earlier versions (e.g. core version 1803 and earlier) do not properly support Kubernetes. + +Windows overlay networking requires that [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix is installed. Most cloud-hosted VMs already have this hotfix. + +### Container Requirements + +Windows requires that containers must be built on the same Windows server version that they are being deployed on. Therefore, containers must be built on Windows Server 2019 in order to be used with the node requirements of running Windows Server 2019. If you have existing containers built for Windows Server 1803 or earlier, they must be re-built to use Windows Server 2019. ## Objectives for Creating Cluster with Windows Support -To set up a custom cluster with support for Windows nodes and containers, you will need to complete the series of tasks listed below. +To set up a custom cluster with support for Windows nodes and containers, you will need to complete the series of tasks listed below. @@ -44,11 +51,9 @@ To set up a custom cluster with support for Windows nodes and containers, you wi - - ## 1. Provision Hosts -To begin provisioning a custom cluster with Windows support, prepare your host servers. Provision three nodes according to our [requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/)—two Linux, one Windows. Your hosts can be: +To begin provisioning a custom cluster with Windows support, prepare your hosts. Provision three nodes according to our [installation requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/) - two Linux, one Windows. Your hosts can be: - Cloud-hosted VMs - VMs from virtualization clusters @@ -69,12 +74,11 @@ Node 3 | Windows (Windows Server 2019 required) | [Worker]({{< baseu ### Requirements -- You can view the requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). +- You can view the general requirements for Linux and Windows nodes in the [installation section]({{< baseurl >}}/rancher/v2.x/en/installation/requirements/). - For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. -- For **VXLAN (Overlay)** networking, you must confirm the Windows Server 2019 has the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix installed. Most of Cloud-hosted VMs already have this hotfix. +- For **VXLAN (Overlay)** networking, you must confirm that the Windows Server 2019 has the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix installed. Most cloud-hosted VMs already have this hotfix. - Your cluster must include at least one Linux worker node to run Rancher Cluster agent, DNS, Metrics server and Ingress related containers. -- Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy. - +- Although we recommend the three node architecture listed in the table above, you can always add additional Linux and Windows workers to scale up your cluster for redundancy. ## 2. Create the Custom Cluster @@ -103,7 +107,7 @@ Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/ ## 3. Add Linux Master Node -The first node in your cluster should be a Linux host that fills both *Control Plane* and *etcd* role. Both of this two roles must be fulfilled before you can add Windows hosts to your cluster. At a minimum, the node must have 2 roles enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). +The first node in your cluster should be a Linux host that fills both *Control Plane* and *etcd* role. Both of these two roles must be fulfilled before you can add Windows hosts to your cluster. At a minimum, the node must have 2 roles enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later). Option | Setting -------|-------- From 09889f609e2a45cf0578889ca1fe072114082549 Mon Sep 17 00:00:00 2001 From: loganhz Date: Tue, 14 May 2019 11:49:21 +0800 Subject: [PATCH 40/43] Add docs for azure files on Windows --- .../rke-clusters/windows-clusters/_index.md | 42 ++++++++++++++++++- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index c619e902fa8..c921cb7fbc0 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -48,7 +48,7 @@ To set up a custom cluster with support for Windows nodes and containers, you wi - [4. Add Linux Worker Node](#4-add-linux-worker-node) - [5. Add Windows Workers](#5-add-windows-workers) - [6. Cloud-host VM Routes Configuration for Host Gateway Mode (Optional)](#6-cloud-hosted-vm-routes-configuration-for-host-gateway-mode) - +- [7. Configuration for Azure Files (Optional)](#7-configuration-for-azure-files) ## 1. Provision Hosts @@ -186,4 +186,42 @@ Google GCE | For GCE, add a static route for each node: [Adding a Static Route]( Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined). -` ` +## 7. Configuration for Azure Files + +You can use Azure Files as the [storage class]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) if you are using Azure VM in your cluster. For detailed information about it , [see here](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv). + +To allow the Azure platform to create the required storage resources, follow these steps: + +1. [Configure the Azure cloud provider]({{< baseurl >}}/rke/latest/en/config-options/cloud-providers/azure) + +1. Configure kubectl to connect to your cluster. + +1. Copy the ClusterRole and ClusterRoleBinding manifest for service account. + + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: system:azure-cloud-provider + rules: + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get','create'] + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: system:azure-cloud-provider + roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: system:azure-cloud-provider + subjects: + - kind: ServiceAccount + name: persistent-volume-binder + namespace: kube-system + +1. Create them in your cluster using one of the follow command. + ``` + # kubectl create -f + ``` From 0abab8bab21ec583dcf6d38ef4e635493a8939af Mon Sep 17 00:00:00 2001 From: Denise Date: Mon, 13 May 2019 21:39:00 -0700 Subject: [PATCH 41/43] Update _index.md --- .../rke-clusters/windows-clusters/_index.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md index c921cb7fbc0..a489eb434ab 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md @@ -188,15 +188,15 @@ Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](ht ## 7. Configuration for Azure Files -You can use Azure Files as the [storage class]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) if you are using Azure VM in your cluster. For detailed information about it , [see here](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv). +If you are using Azure VMs for your nodes, you can use [Azure files](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv) as a [storage class]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) for the cluster. -To allow the Azure platform to create the required storage resources, follow these steps: +In order to have the Azure platform create the required storage resources, follow these steps: -1. [Configure the Azure cloud provider]({{< baseurl >}}/rke/latest/en/config-options/cloud-providers/azure) +1. [Configure the Azure cloud provider.]({{< baseurl >}}rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/#azure) -1. Configure kubectl to connect to your cluster. +1. Configure `kubectl` to connect to your cluster. -1. Copy the ClusterRole and ClusterRoleBinding manifest for service account. +1. Copy the `ClusterRole` and `ClusterRoleBinding` manifest for service account. --- apiVersion: rbac.authorization.k8s.io/v1 @@ -221,7 +221,8 @@ To allow the Azure platform to create the required storage resources, follow the name: persistent-volume-binder namespace: kube-system -1. Create them in your cluster using one of the follow command. - ``` - # kubectl create -f - ``` +1. Create these in your cluster using one of the follow command. + + ``` + # kubectl create -f + ``` From 144ae56ae3af880c477ae6fa15d7c6a54d69894b Mon Sep 17 00:00:00 2001 From: David Noland Date: Tue, 14 May 2019 23:03:03 -0700 Subject: [PATCH 42/43] Removed duplicate words. --- .../installation/configuration/private-registries/_index.md | 2 +- content/rancher/v2.x/en/admin-settings/rbac/_index.md | 2 +- .../rke-clusters/node-pools/azure/_index.md | 2 +- .../v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md | 2 +- content/rancher/v2.x/en/installation/single-node/_index.md | 2 +- .../single-node/single-node-install-external-lb/_index.md | 2 +- .../en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md | 6 +++--- content/rancher/v2.x/en/project-admin/namespaces/_index.md | 2 +- content/rancher/v2.x/en/troubleshooting/_index.md | 2 +- content/rke/latest/en/config-options/add-ons/_index.md | 2 +- .../config-options/add-ons/user-defined-add-ons/_index.md | 2 +- content/rke/latest/en/os/_index.md | 2 +- 12 files changed, 14 insertions(+), 14 deletions(-) diff --git a/content/os/v1.x/en/installation/configuration/private-registries/_index.md b/content/os/v1.x/en/installation/configuration/private-registries/_index.md index 65ebd182839..5abe0adbbaf 100644 --- a/content/os/v1.x/en/installation/configuration/private-registries/_index.md +++ b/content/os/v1.x/en/installation/configuration/private-registries/_index.md @@ -15,7 +15,7 @@ rancher: auth: dXNlcm5hbWU6cGFzc3dvcmQ= ``` -The `auth` key is generated by base64 encoding a string of the form `username:password`. The `docker login` command can be be used to generate an `auth` key. After running the command and authenticating successfully, the key can be found in the `$HOME/.docker/config.json` file. +The `auth` key is generated by base64 encoding a string of the form `username:password`. The `docker login` command can be used to generate an `auth` key. After running the command and authenticating successfully, the key can be found in the `$HOME/.docker/config.json` file. ```json { diff --git a/content/rancher/v2.x/en/admin-settings/rbac/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/_index.md index f3aedf6b0d6..d860a62995f 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/_index.md @@ -11,7 +11,7 @@ After you configure external authentication, the users that display on the **Use - If you are logged in as a local user, only local users display. -- If you are logged in an an external user, both external and local users display. +- If you are logged in an external user, both external and local users display. ## Users and Roles diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md index 43bb3b1979c..d1f29074b38 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/_index.md @@ -28,7 +28,7 @@ Use {{< product >}} to create a Kubernetes cluster in Azure. {{< step_create-cloud-credential >}} - - **Placement** sets the geographical region where where your cluster is hosted and other location metadata. + - **Placement** sets the geographical region where your cluster is hosted and other location metadata. - **Network** configures the networking used in your cluster. diff --git a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md index 93a1b4fb16b..8460a64160e 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/_index.md @@ -198,7 +198,7 @@ If you are using a Certificate Signed By A Recognized Certificate Authority, you ## 8. Configure FQDN -There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#3-configure-dns). +There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in [3. Configure DNS](#3-configure-dns). 1. Open `rancher-cluster.yml`. diff --git a/content/rancher/v2.x/en/installation/single-node/_index.md b/content/rancher/v2.x/en/installation/single-node/_index.md index dabf756c793..2b0a0f5e51a 100644 --- a/content/rancher/v2.x/en/installation/single-node/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/_index.md @@ -97,7 +97,7 @@ For production environments, you also have the option of using [Let's Encrypt](h >- Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses. -After you fulfill the prerequisites, you can install Rancher using a Let's Encrypt certificate by running the following command. Replace `` with your your domain. +After you fulfill the prerequisites, you can install Rancher using a Let's Encrypt certificate by running the following command. Replace `` with your domain. docker run -d --restart=unless-stopped \ -p 80:80 -p 443:443 \ diff --git a/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md index 93623d655b1..a6d832a5a2c 100644 --- a/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node/single-node-install-external-lb/_index.md @@ -4,7 +4,7 @@ weight: 252 aliases: - /rancher/v2.x/en/installation/single-node-install-external-lb/ --- -For development and testing environments that have a special requirement to terminate TLS/SSL at a load balancer instead of your Rancher Server container, deploy Rancher and configure a load balancer to work with it it conjunction. This install procedure walks you through deployment of Rancher using a single container, and then provides a sample configuration for a layer 7 Nginx load balancer. +For development and testing environments that have a special requirement to terminate TLS/SSL at a load balancer instead of your Rancher Server container, deploy Rancher and configure a load balancer to work with it conjunction. This install procedure walks you through deployment of Rancher using a single container, and then provides a sample configuration for a layer 7 Nginx load balancer. >**Want to skip the external load balancer?** > See [Single Node Installation]({{< baseurl >}}/rancher/v2.x/en/installation/single-node) instead. diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md index 422bf82e033..6e8f01052d6 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md @@ -405,7 +405,7 @@ spec: 1. Test that pod autoscaling works as intended.

    **To Test Autoscaling Using Resource Metrics:** {{% accordion id="observe-upscale-2-pods-cpu" label="Upscale to 2 Pods: CPU Usage Up to Target" %}} -Use your load testing tool to to scale up to two pods based on CPU Usage. +Use your load testing tool to scale up to two pods based on CPU Usage. 1. View your HPA. ``` @@ -491,7 +491,7 @@ Use your load testing tool to upspace to 3 pods based on CPU usage with `horizon ``` {{% /accordion %}} {{% accordion id="observe-downscale-1-pod" label="Downscale to 1 Pod: All Metrics Below Target" %}} -Use your load testing to to scale down to 1 pod when all metrics are below target for `horizontal-pod-autoscaler-downscale-delay` (5 minutes by default). +Use your load testing to scale down to 1 pod when all metrics are below target for `horizontal-pod-autoscaler-downscale-delay` (5 minutes by default). 1. Enter the following command. ``` @@ -794,7 +794,7 @@ To create HPA resources based on resource metrics such as CPU and memory use, yo ``` # kubectl -n kube-system logs metrics-server-6fbfb84cdd-t2fk9 ``` - Then review the log to confirm that that the `metrics-server` package is running. + Then review the log to confirm that the `metrics-server` package is running. {{% accordion id="metrics-server-run-check" label="Metrics Server Log Output" %}} I0723 08:09:56.193136 1 heapster.go:71] /metrics-server --source=kubernetes.summary_api:'' I0723 08:09:56.193574 1 heapster.go:72] Metrics Server version v0.2.1 diff --git a/content/rancher/v2.x/en/project-admin/namespaces/_index.md b/content/rancher/v2.x/en/project-admin/namespaces/_index.md index e56bfd6bc1c..96c03538fae 100644 --- a/content/rancher/v2.x/en/project-admin/namespaces/_index.md +++ b/content/rancher/v2.x/en/project-admin/namespaces/_index.md @@ -28,7 +28,7 @@ Create a new namespace to isolate apps and resources in a project. 1. From the **Global** view, open the project where you want to create a namespace. - >**Tip:** As a best practice, we recommend creating namespaces from the project level. However, cluster owners and members can can create them from the cluster level as well. + >**Tip:** As a best practice, we recommend creating namespaces from the project level. However, cluster owners and members can create them from the cluster level as well. 1. From the main menu, select **Namespace**. The click **Add Namespace**. diff --git a/content/rancher/v2.x/en/troubleshooting/_index.md b/content/rancher/v2.x/en/troubleshooting/_index.md index b59f147334f..5177b1eff07 100644 --- a/content/rancher/v2.x/en/troubleshooting/_index.md +++ b/content/rancher/v2.x/en/troubleshooting/_index.md @@ -30,7 +30,7 @@ This section contains information to help you troubleshoot issues when using Ran - [Rancher HA]({{< baseurl >}}/rancher/v2.x/en/troubleshooting/rancherha/) - If you experience issues issues with your [High Availability (HA) Install]({{< baseurl >}}/rancher/v2.x/en/installation/ha/) + If you experience issues with your [High Availability (HA) Install]({{< baseurl >}}/rancher/v2.x/en/installation/ha/) - [Imported clusters]({{< baseurl >}}/rancher/v2.x/en/troubleshooting/imported-clusters/) diff --git a/content/rke/latest/en/config-options/add-ons/_index.md b/content/rke/latest/en/config-options/add-ons/_index.md index b15e5346947..8a659431c83 100644 --- a/content/rke/latest/en/config-options/add-ons/_index.md +++ b/content/rke/latest/en/config-options/add-ons/_index.md @@ -18,7 +18,7 @@ RKE only adds additional add-ons when using `rke up` multiple times. RKE does ** As of v0.1.8, RKE will update an add-on if it is the same name. -Prior to v0.1.8, update any add-ons by by using `kubectl edit`. +Prior to v0.1.8, update any add-ons by using `kubectl edit`. ## Critical and Non-Critical Add-ons diff --git a/content/rke/latest/en/config-options/add-ons/user-defined-add-ons/_index.md b/content/rke/latest/en/config-options/add-ons/user-defined-add-ons/_index.md index 6a03f9f418d..3f2dd072f91 100644 --- a/content/rke/latest/en/config-options/add-ons/user-defined-add-ons/_index.md +++ b/content/rke/latest/en/config-options/add-ons/user-defined-add-ons/_index.md @@ -18,7 +18,7 @@ RKE only adds additional add-ons when using `rke up` multiple times. RKE does ** As of v0.1.8, RKE will update an add-on if it is the same name. -Prior to v0.1.8, update any add-ons by by using `kubectl edit`. +Prior to v0.1.8, update any add-ons by using `kubectl edit`. ## In-line Add-ons diff --git a/content/rke/latest/en/os/_index.md b/content/rke/latest/en/os/_index.md index 56df0dea9c6..44c16a28a2c 100644 --- a/content/rke/latest/en/os/_index.md +++ b/content/rke/latest/en/os/_index.md @@ -99,7 +99,7 @@ rpm -q docker-ce When using the upstream Docker packages, please follow [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user). #### Using RHEL/CentOS packaged Docker -If you are using the Docker Docker package supplied by Red Hat / CentOS, the package name is `docker`. You can check the installed package by executing: +If you are using the Docker package supplied by Red Hat / CentOS, the package name is `docker`. You can check the installed package by executing: ``` rpm -q docker From 687e2edf0d26f28ea95b4f844ab7f8525a1c484e Mon Sep 17 00:00:00 2001 From: David Noland Date: Tue, 14 May 2019 22:43:13 -0700 Subject: [PATCH 43/43] Fix all the the --- .../v2.x/en/admin-settings/authentication/ad/_index.md | 2 +- .../v2.x/en/installation/ha/rke-add-on/proxy/_index.md | 2 +- .../en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md | 4 ++-- .../quick-start-guide/deployment/digital-ocean-qs/_index.md | 2 +- content/rancher/v2.x/en/system-tools/_index.md | 2 +- .../v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md | 2 +- .../v2.x/en/v1.6-migration/schedule-workloads/_index.md | 2 +- content/rke/latest/en/cert-mgmt/_index.md | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md index a65ebc1b138..037a2fc6881 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md @@ -144,7 +144,7 @@ $ ldapsearch -x -D "acme\jdoe" -w "secret" -p 389 \ -h ad.acme.com -b "dc=acme,dc=com" -s sub "sAMAccountName=jdoe" ``` -This command performs an LDAP search with the search base set to the domain root (`-b "dc=acme,dc=com"`) and a filter targeting the the user account (`sAMAccountNam=jdoe`), returning the attributes for said user: +This command performs an LDAP search with the search base set to the domain root (`-b "dc=acme,dc=com"`) and a filter targeting the user account (`sAMAccountNam=jdoe`), returning the attributes for said user: ![LDAP User]({{< baseurl >}}/img/rancher/ldapsearch-user.png) diff --git a/content/rancher/v2.x/en/installation/ha/rke-add-on/proxy/_index.md b/content/rancher/v2.x/en/installation/ha/rke-add-on/proxy/_index.md index b35ac7a9e09..9a0e7edb6e4 100644 --- a/content/rancher/v2.x/en/installation/ha/rke-add-on/proxy/_index.md +++ b/content/rancher/v2.x/en/installation/ha/rke-add-on/proxy/_index.md @@ -28,7 +28,7 @@ When using High Availability Installation, the environment variables need to be * [High Availability Installation with External Load Balancer (TCP/Layer 4) RKE Config File Template]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install/#5-download-rke-config-file-template) * [High Availability Installation with External Load Balancer (HTTPS/Layer 7) RKE Config File Template]({{< baseurl >}}/rancher/v2.x/en/installation/ha-server-install-external-lb/#5-download-rke-config-file-template) -The environment variables should be defined in the `Deployment` inside the RKE Config File Template. You only have to add the the part starting with `env:` to (but not including) `ports:`. Make sure the indentation is identical to the preceding `name:`. Required values for `NO_PROXY` are: +The environment variables should be defined in the `Deployment` inside the RKE Config File Template. You only have to add the part starting with `env:` to (but not including) `ports:`. Make sure the indentation is identical to the preceding `name:`. Required values for `NO_PROXY` are: * `localhost` * `127.0.0.1` diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md index 6e8f01052d6..c53c1c2706f 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md @@ -816,7 +816,7 @@ To create HPA resources based on resource metrics such as CPU and memory use, yo ``` # kubectl get --raw /k8s/clusters//apis/metrics.k8s.io/v1beta1 ``` - If the the API is working correctly, you should receive output similar to the output below. + If the API is working correctly, you should receive output similar to the output below. ``` {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"metrics.k8s.io/v1beta1","resources":[{"name":"nodes","singularName":"","namespaced":false,"kind":"NodeMetrics","verbs":["get","list"]},{"name":"pods","singularName":"","namespaced":true,"kind":"PodMetrics","verbs":["get","list"]}]} ``` @@ -825,7 +825,7 @@ To create HPA resources based on resource metrics such as CPU and memory use, yo ``` # kubectl get --raw /apis/metrics.k8s.io/v1beta1 ``` - If the the API is working correctly, you should receive output similar to the output below. + If the API is working correctly, you should receive output similar to the output below. ``` {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"metrics.k8s.io/v1beta1","resources":[{"name":"nodes","singularName":"","namespaced":false,"kind":"NodeMetrics","verbs":["get","list"]},{"name":"pods","singularName":"","namespaced":true,"kind":"PodMetrics","verbs":["get","list"]}]} ``` diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md index bfc0964705a..800757e7674 100644 --- a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md +++ b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md @@ -31,7 +31,7 @@ The following steps will quickly deploy a Rancher Server with a single node clus 6. Run `terraform init`. -7. To initiate the creation of the environment, run `terraform apply`. Then wait for the the following output: +7. To initiate the creation of the environment, run `terraform apply`. Then wait for the following output: ``` Apply complete! Resources: 2 added, 0 changed, 0 destroyed. diff --git a/content/rancher/v2.x/en/system-tools/_index.md b/content/rancher/v2.x/en/system-tools/_index.md index 2856637d961..db524751cd4 100644 --- a/content/rancher/v2.x/en/system-tools/_index.md +++ b/content/rancher/v2.x/en/system-tools/_index.md @@ -115,4 +115,4 @@ When you run the command below, all the resources listed [above](#remove) will b | ---------------------------------------------- | ------------ | `--kubeconfig , -c ` | The cluster's kubeconfig file | `--namespace , -n cattle-system` | Rancher 2.x deployment namespace (``). If no namespace is defined, the options defaults to `cattle-system`. -| `--force` | Skips the the interactive removal confirmation and removes the Rancher deployment without prompt. +| `--force` | Skips the interactive removal confirmation and removes the Rancher deployment without prompt. diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md index 1b04257eb02..e3be3ce786c 100644 --- a/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md +++ b/content/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/_index.md @@ -15,7 +15,7 @@ During upgrade, you'll enter a series of commands, filling placeholders with dat docker run --volumes-from rancher-data -v $PWD:/backup alpine tar zcvf /backup/rancher-data-backup--.tar.gz /var/lib/rancher ``` -In this command, `-` is the the version number and date of creation for a backup of Rancher. +In this command, `-` is the version number and date of creation for a backup of Rancher. Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#completing-the-upgrade). diff --git a/content/rancher/v2.x/en/v1.6-migration/schedule-workloads/_index.md b/content/rancher/v2.x/en/v1.6-migration/schedule-workloads/_index.md index 826dd06bfee..67747de53c0 100644 --- a/content/rancher/v2.x/en/v1.6-migration/schedule-workloads/_index.md +++ b/content/rancher/v2.x/en/v1.6-migration/schedule-workloads/_index.md @@ -183,7 +183,7 @@ Rancher v1.6 included the ability to deploy [global services]({{< baseurl >}}/ra In Rancher v2.x, you can schedule a pod to each node using a [Kubernetes DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/), which is a specific type of workload ). A _DaemonSet_ functions exactly like a Rancher v1.6 global service. The Kubernetes scheduler deploys a pod on each node of the cluster, and as new nodes are added, the scheduler will start new pods on them provided they match the scheduling requirements of the workload. Additionally, in v2.x, you can also limit a DaemonSet to be deployed to nodes that have a specific label. -To create a daemonset while configuring a workload, choose **Run one pod on each node** from the the **Workload Type** options. +To create a daemonset while configuring a workload, choose **Run one pod on each node** from the **Workload Type** options. ### Scheduling Pods Using Resource Constraints diff --git a/content/rke/latest/en/cert-mgmt/_index.md b/content/rke/latest/en/cert-mgmt/_index.md index 765826121bc..5d202d6bbdc 100644 --- a/content/rke/latest/en/cert-mgmt/_index.md +++ b/content/rke/latest/en/cert-mgmt/_index.md @@ -80,7 +80,7 @@ INFO[0033] [worker] Successfully restarted Worker Plane.. ### Rotating the CA and all service certificates -If the CA certificate needs to be rotated, you are required to rotate all the services certificates as they need to be signed with the newly rotated CA certificate. To include rotating the CA with the service certificates, add the `--rotate-ca` option. After the the CA and all the service certificates are rotated, these services will automatically be restarted to start using the new certificate. +If the CA certificate needs to be rotated, you are required to rotate all the services certificates as they need to be signed with the newly rotated CA certificate. To include rotating the CA with the service certificates, add the `--rotate-ca` option. After the CA and all the service certificates are rotated, these services will automatically be restarted to start using the new certificate. Rotating the CA certificate will result in restarting other system pods, that will also use the new CA certificate. This includes: