diff --git a/Dockerfile.dev b/Dockerfile.dev index af34fcf57dc..53225113ca0 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -10,4 +10,4 @@ RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz # Expose default hugo port EXPOSE 9001 -ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture", "--baseURL=" ] +ENTRYPOINT ["hugo", "serve", "--bind=0.0.0.0", "--buildDrafts", "--buildFuture" ] diff --git a/Dockerfile.prod b/Dockerfile.prod index 38ba46de614..0a0511d279c 100644 --- a/Dockerfile.prod +++ b/Dockerfile.prod @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildFuture", "--baseURL=https://rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/Dockerfile.staging b/Dockerfile.staging index 5dc30768635..ea6ea487cfb 100644 --- a/Dockerfile.staging +++ b/Dockerfile.staging @@ -16,7 +16,7 @@ COPY .git .git ADD https://github.com/rancherlabs/website-theme/archive/master.tar.gz /run/master.tar.gz RUN mkdir -p /output /theme/rancher-website-theme && tar -xzf /run/master.tar.gz -C /run/node_modules/rancher-website-theme --strip=1 && rm /run/master.tar.gz -RUN ["hugo", "--buildDrafts", "--buildFuture", "--baseURL=https://staging.rancher.com/docs", "--destination=/output"] +RUN ["hugo", "--buildDrafts", "--buildFuture", "--destination=/output"] # Make sure something got built RUN stat /output/index.html diff --git a/config.toml b/config.toml index 35fdfda6e03..de5a060aead 100644 --- a/config.toml +++ b/config.toml @@ -1,4 +1,4 @@ -baseURL = "" +baseURL = ".Permalink" languageCode = "en-us" title = "Rancher Labs" diff --git a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md index 2e0d6d70fc3..9244102623d 100644 --- a/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.6/en/admin-settings/pod-security-policies/_index.md @@ -9,6 +9,7 @@ If a pod does not meet the conditions specified in the PSP, Kubernetes will not - [How PSPs Work](#how-psps-work) - [Default PSPs](#default-psps) + - [Restricted-NoRoot](#restricted-noroot) - [Restricted](#restricted) - [Unrestricted](#unrestricted) - [Creating PSPs](#creating-psps) @@ -28,18 +29,22 @@ PSPs work through inheritance: Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP. -Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). +Read more about Pod Security Policies in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). # Default PSPs -Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies. +Rancher ships with three default Pod Security Policies (PSPs): the `restricted-noroot`, `restricted` and `unrestricted` policies. -### Restricted +### Restricted-NoRoot This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy: - Prevents pods from running as a privileged user and prevents escalation of privileges. -- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. +- Validates that server-required security mechanisms are in place, such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added. + +### Restricted + +This policy is a relaxed version of the `restricted-noroot` policy, with almost all the restrictions in place, except for the fact that it allows running containers as a privileged user. ### Unrestricted @@ -51,9 +56,9 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr ### Requirements -Rancher can only assign PSPs for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/) +Rancher can only assign PSPs for clusters that are [launched using RKE]({{< baseurl >}}/rancher/v2.6/en/cluster-provisioning/rke-clusters/). -You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/) +You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster]({{}}/rancher/v2.6/en/cluster-admin/editing-clusters/). It is a best practice to set PSP at the cluster level. @@ -63,19 +68,11 @@ We recommend adding PSPs during cluster and project creation instead of adding i 1. In the upper left corner, click **☰ > Cluster Management**. 1. In the left navigation bar, click **Pod Security Policies**. -1. Click **Add policy**. +1. Click **Add Policy**. 1. Name the policy. 1. Complete each section of the form. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) for more information on what each policy does. 1. Click **Create**. # Configuration -The Kubernetes documentation on PSPs is [here.](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) - - - - - -[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems -[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces -[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups +The Kubernetes documentation on PSPs is [here](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). diff --git a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md index 022b08762ce..c2767b8a66f 100644 --- a/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -5,7 +5,7 @@ weight: 1127 Cluster and project roles define user authorization inside a cluster or project. -To manage these roles, +To manage these roles, 1. Click **☰ > Users & Authentication**. 1. In the left navigation bar, click **Roles** and go to the **Cluster** or **Project/Namespaces** tab. @@ -60,8 +60,8 @@ The following table lists the permissions available for the `Manage Nodes` role | SSH Access | ✓ | ✓ | | Delete Nodes | ✓ | ✓ | | Scale Clusters Up and Down | ✓ | * | -***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** -
+***In RKE2, you must have permission to edit a cluster to be able to scale clusters up and down.** +
For details on how each cluster role can access Kubernetes resources, you can look them up in the Rancher UI: @@ -81,12 +81,24 @@ To assign a custom role to a new cluster member, you can use the Rancher UI. To To assign the role to a new cluster member, +{{% tabs %}} +{{% tab "Rancher before v2.6.4" %}} 1. Click **☰ > Cluster Management**. 1. Go to the cluster where you want to assign a role to a member and click **Explore**. 1. Click **RBAC > Cluster Members**. 1. Click **Add**. 1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. 1. Click **Create**. +{{% /tab %}} +{{% tab "Rancher v2.6.4+" %}} +1. Click **☰ > Cluster Management**. +1. Go to the cluster where you want to assign a role to a member and click **Explore**. +1. Click **Cluster > Cluster Members**. +1. Click **Add**. +1. In the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member. +1. Click **Create**. +{{% /tab %}} +{{% /tabs %}} **Result:** The member has the assigned role. diff --git a/content/rancher/v2.6/en/api/_index.md b/content/rancher/v2.6/en/api/_index.md index a4b56bd9478..d1cc9cc4454 100644 --- a/content/rancher/v2.6/en/api/_index.md +++ b/content/rancher/v2.6/en/api/_index.md @@ -5,7 +5,22 @@ weight: 24 ## How to use the API -The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint (`https:///v3`) as well as create [API keys]({{}}/rancher/v2.6/en/user-settings/api-keys/). +The API has its own user interface accessible from a web browser. This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response. To access it: + +{{% tabs %}} +{{% tab "Rancher v2.6.4+" %}} + +1. Click on your user avatar in the upper right corner. +1. Click **Account & API Keys**. +1. Under the **API Keys** section, find the **API Endpoint** field and click the link. The link will look something like `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% tab "Rancher before v2.6.4" %}} + +Go to the URL endpoint at `https:///v3`, where `` is the fully qualified domain name of your Rancher deployment. + +{{% /tab %}} +{{% /tabs %}} ## Authentication diff --git a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md index 1f20f311720..468b179d348 100644 --- a/content/rancher/v2.6/en/backups/restoring-rancher/_index.md +++ b/content/rancher/v2.6/en/backups/restoring-rancher/_index.md @@ -5,6 +5,15 @@ weight: 2 A restore is performed by creating a Restore custom resource. +--- +**Caution:** Before performing a restore or rollback, note the following: + +- In Rancher v2.6.4, the cluster-api module has been upgraded from v0.4.4 to v1.0.2 in which the apiVersion of CAPI CRDs are upgraded from `cluster.x-k8s.io/v1alpha4` to `cluster.x-k8s.io/v1beta1`. This has the effect of causing rollbacks from Rancher v2.6.4 to any previous version of Rancher v2.6.x to fail because the previous version the CRDs needed to roll back are no longer available in v1beta1. + +- To avoid this, the Rancher resource cleanup scripts should be run **before** the restore or rollback is attempted. Specifically, two scripts have been created to assist you: one to clean up the cluster (`cleanup.sh`), and one to check for any Rancher-related resources in the cluster (`verify.sh`). Details on the cleanup script can be found in the [rancherlabs/support-tools repo](https://github.com/rancherlabs/support-tools/tree/master/cleanup-rancher-k8s-resources). + +--- + > **Important** > > * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.]({{}}/rancher/v2.6/en/backups/migrating-rancher) diff --git a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md index cb8fdb4b278..ea4bbde4872 100644 --- a/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md +++ b/content/rancher/v2.6/en/faq/networking/cni-providers/_index.md @@ -109,6 +109,12 @@ Calico also provides a stateless IP-in-IP or VXLAN encapsulation mode that can b Kubernetes workers should open TCP port `179` if using BGP or UDP port `4789` if using VXLAN encapsulation. In addition, TCP port `5473` is needed when using Typha. See [the port requirements for user clusters]({{}}/rancher/v2.6/en/cluster-provisioning/node-requirements/#networking-requirements) for more details. +>**Important:** In Rancher v2.6.3, Calico probes fail on Windows nodes upon RKE2 installation. Note that this issue is resolved in v2.6.4. +> +>- To work around this issue, first navigate to `https:///v3/settings/windows-rke2-install-script`. +> +>- There, change the current setting: `https://raw.githubusercontent.com/rancher/wins/v0.1.3/install.ps1` to this new setting: `https://raw.githubusercontent.com/rancher/rke2/master/windows/rke2-install.ps1`. + ![Calico Diagram]({{}}/img/rancher/calico-diagram.svg) For more information, see the following pages: diff --git a/content/rancher/v2.6/en/helm-charts/_index.md b/content/rancher/v2.6/en/helm-charts/_index.md index b5313d0bd54..d225e2f5854 100644 --- a/content/rancher/v2.6/en/helm-charts/_index.md +++ b/content/rancher/v2.6/en/helm-charts/_index.md @@ -74,7 +74,8 @@ To add a private CA for Helm Chart repositories: [...] ``` -- **Git-based chart repositories**: You must add a base64 encoded copy of the CA certificate in DER format to the spec.caBundle field of the chart repo, such as `openssl x509 -outform der -in ca.pem | base64 -w0`. Click **Edit YAML** for the chart repo and set, as in the following example:
+ +- **Git-based chart repositories**: It is not currently possible to add a private CA. For git-based chart repositories with a certificate signed by a private CA, you must disable TLS verification. Click **Edit YAML** for the chart repo and add the key/value pair as follows: ``` [...] spec: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md index 5776af8f778..5d97210cc95 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/_index.md @@ -104,6 +104,10 @@ There are three recommended options for the source of the certificate used for T ### 4. Install cert-manager +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + +> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). + > You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/chart-options/#external-tls-termination). This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). @@ -116,7 +120,7 @@ These instructions are adapted from the [official cert-manager documentation](ht ``` # If you have installed the CRDs manually instead of with the `--set installCRDs=true` option added to your Helm install command, you should upgrade your CRD resources before upgrading the Helm chart: -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml # Add the Jetstack Helm repository helm repo add jetstack https://charts.jetstack.io @@ -128,7 +132,7 @@ helm repo update helm install cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ - --version v1.5.1 + --version v1.7.1 ``` Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods: diff --git a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md index 5c25a7f24b8..cfe481e2b94 100644 --- a/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md +++ b/content/rancher/v2.6/en/installation/install-rancher-on-k8s/upgrades/_index.md @@ -148,7 +148,13 @@ helm upgrade rancher rancher-/rancher \ ### Option B: Reinstalling Rancher and cert-manager -If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manager due to the API change in cert-manager v0.11. +If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. + +>**Important:** +> +>- New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. +> +>- Note that if you are below version 1.5 and want to go to 1.7, you should first upgrade to 1.6 as an intermediate step. Follow the cert-manager docs [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/) to do a 1.5 to 1.6 upgrade, and [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/) to then do a 1.6 to 1.7 upgrade. For more details on upgrading cert-manager, refer to our [documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager). 1. Uninstall Rancher diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md index 8f15d855e8e..a739fd07987 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/install-rancher/_index.md @@ -94,8 +94,10 @@ helm repo update Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager). +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ```plain -helm fetch jetstack/cert-manager --version v1.5.1 +helm fetch jetstack/cert-manager --version v1.7.1 ``` ### 3. Render the cert-manager template @@ -103,7 +105,7 @@ helm fetch jetstack/cert-manager --version v1.5.1 Render the cert-manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files. ```plain -helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ +helm template cert-manager ./cert-manager-v1.7.1.tgz --output-dir . \ --namespace cert-manager \ --set image.repository=/quay.io/jetstack/cert-manager-controller \ --set webhook.image.repository=/quay.io/jetstack/cert-manager-webhook \ @@ -115,7 +117,7 @@ helm template cert-manager ./cert-manager-v1.5.1.tgz --output-dir . \ Download the required CRD file for cert-manager: ```plain - curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml + curl -L -o cert-manager/cert-manager-crd.yaml https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` ### 5. Render the Rancher template diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md index 05b260b3aa5..18c8817f76f 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md @@ -51,6 +51,8 @@ If you will use ARM64 hosts, the registry must support manifests. As of April 20 In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + 1. Fetch the latest `cert-manager` Helm chart and parse the template for image details: > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{}}/rancher/v2.6/en/installation/resources/upgrading-cert-manager/). @@ -58,7 +60,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS ```plain helm repo add jetstack https://charts.jetstack.io helm repo update - helm fetch jetstack/cert-manager --version v1.5.1 + helm fetch jetstack/cert-manager --version v1.7.1 helm template ./cert-manager-.tgz | awk '$1 ~ /image:/ {print $2}' | sed s/\"//g >> ./rancher-images.txt ``` diff --git a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md index 35ceaf1b26a..a5a57c7b6ae 100644 --- a/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md +++ b/content/rancher/v2.6/en/installation/other-installation-methods/behind-proxy/install-rancher/_index.md @@ -23,15 +23,17 @@ kubectl create namespace cert-manager Install the CustomResourceDefinitions of cert-manager: +**Note:** New in v2.6.4, cert-manager versions 1.6.2 and 1.7.1 are compatible. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. + ``` -kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.1/cert-manager.crds.yaml +kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.7.1/cert-manager.crds.yaml ``` And install it with Helm. Note that cert-manager also needs your proxy configured in case it needs to communicate with Let's Encrypt or other external certificate issuers: ``` helm upgrade --install cert-manager jetstack/cert-manager \ - --namespace cert-manager --version v1.5.1 \ + --namespace cert-manager --version v1.7.1 \ --set http_proxy=http://${proxy_host} \ --set https_proxy=http://${proxy_host} \ --set no_proxy=127.0.0.0/8\\,10.0.0.0/8\\,cattle-system.svc\\,172.16.0.0/12\\,192.168.0.0/16\\,.svc\\,.cluster.local diff --git a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md index 3879ab15d1f..f3b21f8aed0 100644 --- a/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md +++ b/content/rancher/v2.6/en/installation/resources/upgrading-cert-manager/_index.md @@ -15,7 +15,7 @@ To address these changes, this guide will do two things: 1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data > **Important:** -> If you are currently running the cert-manager whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them: +> If you are currently running the cert-manager whose version is 1.5 or below, and want to upgrade both Rancher and cert-manager to a new version (1.6+ in the case of cert-manager), then you need to re-install both Rancher and cert-manager due to the API change in cert-manager 1.6. This will also be necessary if you are upgrading from a version of cert manager below 0.11 to a version of cert-manager above 0.11. Follow the steps below: > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server > 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager @@ -220,6 +220,13 @@ cert-manager-webhook-787858fcdb-nlzsq 1/1 Running 0 2m ## Cert-Manager API change and data migration +--- +_New in v2.6.4_ + +Rancher now supports cert-manager versions 1.6.2 and 1.7.1. We recommend v1.7.x because v 1.6.x will reach end-of-life on March 30, 2022. To read more, see the [cert-manager docs]({{}}/rancher/v2.6/en/installation/install-rancher-on-k8s/#4-install-cert-manager). For instructions on upgrading cert-manager from version 1.5 to 1.6, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.5-1.6/). For instructions on upgrading cert-manager from version 1.6 to 1.7, see the upstream cert-manager documentation [here](https://cert-manager.io/docs/installation/upgrading/upgrading-1.6-1.7/). + +--- + Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release. Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format. diff --git a/content/rancher/v2.6/en/security/_index.md b/content/rancher/v2.6/en/security/_index.md index 1f121f11ed2..0cd5e3dcaf4 100644 --- a/content/rancher/v2.6/en/security/_index.md +++ b/content/rancher/v2.6/en/security/_index.md @@ -11,7 +11,7 @@ weight: 20

Reporting process

-

Please submit possible security issues by emailing security@rancher.com .

+

Please submit possible security issues by emailing security-rancher@suse.com .

Announcements

diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf new file mode 100644 index 00000000000..f08210f51e6 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf @@ -0,0 +1,14832 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 309 0 R 313 0 R 315 0 R 318 0 R 323 0 R 325 0 R 349 0 R 374 0 R 407 0 R 440 0 R 464 0 R 503 0 R 508 0 R 511 0 R 514 0 R 516 0 R 519 0 R 521 0 R 524 0 R 527 0 R 529 0 R 532 0 R 534 0 R 537 0 R 540 0 R 542 0 R 545 0 R 548 0 R 550 0 R 553 0 R 555 0 R 559 0 R 562 0 R 565 0 R 567 0 R 570 0 R 572 0 R 575 0 R 578 0 R 580 0 R 583 0 R 586 0 R 588 0 R 591 0 R 593 0 R 596 0 R 599 0 R 601 0 R 604 0 R 607 0 R 609 0 R 612 0 R 614 0 R 617 0 R 620 0 R 622 0 R 625 0 R 627 0 R 630 0 R 633 0 R 635 0 R 638 0 R 641 0 R 643 0 R 660 0 R 674 0 R 677 0 R 680 0 R 683 0 R 686 0 R 689 0 R 692 0 R 694 0 R 698 0 R 700 0 R 703 0 R 705 0 R 708 0 R 710 0 R 713 0 R 715 0 R 717 0 R 720 0 R 722 0 R 725 0 R 727 0 R 730 0 R 732 0 R 734 0 R 737 0 R 739 0 R 741 0 R 743 0 R 746 0 R 748 0 R 751 0 R 755 0 R 764 0 R 772 0 R 774 0 R 779 0 R 784 0 R 790 0 R 794 0 R 798 0 R 804 0 R 808 0 R 812 0 R 815 0 R 817 0 R 842 0 R 853 0 R 856 0 R 860 0 R 863 0 R 880 0 R 887 0 R 889 0 R 891 0 R 893 0 R ] +/Count 131 +>> +endobj +2 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Creator (pandoc) +/Producer (WeasyPrint 54.2) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 1055 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 508 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 891 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 741 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 315 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 315 0 R /XYZ 101.433071 205.473057 0 ] (cb10) [ 349 0 R /XYZ 84.259843 342.035606 0 ] (cb10-1) [ 349 0 R /XYZ 101.433071 340.338585 0 ] (cb101) [ 622 0 R /XYZ 84.259843 504.320079 0 ] (cb101-1) [ 622 0 R /XYZ 101.433071 502.623057 0 ] (cb104) [ 627 0 R /XYZ 84.259843 772.370079 0 ] (cb104-1) [ 627 0 R /XYZ 101.433071 770.673057 0 ] (cb107) [ 630 0 R /XYZ 84.259843 313.070079 0 ] (cb107-1) [ 630 0 R /XYZ 101.433071 311.373057 0 ] (cb110) [ 635 0 R /XYZ 84.259843 560.570079 0 ] (cb110-1) [ 635 0 R /XYZ 101.433071 558.873057 0 ] (cb113) [ 638 0 R /XYZ 84.259843 110.570079 0 ] (cb113-1) [ 638 0 R /XYZ 101.433071 108.873057 0 ] (cb116) [ 643 0 R /XYZ 84.259843 418.070079 0 ] (cb116-1) [ 643 0 R /XYZ 101.433071 416.373057 0 ] (cb116-10) [ 643 0 R /XYZ 99.933071 189.008799 0 ] (cb116-11) [ 643 0 R /XYZ 99.933071 170.061778 0 ] (cb116-12) [ 643 0 R /XYZ 99.933071 151.114756 0 ] (cb116-13) [ 643 0 R /XYZ 99.933071 132.167735 0 ] (cb116-14) [ 643 0 R /XYZ 99.933071 113.220714 0 ] (cb116-15) [ 643 0 R /XYZ 99.933071 94.273692 0 ] (cb116-16) [ 660 0 R /XYZ 99.933071 799.173057 0 ] (cb116-17) [ 660 0 R /XYZ 99.933071 780.226036 0 ] (cb116-18) [ 660 0 R /XYZ 99.933071 761.279014 0 ] (cb116-19) [ 660 0 R /XYZ 99.933071 742.331993 0 ] (cb116-2) [ 643 0 R /XYZ 99.933071 397.426036 0 ] (cb116-20) [ 660 0 R /XYZ 99.933071 723.384971 0 ] (cb116-21) [ 660 0 R /XYZ 99.933071 704.437950 0 ] (cb116-22) [ 660 0 R /XYZ 99.933071 685.490928 0 ] (cb116-23) [ 660 0 R /XYZ 99.933071 666.543907 0 ] (cb116-24) [ 660 0 R /XYZ 99.933071 647.596885 0 ] (cb116-25) [ 660 0 R /XYZ 99.933071 628.649864 0 ] (cb116-3) [ 643 0 R /XYZ 99.933071 378.479014 0 ] (cb116-4) [ 643 0 R /XYZ 99.933071 340.584971 0 ] (cb116-5) [ 643 0 R /XYZ 99.933071 321.637950 0 ] (cb116-6) [ 643 0 R /XYZ 99.933071 302.690928 0 ] (cb116-7) [ 643 0 R /XYZ 99.933071 283.743907 0 ] (cb116-8) [ 643 0 R /XYZ 99.933071 264.796885 0 ] (cb116-9) [ 643 0 R /XYZ 99.933071 226.902842 0 ] (cb117) [ 660 0 R /XYZ 84.259843 569.399864 0 ] (cb117-1) [ 660 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 660 0 R /XYZ 84.259843 196.152842 0 ] (cb120-1) [ 660 0 R /XYZ 101.433071 194.455821 0 ] (cb121) [ 674 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 674 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 677 0 R /XYZ 84.259843 571.820079 0 ] (cb124-1) [ 677 0 R /XYZ 101.433071 570.123057 0 ] (cb127) [ 680 0 R /XYZ 84.259843 575.570079 0 ] (cb127-1) [ 680 0 R /XYZ 101.433071 573.873057 0 ] (cb13) [ 374 0 R /XYZ 84.259843 711.620079 0 ] (cb13-1) [ 374 0 R /XYZ 101.433071 709.923057 0 ] (cb13-10) [ 374 0 R /XYZ 99.933071 501.505821 0 ] (cb13-11) [ 374 0 R /XYZ 99.933071 482.558799 0 ] (cb13-12) [ 374 0 R /XYZ 99.933071 463.611778 0 ] (cb13-13) [ 374 0 R /XYZ 99.933071 444.664756 0 ] (cb13-14) [ 374 0 R /XYZ 99.933071 425.717735 0 ] (cb13-15) [ 374 0 R /XYZ 99.933071 406.770714 0 ] (cb13-16) [ 374 0 R /XYZ 99.933071 387.823692 0 ] (cb13-17) [ 374 0 R /XYZ 99.933071 368.876671 0 ] (cb13-18) [ 374 0 R /XYZ 99.933071 349.929649 0 ] (cb13-19) [ 374 0 R /XYZ 99.933071 330.982628 0 ] (cb13-2) [ 374 0 R /XYZ 99.933071 690.976036 0 ] (cb13-20) [ 374 0 R /XYZ 99.933071 312.035606 0 ] (cb13-21) [ 374 0 R /XYZ 99.933071 293.088585 0 ] (cb13-22) [ 374 0 R /XYZ 99.933071 274.141563 0 ] (cb13-23) [ 374 0 R /XYZ 99.933071 255.194542 0 ] (cb13-24) [ 374 0 R /XYZ 99.933071 236.247520 0 ] (cb13-25) [ 374 0 R /XYZ 99.933071 217.300499 0 ] (cb13-26) [ 374 0 R /XYZ 99.933071 198.353477 0 ] (cb13-27) [ 374 0 R /XYZ 99.933071 179.406456 0 ] (cb13-28) [ 374 0 R /XYZ 99.933071 160.459434 0 ] (cb13-29) [ 374 0 R /XYZ 99.933071 141.512413 0 ] (cb13-3) [ 374 0 R /XYZ 99.933071 672.029014 0 ] (cb13-30) [ 374 0 R /XYZ 99.933071 122.565391 0 ] (cb13-31) [ 374 0 R /XYZ 99.933071 103.618370 0 ] (cb13-32) [ 407 0 R /XYZ 99.933071 799.173057 0 ] (cb13-33) [ 407 0 R /XYZ 99.933071 780.226036 0 ] (cb13-34) [ 407 0 R /XYZ 99.933071 761.279014 0 ] (cb13-35) [ 407 0 R /XYZ 99.933071 742.331993 0 ] (cb13-36) [ 407 0 R /XYZ 99.933071 723.384971 0 ] (cb13-37) [ 407 0 R /XYZ 99.933071 704.437950 0 ] (cb13-38) [ 407 0 R /XYZ 99.933071 685.490928 0 ] (cb13-39) [ 407 0 R /XYZ 99.933071 666.543907 0 ] (cb13-4) [ 374 0 R /XYZ 99.933071 634.134971 0 ] (cb13-40) [ 407 0 R /XYZ 99.933071 647.596885 0 ] (cb13-41) [ 407 0 R /XYZ 99.933071 628.649864 0 ] (cb13-42) [ 407 0 R /XYZ 99.933071 609.702842 0 ] (cb13-43) [ 407 0 R /XYZ 99.933071 590.755821 0 ] (cb13-44) [ 407 0 R /XYZ 99.933071 571.808799 0 ] (cb13-45) [ 407 0 R /XYZ 99.933071 552.861778 0 ] (cb13-46) [ 407 0 R /XYZ 99.933071 533.914756 0 ] (cb13-47) [ 407 0 R /XYZ 99.933071 514.967735 0 ] (cb13-48) [ 407 0 R /XYZ 99.933071 496.020714 0 ] (cb13-49) [ 407 0 R /XYZ 99.933071 477.073692 0 ] (cb13-5) [ 374 0 R /XYZ 99.933071 596.240928 0 ] (cb13-50) [ 407 0 R /XYZ 99.933071 458.126671 0 ] (cb13-51) [ 407 0 R /XYZ 99.933071 439.179649 0 ] (cb13-52) [ 407 0 R /XYZ 99.933071 420.232628 0 ] (cb13-53) [ 407 0 R /XYZ 99.933071 382.338585 0 ] (cb13-54) [ 407 0 R /XYZ 99.933071 363.391563 0 ] (cb13-55) [ 407 0 R /XYZ 99.933071 344.444542 0 ] (cb13-56) [ 407 0 R /XYZ 99.933071 325.497520 0 ] (cb13-57) [ 407 0 R /XYZ 99.933071 306.550499 0 ] (cb13-58) [ 407 0 R /XYZ 99.933071 287.603477 0 ] (cb13-59) [ 407 0 R /XYZ 99.933071 268.656456 0 ] (cb13-6) [ 374 0 R /XYZ 99.933071 577.293907 0 ] (cb13-60) [ 407 0 R /XYZ 99.933071 249.709434 0 ] (cb13-61) [ 407 0 R /XYZ 99.933071 230.762413 0 ] (cb13-7) [ 374 0 R /XYZ 99.933071 558.346885 0 ] (cb13-8) [ 374 0 R /XYZ 99.933071 539.399864 0 ] (cb13-9) [ 374 0 R /XYZ 99.933071 520.452842 0 ] (cb130) [ 683 0 R /XYZ 84.259843 560.570079 0 ] (cb130-1) [ 683 0 R /XYZ 101.433071 558.873057 0 ] (cb133) [ 686 0 R /XYZ 84.259843 556.820079 0 ] (cb133-1) [ 686 0 R /XYZ 101.433071 555.123057 0 ] (cb136) [ 689 0 R /XYZ 84.259843 369.020079 0 ] (cb136-1) [ 689 0 R /XYZ 101.433071 367.323057 0 ] (cb139) [ 694 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 694 0 R /XYZ 101.433071 563.554475 0 ] (cb14) [ 407 0 R /XYZ 84.259843 171.512413 0 ] (cb14-1) [ 407 0 R /XYZ 101.433071 169.815391 0 ] (cb142) [ 694 0 R /XYZ 84.259843 102.004475 0 ] (cb142-1) [ 694 0 R /XYZ 101.433071 100.307453 0 ] (cb145) [ 700 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 700 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 705 0 R /XYZ 84.259843 309.320079 0 ] (cb148-1) [ 705 0 R /XYZ 101.433071 307.623057 0 ] (cb151) [ 710 0 R /XYZ 84.259843 103.070079 0 ] (cb151-1) [ 710 0 R /XYZ 101.433071 101.373057 0 ] (cb154) [ 717 0 R /XYZ 84.259843 613.970079 0 ] (cb154-1) [ 717 0 R /XYZ 101.433071 612.273057 0 ] (cb157) [ 722 0 R /XYZ 84.259843 403.070079 0 ] (cb157-1) [ 722 0 R /XYZ 101.433071 401.373057 0 ] (cb160) [ 727 0 R /XYZ 84.259843 178.070079 0 ] (cb160-1) [ 727 0 R /XYZ 101.433071 176.373057 0 ] (cb163) [ 734 0 R /XYZ 84.259843 628.970079 0 ] (cb163-1) [ 734 0 R /XYZ 101.433071 627.273057 0 ] (cb166) [ 743 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 743 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 748 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 748 0 R /XYZ 101.433071 265.954475 0 ] (cb17) [ 440 0 R /XYZ 84.259843 543.320079 0 ] (cb17-1) [ 440 0 R /XYZ 101.433071 541.623057 0 ] (cb17-10) [ 440 0 R /XYZ 99.933071 333.205821 0 ] (cb17-11) [ 440 0 R /XYZ 99.933071 314.258799 0 ] (cb17-12) [ 440 0 R /XYZ 99.933071 295.311778 0 ] (cb17-13) [ 440 0 R /XYZ 99.933071 276.364756 0 ] (cb17-14) [ 440 0 R /XYZ 99.933071 257.417735 0 ] (cb17-15) [ 440 0 R /XYZ 99.933071 238.470714 0 ] (cb17-16) [ 440 0 R /XYZ 99.933071 219.523692 0 ] (cb17-17) [ 440 0 R /XYZ 99.933071 200.576671 0 ] (cb17-18) [ 440 0 R /XYZ 99.933071 181.629649 0 ] (cb17-19) [ 440 0 R /XYZ 99.933071 162.682628 0 ] (cb17-2) [ 440 0 R /XYZ 99.933071 522.676036 0 ] (cb17-20) [ 440 0 R /XYZ 99.933071 143.735606 0 ] (cb17-21) [ 440 0 R /XYZ 99.933071 124.788585 0 ] (cb17-22) [ 440 0 R /XYZ 99.933071 105.841563 0 ] (cb17-23) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb17-24) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb17-25) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb17-26) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb17-27) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb17-28) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb17-29) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb17-3) [ 440 0 R /XYZ 99.933071 503.729014 0 ] (cb17-30) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb17-31) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb17-32) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb17-33) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb17-34) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb17-35) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb17-36) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb17-37) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb17-38) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb17-39) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb17-4) [ 440 0 R /XYZ 99.933071 465.834971 0 ] (cb17-40) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb17-41) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb17-42) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb17-43) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb17-44) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb17-45) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb17-46) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb17-47) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb17-48) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb17-49) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb17-5) [ 440 0 R /XYZ 99.933071 427.940928 0 ] (cb17-50) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb17-51) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb17-52) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb17-53) [ 464 0 R /XYZ 99.933071 211.815391 0 ] (cb17-54) [ 464 0 R /XYZ 99.933071 192.868370 0 ] (cb17-55) [ 464 0 R /XYZ 99.933071 173.921348 0 ] (cb17-56) [ 464 0 R /XYZ 99.933071 154.974327 0 ] (cb17-57) [ 464 0 R /XYZ 99.933071 136.027305 0 ] (cb17-58) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb17-59) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb17-6) [ 440 0 R /XYZ 99.933071 408.993907 0 ] (cb17-60) [ 503 0 R /XYZ 99.933071 799.173057 0 ] (cb17-61) [ 503 0 R /XYZ 99.933071 780.226036 0 ] (cb17-7) [ 440 0 R /XYZ 99.933071 390.046885 0 ] (cb17-8) [ 440 0 R /XYZ 99.933071 371.099864 0 ] (cb17-9) [ 440 0 R /XYZ 99.933071 352.152842 0 ] (cb172) [ 751 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 751 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 751 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 751 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 755 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 755 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 755 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 755 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 755 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 755 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 755 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 755 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 503 0 R /XYZ 84.259843 720.976036 0 ] (cb18-1) [ 503 0 R /XYZ 101.433071 719.279014 0 ] (cb180) [ 755 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 755 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 764 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 764 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 764 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 764 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 764 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 764 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 764 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 764 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 774 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 774 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 774 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 774 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 774 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 774 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 779 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 779 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 779 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 779 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 779 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 779 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 784 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 784 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 784 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 784 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 784 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 784 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 784 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 784 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 318 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 318 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 790 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 790 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 790 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 790 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 794 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 794 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 794 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 794 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 798 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 798 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 798 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 798 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 508 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 508 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 798 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 798 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 798 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 798 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 804 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 804 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 804 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 804 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 808 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 808 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 808 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 808 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 812 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 812 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 817 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 817 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 817 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 817 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 817 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 817 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 817 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 817 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 817 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 817 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 817 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 817 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 817 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 817 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 817 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 817 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 817 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 842 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 842 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 842 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 842 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 842 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 842 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 817 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 842 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 842 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 817 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 817 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 817 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 817 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 817 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 817 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 842 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 842 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 853 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 853 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 856 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 856 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 856 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 856 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 860 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 860 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 863 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 863 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 863 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 863 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 863 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 863 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 863 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 863 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 880 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 880 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 880 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 880 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 863 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 863 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 863 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 863 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 863 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 863 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 863 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 863 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 880 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 880 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 511 0 R /XYZ 84.259843 125.570079 0 ] (cb24-1) [ 511 0 R /XYZ 101.433071 123.873057 0 ] (cb241) [ 893 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 893 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 893 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 893 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 893 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 893 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 893 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 893 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 893 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 893 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 893 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 893 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 893 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 893 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 893 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 893 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 893 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 893 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 893 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 893 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 893 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 516 0 R /XYZ 84.259843 425.570079 0 ] (cb27-1) [ 516 0 R /XYZ 101.433071 423.873057 0 ] (cb3) [ 318 0 R /XYZ 84.259843 523.623057 0 ] (cb3-1) [ 318 0 R /XYZ 101.433071 521.926036 0 ] (cb30) [ 521 0 R /XYZ 84.259843 715.370079 0 ] (cb30-1) [ 521 0 R /XYZ 101.433071 713.673057 0 ] (cb33) [ 524 0 R /XYZ 84.259843 211.820079 0 ] (cb33-1) [ 524 0 R /XYZ 101.433071 210.123057 0 ] (cb36) [ 529 0 R /XYZ 84.259843 451.820079 0 ] (cb36-1) [ 529 0 R /XYZ 101.433071 450.123057 0 ] (cb39) [ 534 0 R /XYZ 84.259843 730.370079 0 ] (cb39-1) [ 534 0 R /XYZ 101.433071 728.673057 0 ] (cb42) [ 537 0 R /XYZ 84.259843 294.320079 0 ] (cb42-1) [ 537 0 R /XYZ 101.433071 292.623057 0 ] (cb45) [ 542 0 R /XYZ 84.259843 575.570079 0 ] (cb45-1) [ 542 0 R /XYZ 101.433071 573.873057 0 ] (cb48) [ 545 0 R /XYZ 84.259843 129.320079 0 ] (cb48-1) [ 545 0 R /XYZ 101.433071 127.623057 0 ] (cb51) [ 550 0 R /XYZ 84.259843 350.570079 0 ] (cb51-1) [ 550 0 R /XYZ 101.433071 348.873057 0 ] (cb54) [ 555 0 R /XYZ 84.259843 538.070079 0 ] (cb54-1) [ 555 0 R /XYZ 101.433071 536.373057 0 ] (cb55) [ 555 0 R /XYZ 84.259843 301.323057 0 ] (cb55-1) [ 555 0 R /XYZ 101.433071 299.626036 0 ] (cb56) [ 559 0 R /XYZ 84.259843 799.370079 0 ] (cb56-1) [ 559 0 R /XYZ 101.433071 797.673057 0 ] (cb59) [ 562 0 R /XYZ 84.259843 350.570079 0 ] (cb59-1) [ 562 0 R /XYZ 101.433071 348.873057 0 ] (cb6) [ 318 0 R /XYZ 84.259843 138.376036 0 ] (cb6-1) [ 318 0 R /XYZ 101.433071 136.679014 0 ] (cb62) [ 567 0 R /XYZ 84.259843 598.970079 0 ] (cb62-1) [ 567 0 R /XYZ 101.433071 597.273057 0 ] (cb65) [ 572 0 R /XYZ 84.259843 772.370079 0 ] (cb65-1) [ 572 0 R /XYZ 101.433071 770.673057 0 ] (cb68) [ 575 0 R /XYZ 84.259843 271.820079 0 ] (cb68-1) [ 575 0 R /XYZ 101.433071 270.123057 0 ] (cb71) [ 580 0 R /XYZ 84.259843 571.820079 0 ] (cb71-1) [ 580 0 R /XYZ 101.433071 570.123057 0 ] (cb74) [ 583 0 R /XYZ 84.259843 144.320079 0 ] (cb74-1) [ 583 0 R /XYZ 101.433071 142.623057 0 ] (cb77) [ 588 0 R /XYZ 84.259843 440.570079 0 ] (cb77-1) [ 588 0 R /XYZ 101.433071 438.873057 0 ] (cb80) [ 593 0 R /XYZ 84.259843 715.370079 0 ] (cb80-1) [ 593 0 R /XYZ 101.433071 713.673057 0 ] (cb83) [ 596 0 R /XYZ 84.259843 275.570079 0 ] (cb83-1) [ 596 0 R /XYZ 101.433071 273.873057 0 ] (cb86) [ 601 0 R /XYZ 84.259843 556.820079 0 ] (cb86-1) [ 601 0 R /XYZ 101.433071 555.123057 0 ] (cb89) [ 604 0 R /XYZ 84.259843 125.570079 0 ] (cb89-1) [ 604 0 R /XYZ 101.433071 123.873057 0 ] (cb9) [ 325 0 R /XYZ 84.259843 509.420079 0 ] (cb9-1) [ 325 0 R /XYZ 101.433071 507.723057 0 ] (cb9-10) [ 325 0 R /XYZ 99.933071 318.252842 0 ] (cb9-11) [ 325 0 R /XYZ 99.933071 299.305821 0 ] (cb9-12) [ 325 0 R /XYZ 99.933071 280.358799 0 ] (cb9-13) [ 325 0 R /XYZ 99.933071 261.411778 0 ] (cb9-14) [ 325 0 R /XYZ 99.933071 242.464756 0 ] (cb9-15) [ 325 0 R /XYZ 99.933071 223.517735 0 ] (cb9-16) [ 325 0 R /XYZ 99.933071 204.570714 0 ] (cb9-17) [ 325 0 R /XYZ 99.933071 185.623692 0 ] (cb9-18) [ 325 0 R /XYZ 99.933071 166.676671 0 ] (cb9-19) [ 325 0 R /XYZ 99.933071 147.729649 0 ] (cb9-2) [ 325 0 R /XYZ 99.933071 488.776036 0 ] (cb9-20) [ 325 0 R /XYZ 99.933071 128.782628 0 ] (cb9-21) [ 325 0 R /XYZ 99.933071 109.835606 0 ] (cb9-22) [ 325 0 R /XYZ 99.933071 90.888585 0 ] (cb9-23) [ 349 0 R /XYZ 99.933071 799.173057 0 ] (cb9-24) [ 349 0 R /XYZ 99.933071 780.226036 0 ] (cb9-25) [ 349 0 R /XYZ 99.933071 761.279014 0 ] (cb9-26) [ 349 0 R /XYZ 99.933071 742.331993 0 ] (cb9-27) [ 349 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 349 0 R /XYZ 99.933071 704.437950 0 ] (cb9-29) [ 349 0 R /XYZ 99.933071 685.490928 0 ] (cb9-3) [ 325 0 R /XYZ 99.933071 469.829014 0 ] (cb9-30) [ 349 0 R /XYZ 99.933071 666.543907 0 ] (cb9-31) [ 349 0 R /XYZ 99.933071 647.596885 0 ] (cb9-32) [ 349 0 R /XYZ 99.933071 628.649864 0 ] (cb9-33) [ 349 0 R /XYZ 99.933071 609.702842 0 ] (cb9-34) [ 349 0 R /XYZ 99.933071 590.755821 0 ] (cb9-35) [ 349 0 R /XYZ 99.933071 571.808799 0 ] (cb9-36) [ 349 0 R /XYZ 99.933071 552.861778 0 ] (cb9-37) [ 349 0 R /XYZ 99.933071 533.914756 0 ] (cb9-38) [ 349 0 R /XYZ 99.933071 514.967735 0 ] (cb9-39) [ 349 0 R /XYZ 99.933071 496.020714 0 ] (cb9-4) [ 325 0 R /XYZ 99.933071 431.934971 0 ] (cb9-40) [ 349 0 R /XYZ 99.933071 477.073692 0 ] (cb9-41) [ 349 0 R /XYZ 99.933071 458.126671 0 ] (cb9-42) [ 349 0 R /XYZ 99.933071 439.179649 0 ] (cb9-43) [ 349 0 R /XYZ 99.933071 420.232628 0 ] (cb9-44) [ 349 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 325 0 R /XYZ 99.933071 412.987950 0 ] (cb9-6) [ 325 0 R /XYZ 99.933071 394.040928 0 ] (cb9-7) [ 325 0 R /XYZ 99.933071 375.093907 0 ] (cb9-8) [ 325 0 R /XYZ 99.933071 356.146885 0 ] (cb9-9) [ 325 0 R /XYZ 99.933071 337.199864 0 ] (cb92) [ 609 0 R /XYZ 84.259843 440.570079 0 ] (cb92-1) [ 609 0 R /XYZ 101.433071 438.873057 0 ] (cb95) [ 614 0 R /XYZ 84.259843 685.370079 0 ] (cb95-1) [ 614 0 R /XYZ 101.433071 683.673057 0 ] (cb98) [ 617 0 R /XYZ 84.259843 238.070079 0 ] (cb98-1) [ 617 0 R /XYZ 101.433071 236.373057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 741 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 889 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 887 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 674 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 309 0 R /XYZ 84.259843 612.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 891 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 743 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 734 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 863 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 815 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 643 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 842 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 508 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 596 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 604 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 591 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 537 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 542 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 532 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 774 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 710 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 511 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 689 0 R /XYZ 84.259843 524.420079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 694 0 R /XYZ 84.259843 257.404475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 700 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 630 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 779 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 705 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 638 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 635 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 622 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 794 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 794 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 575 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 580 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 751 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 529 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 524 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 519 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 794 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 727 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 717 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 722 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 588 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 677 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 694 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 790 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 779 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 609 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 798 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 583 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 617 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 612 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 683 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 784 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 674 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 625 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 798 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 516 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 680 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 586.670079 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 550 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 555 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 545 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 562 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 570 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 567 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 555 0 R /XYZ 84.259843 501.723057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 555 0 R /XYZ 84.259843 264.976036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 774 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 660 0 R /XYZ 84.259843 411.552842 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 746 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 755 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 815 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 863 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 315 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 315 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 313 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 209.270079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 318 0 R /XYZ 84.259843 365.776036 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 318 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 764 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 764 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 808 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 748 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 349 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 440 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 751 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 689 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 313 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 323 0 R /XYZ 84.259843 340.070079 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 323 0 R /XYZ 84.259843 470.870079 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 891 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 700 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 891 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 748 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 774 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 743 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 313 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 815 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 815 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 853 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 856 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 853 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 860 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 856 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 860 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 860 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 853 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 860 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 815 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 863 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 853 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 887 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 815 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 694 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 887 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 891 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 808 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 748 0 R /XYZ 41.740157 784.430079 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 1076 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2619 +>> +stream +x[Wa咪tc! "d1!v1u.׭CO{n̶II4ς?ZΗק7' 5 =jȱϯ]5ԞS-~w +DMt_C#?%oUͩGk@׃GMMɆ=럹te mGT|r´\D~6,ct3Oi='" 9ۮy-rH6я.'6Z;Ugc)յͅ'cn꿠Έx/.c.I y=NyBp]۸Sd˒"-y&?S9>y5Zk?S|HL[huݖ+:}v_؄wsےmڇy {q^7Ŏ>Pnt;3ϣeNVyei׹Kiw!ۘ͞dh&ۄ0@aF8Nq2q/_OGKSu$*=ˊ7dFirI&-dxd{b=c m_VuoV6uQ/jUh쯃f[:]! w]!ZKۃh샢MؗewfC̥wm +ƖFxSV݇-.Huo['w?x}L.t}Jv|1Nqrߜ1GwK3YGcv}tحC'!t duTne9޸U3X_E>x3[ҙݝz;Y=g.وOO:ds#ڞװeHYCϏǜzz&$u@}\YJCVmW#wߕ<ވ}&lG0UҎEbj }?o׃S ]fRJ=m *^ E:9 H +endstream +endobj +6 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 5 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3661 +>> +stream +x\[ܶ~_C/@Q  $Ѥ-`oq(p6-}onD{4?)?,1̗ǏK'Ȝ69=X&(7~n8Ll'5t0Lٺ㯯C: +i3't%t?Û桇HS6̖Dqp"HtIe:[;_o;7u0ho]w &xqJK:zB!qXI4ȶi7cgjQoiqCs\ 41E;;ߏQ1Br(,,q [Bt\!*5GvFt [BBt??ѽ-Dl~lC(f⦎!*p\>^C4G G[C2x Pm.=vF;Ԁ2yMف.AH#f1Dx]8;Xiڄ`jDŽh {9o-Do! чEeJMчB}Ot/-Do!z GMt8A򗌏%FoMpP fB" L%VdM] +FI;9(2lf"T@g!E&sBe4(:E&la2G{ c de3&ͬpt,$CЙ'CaYV8dVV8d8DCsA}Q8d 19Cf'&}vF0@go8,oJ8: :["qXRO]$`D#40QdgR8 HxĘ(>ptv:CxAJA0xl3"U CgcMT9hrBD M^uFGI0oaBDOqX{ZM :;.È%H*Fm Y0ZVSj5%VS@1dLjJD4:DAA +upBM:{d2CAxh5%1)9!X)#i5%fLRZMLSjJ2n!pL!$ dp:{!fC7 +AgrV)AgCgVSy2*!3?lO N$)u"y*_i5%%XLX c0Ed3Yj +<xjJPjJak5~1VS2ZM#O1`p__VS2G Cg8dLrζD"3fZM:ÊݲVSryəa)DguB""kU^홌B#,P+O(s^W{kWƄbNC6.ŋ}ߝ5K_8`|X0*TFd#te- _ ś}?/>e::W:uGxD͠vޯ-"ڀtLQw囿tsqgl3g|ͣjb|͇2|c+G4,{ʹh>awʹii|.as:ɩ+2{z=%eFDf-`ҙqYfImqָum̦>k0s3fNOީl> D|d:Zu/D9&?ٓeݞidڒVx~;9@3~b-E(oJ3g#4NRT#NOcybYt'$eg!˹?O>Hۑ| NMgxo3ksW,f߷Ϊ9OdG`Oʝ>W^(IQk{[)n5ى\ƒyY}"Aqvާ?Ў]O{ֶ}9 ۯ[sۗV^VL\/ň Eٖ atteGS /#R_їhbC ˛zX-=<.Vapԏv ta/6/R_6w.{| >WC[ILlٝoq/olS1@ٔe'^3>`<ؗp=4-o`N,Ka9̭qaMz[BYqwg1 #Iz*{^Way ]R;:+_e) +sjn9zmUv4 rCJ6f|c?71A.FSZT7\vaWnmbJ\tWw(ĝ8-/A¡X$7Ow6݁4\ahthR!4+V6T -g>T(NJl6x$Ieǀ +lg%_6ttcl@eWTK#l5O˕4U tan|7]OnZV`ݹr睄c ׁ |s~tLv3vŐ: hm{U\1򍪛7i=2__n[8-U^r[HrVljDv{-vU905%33D汶{9uuplZD_s$E8+'q#Nd8٠fqHI)\KiD9ueV6]yB[qCNώG}U9(hK hXA[G|Vsܱ =&9=4'GmN}ņNkh|Sb:J> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.750423 648.111024 496.429134 633.111024 ] +/BS << +/W 0 +>> +/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.21) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.690364 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (controls) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 485.521907 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (master-node-configuration-files) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 530.961024 498.679134 507.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 510.561024 491.179134 495.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 491.361024 498.679134 467.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 470.961024 491.179134 455.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 451.761024 498.679134 428.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 431.361024 491.179134 416.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 412.161024 498.679134 388.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 391.761024 491.179134 376.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 372.561024 498.679134 349.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 352.161024 491.179134 337.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 332.961024 498.679134 309.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +26 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 312.561024 491.179134 297.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +27 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 293.361024 498.679134 269.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 272.961024 491.179134 257.961024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +29 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.761024 498.679134 230.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +30 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 233.361024 491.179134 218.361024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) +>> +endobj +31 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 214.161024 498.679134 190.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +32 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 193.761024 491.179134 178.761024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 174.561024 498.679134 151.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 154.161024 491.179134 139.161024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.961024 498.679134 111.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 114.561024 491.179134 99.561024 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) +>> +endobj +37 0 obj +<< +/Filter /FlateDecode +/Length 3681 +>> +stream +x\[~?< AI&`ȕ%-}41 g LL S! LA@#ɢ3g ,:/&΁7\ L1yЋX1PĠ3ǐDgP A.ML@rc&J61ѻ90Μ$љ!0!ɢ3%,H CB!/:byK!0 :{HrJ6&:ʉcD(?DQ&G1b6G#.`cDgF (:P?$%(e#5ȧlƑ!r6| lA!0A lR9 R1QIHD.)"c1s`Nb`cDgJ1"$13x Rc1A :^dLSD'dKVhKR:(s 13 a@Pl,0Re7EXGd<d%0˔geqKe2ienvD>z^ӗo?}ziYEY>O;~TgL/2z^/jO_~e(ߝ 7h>>y&Ih^n]ȬK;|/?a^d\0Wge|Y7NaGuii2˧sbף?levê-aU͋.fy.GNYIܖ1qb޼wC4'_IQ?(.l2nmYc|L#߇>&nr;+ &d6s%F­1D.oNq{uDݟ0X*bM+>:Vmgզ!qkW"0cAC q8gy-y$n+O$n|kgo_?a.hMԁM֦O_ + VɍKabx4TiUHB*whنl7.C,^pbr/8e,%qVW!^{&ڳeF_yN|ɆpaYmx+tՆUUۑG[5S򧲥>MrӕoוMre8uO |KXag?w8D)ڊRߖ_>8 +M +PMv9[${fi룤>3z1uO~xG(gFYӗhًM}R {a7@~u`XlqNUMi^N-mR&j]OoP4)Wd#$4vD͕ _Bf;>./\)4\崋[ZTjO-]ꔛwda<͵8*k+yJpⴃ+TMggd60N46xmQ[ {:v0|v,vtYl%L6Sijc-uM)ڧQ]ss凕-Tkgwnǖ;Fqj zWe*la+Vϵ.Fߪ]lv$)tqOFkNn,=*TjZk)PI~o[n]JH›b҄-l!!w1 #:}O -B;: +pcs],Æb<^]nH?qTq81%<4){ +%É36*CkRSr줙^#} ;4Bw ̎MW4`89ceώ^}Q9PiKM0JT޾ݸm5κS[ECQS}t~PeNkhBŮb:jiyJ)ydGVVۭ͖MxtG;%,g7iHúZm0BW$߇{ե׏B"sNQr DV!F|}HX2~{Txm%!=o^@LWnҥ"o,A^ ;wW +endstream +endobj +38 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 37 0 R +/Resources 4 0 R +/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +40 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) +>> +endobj +41 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +44 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +45 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +50 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +52 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +53 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +57 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +58 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.982112 386.420079 496.429134 371.420079 ] +/BS << +/W 0 +>> +/Dest (api-server) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +66 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 259.070079 491.179134 244.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) +>> +endobj +67 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 219.470079 491.179134 204.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +74 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) +>> +endobj +75 0 obj +<< +/Filter /FlateDecode +/Length 3492 +>> +stream +x\ێ}gIV1"m`ր~⥻53ӽ 6JR:: {S8R4'>~yq~!dWϦ>b fhsb Yz̩2|ձ-Zf@V&s|Vf`ŞQhb`UVGWK*aNҫСfK*:FBcTWg1lUL 0`UV'<0Vg.K*:!ҫ +XzUաҫ +΅ҫ +,>{Lk߰njY20e)KVFⴜ"&9u zcZPmU\|l{ar?[W/}n{&[4dwv_|q#wU]=Ow_~_>a{%Pœ S>_=,`^nɤ~oQ{kx#>=PJ7D*CXb16- edQ[n9&嶌̕7*1Q{CAM&z27ccz|GHyHLS%CƲڼy<7x|u^ "^yf#XwlG{j̥-4t8Hjo{~th6L=DV~suFn5}T~;V$CmwϏiG5̵Z-W.g(p4 Z%\SvY%洼%.Ʋˋ>P3/W/&i*!sرm}v}3ֵǺL/cx'8[_ײGsúڷ&z,hjO[;?R_GH L,uX\^Ui}ε Ϝ|sZ?N(hig?>` ˻z@ +n\_5?7?fo_z2s5 zIŴ0Ÿq8~c۫x #L\޻eֽԛ"h;&\tavaM 7Nxtn}ڴm}(Vi] twG:A6ٳ$Փǩ9^55|z5f]<)}0uwq94sgbv7a)l|n] sڍM0$aii1ڳSPcmUR" =7Jt"_?cgsyd1R9F>l&c)s(WZou<)_8ݏ[yxR]^Oݪ~  ICq\x)eluJ_(2Ek; :k2{rI-WSkS=s[z~=9Z+B}7שhA!6tO3 +endstream +endobj +76 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 75 0 R +/Resources 4 0 R +/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +77 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 394.370079 498.679134 370.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +98 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 373.970079 491.179134 358.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) +>> +endobj +99 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 354.770079 498.679134 331.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 349.370079 491.179134 334.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 315.170079 498.679134 291.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 309.770079 491.179134 294.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 275.570079 498.679134 252.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 270.170079 491.179134 255.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 235.970079 498.679134 212.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +106 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 230.570079 491.179134 215.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 196.370079 498.679134 172.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 175.970079 491.179134 160.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 156.770079 498.679134 133.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 136.370079 491.179134 121.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 117.170079 498.679134 93.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 96.770079 491.179134 81.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) +>> +endobj +113 0 obj +<< +/Filter /FlateDecode +/Length 3624 +>> +stream +x\݋6￢QTRUIAA}rn1Wr[R.Lf703]TOIV^~\%1O%3!'w|DΗP i:ggYqybX"( zaffaT!LH!̔$?!̈d9P PbO &z " ,bA1bN 1c6'bE "1"3 ,2#lOc&Fj`>eD7.JcQʠxfE RC BB`cX0?(u0X?(uP9JJ@mȌD:(D#2G1:(9:$P`6Fd?(u0PlLvP('Ǥ8)#Tv)JA6Fdf1:(2?$uP@`cDX<CR!B1"C6ibHꠌGƈ^2?2Βa>fLxpYܲZ43YhZG'3t?/i Hœx*rxRLZmkV ΜܳqdшIх"\@钪>4=[[XZwjPO % zU #-.yU+jQij]ߧx%}2^!lAѳ0ȵ\aPv/ʥU aEu}ޕXv޼P\xKK^(ןt>xBj KG +P|@w+t_B%D_B j[rjƼA׌Vs]ӧM XR`0098Ă,L xzH(:70QTȐ9͸>34dN>zC$N02.2Y2G2°+PPg o y"bl`Z 08%4%s.ђ9I9QR%ss&ddS4l}ySNr;9HbډK;cti'v;$w'v2I߉,9Ď8;%GNdQ;YrT؉,9*ĎHNQq'v(܉"9 +wbԇ;SCܝ)x'v=ɫ;S]ډ’Wwb՝)u;Er߉"9N;S$GN쀗$vG@ezu=Wc%_]pZo.̿_C9ob*2ޫz%~tÿ<7>W|b 糯7e@inL4mCL>94me_>=EGu=?oE7fv`>ځpg?z}[`سXo>ؑua۠yL:oTFCЈSDtd΋"L[mȭӧGx3?]俟F0t9u}?8hnk>fc~L͇L=dB2ص>o TiޜںOY ps߆ڰjSkڰ }㵰ȏO3_Yz.v:s9򚍍[%/)(}+ίq}j].9yi~ ?fXcBQ߃-0\N7'f@8_׹o1P|lˇjlR&՝;cj<;~eW5xަ8l[۝!c|I7ӽ[yEh6G]އ~LSR? z!`-,0ft )f*.oMЮ['S۫:Bv~5mҙ/7Yus+D\{_Is&:8q,5v07%("]jn%KÆ~XckՁ2ÆiOi6^RW:-4֗4PS!AiTrE7(וՂ317GŽ+ B:Vq37Jǭi~2\=ڤ*iQB\-lpE<j޹"?(i +O41*AMֺ*Sk^h hf'/ܳi0 R}VK&+t;klAU*Sivc=y,нk +kR}Bd 98{kA;u=w>jroku7i*lxI[#|v1EIRF'r֞~8l?2"RZ_p'Ҷx}~uA֕,LKtbE CXjx*_ݏސ3(HCJ3dOZ[m3 +4I3I%';rǵ8JQ +%Սrʩj bVԍtWQ"ֶԉF8(uMPu3‚1n,YugE@ީ;V=St^sⱞ꼢9#4'G5fFBEߖ15xeq^RcAYkUI[ox};;?},WhThmVm8126B>+='vV7K!o&C<:̒C))aVk#O^,^i%%1LڣO !£\(+ڥ)`k_.ViSE*y7fedb9 +endstream +endobj +114 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 113 0 R +/Resources 4 0 R +/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +128 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) +>> +endobj +129 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 473.570079 498.679134 450.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 453.170079 491.179134 438.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 433.970079 498.679134 410.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 413.570079 491.179134 398.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 394.370079 504.679134 361.670079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 483.326107 386.420079 496.429134 371.420079 ] +/BS << +/W 0 +>> +/Dest (controller-manager) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 323.270079 491.179134 308.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 244.070079 491.179134 229.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 204.470079 491.179134 189.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 185.270079 498.679134 161.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 164.870079 491.179134 149.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 145.670079 498.679134 122.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 125.270079 491.179134 110.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 106.070079 498.679134 82.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 85.670079 491.179134 70.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) +>> +endobj +151 0 obj +<< +/Filter /FlateDecode +/Length 3789 +>> +stream +x][ ~_1B-@,zE6IKٖHٲ|ٴh|gw"%%j󩡿"c +.Z3I4oW|ɸ뇋Ѥ('}cPHO\~M|b ä)heְ7 +`y,+xb%՜1H &"qmf n I]?7}=`"t:lowϸJCubuqmo` %ںpNFlL.\~[]2Rɇ>Iwi''cp㯞>tlҌwFs$IȇO{W{4=xWO{ƄZ-ȸq^#\)*3Ws]#VAD\p2*a¨2(Mv$h29[#"Di Ad20CZʪ#ZJ#Z^ F\c4p +=o}6otf7ϸ( g,X64B~it& allԥ/c7#<$p8qNmN#G}TQcQ„ѸQyhG}N336q>Z?bL[L 2 Aܗ ֎d43\H1 ଆAR`ͨN+QW#Qz b +۫2*pV;੺p*;w 1w Q:@:jwj=RAQ;H5pFwjpj<;H5pFz w(-(WĹ+pSR;j>eFP*+{O5pSrTw<(8=bAl{8ş)CRs"mvBonzPwoo2.2|+g1\򕸷)Z@omoUܼ4Hݶa̞ ,- -3<5G~s݉㖮6*nNlA..[h#7S}bS^u((#qRI E_)PO3zIѓ'E?ETGݓ'EOj+iCͦ|/Fϗ̻8nʋF\\l!xۑ @_& 0iJ?g{ Խ):F-nuՌZQs0z5?E,QqQ.J8h hV7US 5Uqd"{`˪$-kX[QaS5Wq;q2qS5#nN\ \(6f'u:N1;ݧe$N=) 6iF;#:)zRGh/t{RIW-t%mB#(x$yzkv18^!)L>\o?F"廨灁wRɤ7.w_H޼swW߾!iV[Q,d({o[ +4FAKMML~5z0_ڬgc30nENh{nm ogIǓ- ̰_l弰vKle\S,,2X}93}TgvWX0?Osϭ_wǡKՂ BXSdf/1K݄PtrS"[Gp._3?Dgc&F1T۾ϗAAm2n:/eyrx͖Q:E(M~SEgd}TiyheoAߧ>]u/RTcRY"kLW/^{Fްj|cޔ8B1GC#e4ͱo_WXU m*]4βZs6?K V;\>f|W eL@:e2^3JH35uȯ=A/>@f32GL=NsP&58cs˲ܡ\jz?fQ,-:vcMх =G _ccZk\Pm6uru2}lו]\4NŐ@\]P!wΧ[K#RZ|((jwn-732;ˆG}.sa&W$_YDsx1퓔 Mr^򹷤rcJ Q<~0Z̒\Jm6s`2E"Q bP;m> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.309749 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (scheduler) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 734.270079 491.179134 719.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 660.470079 504.679134 627.770079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.237972 652.520079 496.429134 637.520079 ] +/BS << +/W 0 +>> +/Dest (etcd-node-configuration-files) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 609.770079 498.679134 586.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 589.370079 491.179134 574.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +163 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 570.170079 498.679134 546.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +164 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 564.770079 491.179134 549.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +165 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 530.570079 498.679134 507.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 525.170079 491.179134 510.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 490.970079 498.679134 467.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 470.570079 491.179134 455.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 451.370079 498.679134 427.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 430.970079 491.179134 415.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 411.770079 498.679134 388.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.786556 406.370079 491.179134 391.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 372.170079 498.679134 348.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 351.770079 491.179134 336.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 332.570079 504.679134 299.870079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.986019 324.620079 496.429134 309.620079 ] +/BS << +/W 0 +>> +/Dest (authentication-and-authorization) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 281.870079 498.679134 258.470079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 261.470079 491.179134 246.470079 ] +/BS << +/W 0 +>> +/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 242.270079 504.679134 209.570079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.506282 234.320079 496.429134 219.320079 ] +/BS << +/W 0 +>> +/Dest (logging) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 191.570079 498.679134 168.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 186.170079 491.179134 171.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 151.970079 498.679134 128.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 146.570079 491.179134 131.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) +>> +endobj +185 0 obj +<< +/Filter /FlateDecode +/Length 3766 +>> +stream +x\[~ׯslxrH m}8VqZwt.:'n#9h%7?RHÇǝ8xɿݔMcbv5$*f1rDg$@4bfȶuo':6[Ó y4uڊ܄ "*rk\Cw+)˾ȲRl{M_7+ҿimN"Dp;әpe~a.f2̿ 6t*,4Jvl.nCv> /o~qŝ6'Jm$Iv~to>c7HXV#򖐷JBﱻխ4-:!']n}#\SrؙA9R0_ޭ0tL'.F VÀs`F \0^ǀ3ygIU1]6&ipv@6! c0`,8Uô}0AɦH*ƻr4Lq!ď LV1'ĘC +#7(]*&sq m*&I.+1X&ɨ2Y{&NsR18+]L 1+=8T sD^p skpf%~|g獊blYlRR1 f3%~|Š)짜8$%JJ`˜2{bK1"5 8lUYQ1X)'%~ȃb8cP11%%(35)Cd*%`0xU1 ?gVrRIÄ +Y[ +. +,8D*Ɓ aI0xk٪gk +*& ob%B"Y8'U XyȤb8Gc&˳gV@̈́P5Q3{4gGi2G%~g TgCT'rtY6Bg2['W c#1.k ]&DdGEʀэι]3t(f (+1X [/M#dOϺB: + J5N^ɹҋ Rc{ +?嫐S8+9mI?ijed|U.hWҕ^V~db46Rw;WV-Eo)zOl+n)zK[PSݭԽ-Eo)<!^ƥ(3\vthu<|}R‰[yd)%H?\BG8Jјqfpƙ`sg<2d[Jy6k3zN 8B +d^a,8}r_ +gp >jKi(4>8S(%LPʆXxbN}46R6t% 3 M +KІVaR)F>zb<IB/-1l4U8cS8g S8ge{yqQ8czyqlbggc}8c iCyiC"&8c8c83893=i8D9sp gcXYi X2y(X>VAg"ڳ (a ߬=8~#ƃGg"oݿocy~/aq㕿7߿EG>ȳJ~o9NX -?^WC. Hnr/*"EU9*$=o X4gط<T!g*GmX&0̯r=SEr*rWxl/'sUW^qR rŜ]4{k@X+}_͝]D&{C-S\s~~F tݨ +>uP|Sp'&䪟lYh:džZ~LSߊ 4G$ p*sJLOWb9zo'K9US!5\W~e!0T->δµu%+s<[-mБئ 5:77}bHfPJa6bBY/,Ċm#\xƗ++\2{/{% +/KN4ąBaV4K@J%?IWK\mDeVv]e(hLv1Y4 H?9rPmjo{)m+6፥~˶}-"|[ Z]ԛ- RօM*k=rf,J]t^iF + [+^- +2tdK,MJ\7uv/AH;Sӛ3濧jU +0 jߗ2)F!T~ސ)ȣŒH-HMpްEmPǍ|jFlCz64~O~\j\!2ٲ| +endstream +endobj +186 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 185 0 R +/Resources 4 0 R +/Annots [ 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.434505 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (worker-node-configuration-files) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) +>> +endobj +193 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +194 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 640.070079 491.179134 625.070079 ] +/BS << +/W 0 +>> +/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 600.470079 491.179134 585.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 581.270079 498.679134 557.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 560.870079 491.179134 545.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 541.670079 498.679134 518.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 521.270079 491.179134 506.270079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 502.070079 498.679134 478.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 481.670079 491.179134 466.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 462.470079 498.679134 439.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 442.070079 491.179134 427.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 484.911067 335.720079 496.429134 320.720079 ] +/BS << +/W 0 +>> +/Dest (kubelet) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 232.970079 491.179134 217.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 213.770079 498.679134 190.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 193.370079 491.179134 178.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 174.170079 498.679134 150.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 168.770079 491.179134 153.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 114.170079 491.179134 99.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) +>> +endobj +221 0 obj +<< +/Filter /FlateDecode +/Length 4001 +>> +stream +x\K$ sE @FX֝];PzTYҳ*%RHR=/Йr x|>$)7c +:jlISGET0e0 O!a h0Md$Ɖ%0D&)z9arR6sƤ +샜2!$S <)pFTxSV0>lGYVxq$ξO .h6 2sf` i)q,“s&2!DWY>LFG>B3<?= +G>BwuW37.袟 hY7kk +hbԶ'AZ,>@rlM"oU ^B[t1 ;.YU|qp#g{f?W1O6^ˡn+0 _ugabi11lZor"bamWc:VX r[o~`ꘔ)/,Gw[^ym?WYlq^*Nar#!/jw矋?޿q%F~m;1g31j_ ;ʷj]xO3]7 X5>~[=*]ԽKwu\5ߍ9YcqWxa~kV`}VK  + V4jҌĜT(+e? OjFj=T͠*ҽ F͐,`_V[nqh[gΎ9Zv{lDsxnOxxjwYQ $}o|=6~ +(>J-sļ[=lג'mj5$OTzW#WGy9^m:Ey(8pIji8_UelJd+Yɿm}n$ݰaV i qk;mf ]\6m>.m@3Q2b٩}[&lˀe -0w6U[{Bw%btVBh "h7y6՞P?@yq02O7ͫpSn,v,O-͓LѪgsL{+p"fk9jL}/nrġ,IB2q).$h8Ų|t/~ӚƄ2Ix>P~ ]hK~b S?<\;c|y~nם<Nxs{:zn]L7{"H }Gs;{t=~UiPn~ )Ɗ1a_O}-_>w*'r8|5? +*h'S>lfqH) +_dQFS?fe׍Bѭ:F'>_^w^U- +N}>B oNiX9/n;,"|/rFhW'G5fPl6Qt4ht +Y324R5Š$-MnDoxZ"q^K -֝7^6e,C0*S;юE%3}qƵ +qoa a=s.NٗOWS$F>Yi%Rvoc;P/DW5fNi8|b7}XSM=6>mi +endstream +endobj +222 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 221 0 R +/Resources 4 0 R +/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 705.770079 491.179134 690.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) +>> +endobj +231 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +232 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 611.570079 491.179134 596.570079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +236 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) +>> +endobj +237 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.154476 465.620079 496.429134 450.620079 ] +/BS << +/W 0 +>> +/Dest (rbac-and-service-accounts) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 402.470079 491.179134 387.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 377.870079 491.179134 362.870079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-secrets-manual) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 343.670079 498.679134 320.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 338.270079 491.179134 323.270079 ] +/BS << +/W 0 +>> +/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 304.070079 498.679134 280.670079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 298.670079 491.179134 283.670079 ] +/BS << +/W 0 +>> +/Dest (minimize-access-to-create-pods-manual) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 264.470079 498.679134 241.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 244.070079 491.179134 229.070079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 224.870079 498.679134 201.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 204.470079 491.179134 189.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 185.270079 504.679134 152.570079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.622493 177.320079 496.429134 162.320079 ] +/BS << +/W 0 +>> +/Dest (pod-security-policies) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 134.570079 498.679134 111.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 129.170079 491.179134 114.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-privileged-containers-manual) +>> +endobj +257 0 obj +<< +/Filter /FlateDecode +/Length 3764 +>> +stream +x]m$>b>,K*1Đl6y%&>k8C~J=z)uճwg~ZUGU%iz{Y'Q!D|y:?iI"ѝ,/1^m8 +#DcOwA+p8E+|vyܔ9[%_~"71/[5ƉSޣ1n_$ + lj +*Y31 ~&T&2*ZG0R*F(LdxXi=A4: 7PT:3{)Qb}M(.)üۙ=*idfFR{@!pʶ(kDX搝&*NH蜟p +(qf +I=*> Q:!RdٓNE~)G*V1`f3fR˳$Ɖ%qlMpjYjbՑ3&9pcS&0=93Y8#NdiCpjmT8csfz"Cs&qxΙ`̇0z9ӱf2sL? hg93&29g"/Zs4\Uf2sfz)IO8EI`grLl"c5LSs&jك +>1p \Z&23 pfӜ39N8ETaij gĪ4 A/3¾Y)Mc$O_<N>[DK)$buyC[;L^MIw8wt}88zE/XB:lt4ehAxWa ɡו9jJH4EHnPU$mZ+U_]g Z0(;a00zEK'-]Tw& 4\$_WCO] ] ^~/ZiH. <5ChP'ۆ;\V橱{%!wC&*<+`|nTq |ף\FF2YG~v_E{9 y>~ΑmE/dõ:>Ƙq=z]kuEo{h"6vm~';r51=j92lXu^`g&ۢ\kh\hYl{X_$3tnxve?6/ڗ21};wFmi's>nުpI6^p6/S_/? G6=FgQu9*5gyb?H+/>X v-1Z}h:I>~|9'(Iщ2For>XGGu[m)_}83&.m 1eR{Pmql8604n[m=r~ehje/bZ+:l~e,|y9zq[>orvRy0۫jꁶd9c~50ʎ6 + e%KET:{IczbM: Yrc uAgJd[h#꺹M[߶Q[&~٭D4钒D-7N:6H݌N,(jRUG6B\" +Ӽ.W{9j{O)<|e<*Hhx5u"r=kd(G]-Ȟ2Vj^2( [<|HꇏV4A.Y{Lvȗ_ 0&Z6\KZˆX47j4@Wu]{ANRC;%NX&}Z ӷDS0;FG3Z\ A?Wl Px2gyT~Vקq,db5Pt=b~dX>um wMb$-M3JoT.prU+©֝+$PP6j +b3Av!l mA-5c0Yrn.]gEs^N֮! +bP bV+JEـ42s|Tb@P.F)_B47SP:~->(Gqj-=\ l) x"?+4'A+ڭpm4ԇ*͂5UPESY7]4 Ϛ$qWZ)M, }b:f e%C VEo Mhu@kl؋O%H͇:t_(h xYyNd^M+S[:48Ndw4l+g$%VSq!FT(Ͳ4 d?J*l%N4"2+. !F\kT;{F8^{6ٕHhM}hXBkv9ui9vs%xj[VĞmj݉ ,@R)SZ +EM}ˊ[|S4'iT'dmdSْ ٷ&Ya9yuEIڂmucT۳6C\vm$_^;[FRV u C?R`{i8y bo7K["eDjb:xn7*`>-)'ut " +endstream +endobj +258 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 257 0 R +/Resources 4 0 R +/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 790.370079 498.679134 766.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 769.970079 491.179134 754.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 750.770079 498.679134 727.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 730.370079 491.179134 715.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 711.170079 498.679134 687.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 690.770079 491.179134 675.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 671.570079 498.679134 648.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 651.170079 491.179134 636.170079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 631.970079 498.679134 608.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 626.570079 491.179134 611.570079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-root-containers-manual) +>> +endobj +269 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 592.370079 498.679134 568.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +270 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 571.970079 491.179134 556.970079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 552.770079 498.679134 529.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 532.370079 491.179134 517.370079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 513.170079 498.679134 489.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 492.770079 491.179134 477.770079 ] +/BS << +/W 0 +>> +/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 473.570079 504.679134 440.870079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +276 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.070980 465.620079 496.429134 450.620079 ] +/BS << +/W 0 +>> +/Dest (network-policies-and-cni) +>> +endobj +277 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 422.870079 498.679134 399.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 417.470079 491.179134 402.470079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 383.270079 498.679134 359.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 362.870079 491.179134 347.870079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 343.670079 504.679134 310.970079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.118587 335.720079 496.429134 320.720079 ] +/BS << +/W 0 +>> +/Dest (secrets-management) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 292.970079 498.679134 269.570079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 272.570079 491.179134 257.570079 ] +/BS << +/W 0 +>> +/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 253.370079 498.679134 229.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 247.970079 491.179134 232.970079 ] +/BS << +/W 0 +>> +/Dest (consider-external-secret-storage-manual) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 213.770079 504.679134 181.070079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 478.131038 205.820079 496.429134 190.820079 ] +/BS << +/W 0 +>> +/Dest (extensible-admission-control) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 163.070079 498.679134 139.670079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 142.670079 491.179134 127.670079 ] +/BS << +/W 0 +>> +/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) +>> +endobj +291 0 obj +<< +/Filter /FlateDecode +/Length 2232 +>> +stream +xZ݋$7q,r $w= G&#,YU]y_ɒ/\ρd&璢ӻɚ,4͠>7&4ņ8lbn~;%e_ '73OMSbԔd \1\&McDS+(Zœ8X!q&,a>cI Yf`5 I8ڭJt|Nǿ}:>]HaKNǁj'!3o74(hq Mѳs'4 &33}(ڼMPIx MLbyMH9b>q3]3}Pz*h.tS V ghbr9\r6M6Nc&݉yyYc&݉yQ<;1r;1OK2N;bw'uU@5ڔδvvK<s&/%*w22Vq`~x;}|?_N Wa-\@j ܝoBMA#;V{>o0:7vv]SmK{oQv?,jtx؀Uuͫžj|EԦڦu]8/ }- |$>2 Fsgx<[^xΏuq}Ƀ.vIvl0QkT3ڝ[C{TLjMݛz㎦K-!lrR%6TZ]Yzhq GezJW+&-ެx3sT_a͵ ޺>^u r}PM`,58G>~LŌ'hNPd!A_{!zҧF&Wg9?n'\~i&lc+JWs%^Mx[K *p]}=[arBQU聰8zM;wapVaZ%niQ.٥6(3-&3pHF/(`E+SJASCb;sˬ=9S+d3t2unA<*-?T^6ncF2qQC/p`_۬w2պ/SHa +84_2ДTóR]ԣD`z4xk$G:ӠU nlkjU&Sx*^-RR<0H \KGj-+A$/x$U)YXA8Jh8!zYyk~f!^B)p(FEa^* JˑdG;2:m]R_9=7iJ@Xd]x: J(*]PQ)^4* cԵaeqsp /rI3Rc~31> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 790.370079 504.679134 757.670079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.986019 782.420079 496.429134 767.420079 ] +/BS << +/W 0 +>> +/Dest (general-policies) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 739.670079 498.679134 716.270079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 719.270079 491.179134 704.270079 ] +/BS << +/W 0 +>> +/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) +>> +endobj +297 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 700.070079 498.679134 676.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +298 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 679.670079 491.179134 664.670079 ] +/BS << +/W 0 +>> +/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 660.470079 498.679134 637.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 655.070079 491.179134 640.070079 ] +/BS << +/W 0 +>> +/Dest (apply-security-context-to-your-pods-and-containers-manual) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.673228 620.870079 498.679134 597.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 477.090267 615.470079 491.179134 600.470079 ] +/BS << +/W 0 +>> +/Dest (the-default-namespace-should-not-be-used-automated) +>> +endobj +303 0 obj +<< +/Filter /FlateDecode +/Length 4723 +>> +stream +x\ێH}g"!E$ B<ۻB=H >'mgf}.rD:y"2첾*|/9=cpˏ5Eo1oU+'sHlb&mrx)`rv)F +%,)XPGgܞ3p$JPú힕1G +zhA5`xFO!e)/aStVƳƔj5eu[e5ybLt]|&@q LK.10)O.F`d?#4xF3 +xX ]V.Ak 0,gXC0,[fX`NpbX`6ǰrJaZ`' r ,P`Xu)0,]bXLʃ.`@d8*2,p],#ð^abe2))kr pDʋ֠eXc +,swWagQB`jxஶԌ&+3,@8LI+.Ix.`0,@TP^HaxRC.{fX[˰ wCCy&ðu xXdMXR0pWixJ̰ wKdXb!İ +N Âܔc BV䣼03, +ȢM(>yJHdYƃuy r(qb[Kn_X:<9qa7.9-Fe~ߩuy r޼y~\ɠG-w]S9,뎉dsA.s|:.zXh?̇ ;.1~0<qa_\5ay!ox3. ދ凑VE__0;{nyGKҥ_xqa_\5ayš`zg>\Y>b{{t!5 w7iœQoёe x-%3;.$W _.W;J ~~\{\7h+{<̎ ;{_,s;FN~~\{\7h{<̎ ;{_,~󀾟> Zr;N{ 'd\Vt՟~~|JߛR6i{KW7/4i<~VW2ulo9eV_W9^ZVʹ~C6+f;q-o9[~hVuàWSȶx2'nyX9;sm rױvM]w]}7`JQ<0Y/}~z_UPn|W-zΦ OW. r>SԷx=zϸ|͔$IznRܞgK+8yxv}lUEb뽺:,l" 1?ڋ?4yr^5伵r[o㓈ǦjlYL* +Sއm%PvVKbVK'Em0\+ c$u\ ڧa$.ɾ@zTbApMn'uygKӷ1_9-~dZĮ@;Z:P֏}{pӜޔ;2 +2Yei7][qZYf ۲DwN}1]?]u`#uCPݸ ٴ5 +mcVȼ7=a/Nm)U  SٞB$ОuF)₹k6YR^+l8eD9z+m)iy;GZ2Zg7#mkl{p]+SOo¿Ke ѩ% +h_RW]9;"W"wLZuy;W|!D׻ӲSz6a,[n[T4A#o +endstream +endobj +304 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 303 0 R +/Resources 4 0 R +/Annots [ 305 0 R 306 0 R 307 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 740.570079 409.271317 725.570079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) +>> +>> +endobj +306 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 351.653153 216.824079 461.230790 201.824079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +307 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 201.824079 165.615800 186.824079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.cisecurity.org/benchmark/kubernetes/) +>> +>> +endobj +308 0 obj +<< +/Filter /FlateDecode +/Length 3498 +>> +stream +x[Kϯ$2p 6Q9|n35|!ZԬXV8{|Wjm%]IzCoI๸Z^T\i)|MSw|vqL8GZ!y',&Wj)>dRrĔ V[lbAT8=@ n5Y,1VU!q tj# b +rɃ e(=[\-6W %Z<" ,^s9T-C|x -daeBɃ,xDh +Y]A}x\j5|-}ryKM2y()!K<ȒGGcJFFn,^,16yƷ fK , 8n-W +B ĖV, %qdaDɃ,,, ,2ܲo޲BLoaqfpfas iatRlawDi PR"f +.-,`n-,`n,H&8 YXݘ+swcF8xB]@E‚ ψi e p7T5 +4n-B‚E" pY-,;dhaABx wQ7$ .5yV X ;_$&88R`YXQ/˫+-VS3ʿ Fy槝h/'＝x~;{z;oöX?b:5w{'w9'{|oi} +Z2l ȿ%xC==Ēy䙒'M4EV撹ZǼe_(5G]nɡ#<y4V!GJ{ߡN00rzLwnO<~-p\ūSs esC n\(ZA4B|b){_)xvfE;;`9SM9[vcY+-Pr]:?L&X8`gGZ)4ʝ.9,WL/šZǼ0)io91M sߥP,6RP0H*c-7 >A78R93:Jdy}^c?|:,u |i,)p6ڥ>7^(w{e{嗏mF$&r%=Ӵ4{#Lqrީ](2^KH̖?)NY6NF6ֹ!u +T\(9p,ܻQ*ܙIA׎ڜMk +إ 󀴵l!wVIX6$W7e_ݟ է$&y("O^b[4?4~a?^n=*u)(.pTC{lNՅ(߸3;FC'L+6_~|? / UcM(B<\;XI>b̼G?0i.m=As؍Oc\_9o D,d8:[y5!k5Er ry#ئ8Dת o,ʜ/(}~jR哜1.砑Mj=Ax ]Ns?fsFÑxkA~liZ^u mCKT E"_4,UM#^Ng$.;-i&w_U!4M^ TIKɫZHlNQI'갥eU +L +tg况ULK HM8IX~!Г+_%g\,iλybU˴xS9AƷdq:Yg[) Fl︚Z*XԟTbVw}eޑfDJڝڝ_=g-Y Z֣'WOȶg ^U5,$1/ޭ^߄ BP(R^ a^pUW#yw%7"Ds8&%۳E^f鳇5on)'VkוBh6iU./~kү>3]B +endstream +endobj +309 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 308 0 R +/Resources 4 0 R +/Annots [ 310 0 R 311 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +310 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 739.370079 128.273270 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/tasks/tools/) +>> +>> +endobj +311 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 345.193925 739.370079 356.281327 724.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://stedolan.github.io/jq/) +>> +>> +endobj +312 0 obj +<< +/Filter /FlateDecode +/Length 3610 +>> +stream +x\ߋ$~b 'K/0C&Z\1[\GqoV]PHH3QX\!1 rlqA3eͅq +s w}V 5Z\-x7-.H]  (,.@~suMYsjqAW0)+,.;: EzodODdg= P ak4U#’w} +[2Y\6-.EX-.Up WvlqAn2|,;' @Y pa PXFZ\P"t-.(dkշ=.ps`2W%e`UKtm*dX\P +;`qR"-.;),.4PՈܒ"T`qAՠ5V2{Iڒ}frvR*Z\0NLiʠ hl`m).Zl7BMo .,.h>;)-.C-T7#[\f~[<#neo CŔAM͈[p`'KKllqAYo7/ Torx750%2MTރxSA}f 8yzry{y|ed^4Yl^5@Z0x'ܮ>KTP3kI6{ٌhv>/ ˕#$HAXذO0k+*Lrb/'c[ +v-`]p5ZЋ'l#)Ͷc8 ws&WIϡu,^Na?>5A*iM`8N,mu@vY]8bخ5Z[/ZekUs,Q²}mn|h[8-c yjPU>Tz<ێ4}(>499ԴeK*+w>~1Xvc1v@d)ۿK}fr>~yDiՌ!6|/| >3Wr/xY=r.E` ?ϯcLSvjBkːv2dm߭۰ }A!ʎ8 1f;nڵГՓW+uOѥ7k}׶rߗMr3|ڦlZ[&ﭷ+>‚`bޯ#,-lцwVQ}qJr~𛛬ja6Vn%yeeh^M76mp0bN7U~2%y؏nEՓVi]9_#f9mBs{966NZquێ;ւnLkĉD*++g(sum.;[[z譎o~yoHOvLo9 ݗI`o-[X]ױڎtw븱~ۖ`3]Zu49si3(1Bx8˲=<&;Vَ2fg[}tjuu8sGn٧72~|sy lC'cߟwIao|&|W6]e˒}7V8bgKkՊ^Z6$w?=yW ّC;˳ULa1l8q +V/CfWe߃W$&|= ؀',Տ8 vH4ٵuR 5>9?-Ϧ6@{VXޢQGyru<@^z5܄#w}u ~\M9 C(m +z:8SF3%U83CQ)ՀmjQSR2L/^ +ԁ*#䐦g]wljm1z*jUcb³QZp:AiأQИo*I Š `cui,ˌi2j- #&*VoTK4 +ݹrԒ>{<[Rǎcvmj<ɳ2thQ1c>`?˕P+9ל!,/)\եG둰| ~O[+O)=w|h#,/x[X."[Ey#I[5TG\>Y~r +endstream +endobj +313 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 312 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +314 0 obj +<< +/Filter /FlateDecode +/Length 3664 +>> +stream +x\Mϯ,V 0 @A4VݵҮ[XͰM> EȕRsɻ=-56E~s<"T +8\c|\/N^CjM7v죡PybC9d9 VK1K*-`HP`GUI,`PP +ޛ:" E`dTj.CG9X:fP$KW]J)K''K%t"\K‰P2[ ,֩ :`ɓb-"BK.G]-M6uXQ ]c5uK"tȹc],]:`[ , + +rK  NBNrfBNR'YDX$ ErMp 8 *X\ ,A +݊dqoSA-.`0.$0(T-.`p.;-.`.{SA,%Y\]xW:`[\vtL-..x(X\Yudq|ŅR ŋ !e5x7D }@AB?h1X\T5 rTj w`L]uaqcʎRD.[\bq8! "xҁw)ToqA"o!͑뚺|-- /`S,.;<Ex$$=X @eki$0z [:Z\6-.HYX\Yp q5dqA:|.9CAYX$H]Z,.X8 r  #p}`d\"䘰U-] +dе+Q gqdqR`[\w.Y\БX\+`X\PJ@fnXd[\L:" JdPLDh%ajK'^"ihq v`JS, 0?َ`&9X8n JMof d|TơJ `]~X\Pc-n+'of KDbIS5-8 MKX\PSfi#lwc3Y:.2dq +o"33[YtYꍈ摁"Ze|ud&v%P7 <8z4Q%CF,YY,}sj@?|{?/Cp~kd rK{&HSQZ\$B1m=/ Ċ,#M*抓Xf r=LɂXdl7zͷ3|ywWzLA?4^.;ˈy~~(&ykmMr"MxG~_kwimE^zx߲i}Zڧ_Ytrų}p :Kr0d7iHPjh[|սPUaewܴd߭m=:Umzi2Ode68S۴4 ~L۸_\\q}X}bgQS( 93P~A_igZ?|vJE*Gk;WO7;\am;ˬiV쭿FGF|">:PekGg~:,N6:iXrkftNcm_qI Y'ĶﶳE>;m=Ol `$pߎ->mlixB3c;-=dcoD󔯿~~ qح۬k>n;I#Dc;&>;mG=>eͯ'LoFL[&`(1o?"űO)~x)m#E=~O#EѕۑiDHGFߎ~ڍQtvs7kۗ];~zSθR[Yv~+ީf zw2+!Yj1M>v~=y2pˆ#@8mC7}󯩝m~1sZZslեvy{CrƕzmhS~hun٢Eh1v?\Hr#(THT)Mw1?'\o^ak)/;zcǛäP 7/2npj43L9ruҖz̷Qn̖^7 +´wz%|CYXD9^';)rar.R,r7՛#6Wž,ļ]~Hu?sOy*fn=?mI_=Ayi˱89H<@ Zt#t| +=Rs,UaYX5Ckm'Vͤ=3~3h{Y -۹:nw׾wmKnYy,~˪&Y< iŰt~=wj׷I{SanXR[kH~ +C| xDm ui &"_RUv>(UkdžW&:u*W㵔:fG2 IB?u7AGvhV7i:o /'t{)ZSͺwOjVOy2D!|[ӂi1쫰4G^zr2뭭>S*,? W o.SnF<[nS\2M8/(}%)fv\csYS]\!ͥ +K!VJKy/$ݥAQ⭑fy#H;r>;ۋ7+bdIk$c+u]ӹr q|/{g&w!N;gq3NVA۝| /K`X]N8Fgp) EVkg'}S}̊O%A؉I_,:uNr=}w[79+=ue3 L?TFؼ&qjRgPY 'q'Ί=y܌}-ra}Baex$JZuth%L07a60!NSG)saJ#C'#M72 +R` sBsuy_!TکKgiJ;R^i[1ZhwX䌥1R fe\VsdN[tobnzY32bZ)bH-YFC]mE-qOyΏ=,,WwdǾewi2qY<|=e/XrBeDŽ@-9i|I "vq2|5J'"d g?2dC>jȾzsHf__YZBuT5-.|+L1P,?CvƏ +endstream +endobj +315 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 314 0 R +/Resources 4 0 R +/Annots [ 316 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +316 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 205.473057 101.433071 186.723057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +317 0 obj +<< +/Filter /FlateDecode +/Length 3947 +>> +stream +x\[d ~_UU I &<0yϧ:u;}4=dClRI:=~>/59|ˉL +o +gKL%pY>TKtWk7cΔ _{rJVWX!\ ++Z% FHJK bsYae9Yde1l IaY<B)<Lңs\\Qy <6XWL1dǐ%/@`IA9iY| kYS^, ExJfVy<)y {x֚*MI9)Y'9;)79CGNئԛIÂB4Y8xDQo:ְ~)fְxBOԛI% EQyISQz"dq5,(1J5,@zz$Lqp7 "3&2['oHtf3' {zf@_C2GaLKӧ*bfN`d3Ͷ_<}{ǏIY0~ϱb_7&m'H$GHe +iMD(F-E"E2SWƻyQ*X앏od:B݋/ {_wyuޫ;R'9=ռTEY;$2mz] +ڼ}^y;G yv# ":d 'o~>}?~ş1} +=N|-qeNmsWC^~CC&6zl4eч־}\ۖ趍J}kjǩzoǐ'4ioȢ.nu۸xSˏ(L ,[,fo<9"V58)QAwNnև!/*Zv87/YCc+id^7?;MAr$Se_= =,,| _Tf/AAO7Sn^}Z7S˼[.YcxVM -(@`rq3JIZT[{ѻvY|vzXKfw+zqku֎.sn wE>nhvYmk՚=*ʫ-RWf{s깲+mHFL-ՖGK>6-Qr va hGЏ ~л}8c7{X[q}Dr;Ďp0Ǻw{o]`7,w{Y-ui{Sןfj1tTT^/`_TZgu.{efg7)fޯC.ʼnos6[1aK֚~o2\jQ(ّTL[Plo')>9ӽi*=t/ibO {՚2궕D=e[̏R)rjҚZ>cAN5C/b|x>L n0=\L󋒜vXRn_ݦ6ߗ,yrB-khJT^f\r$6Մ7-n.e_2|hv)޲\& %f,21L *;a/H;vY.Kv{Ds]0ƴ*O떤Tu/nEq+x8_Q~/腢.k^WE{qu=y7h G{7ƴýܮ^2m}i/2}5=ul{1cmca9^6ezۇۺMؽS56ۆc]w+n'_g؆y!'ޯ"a`roߔR.;cCBzg搣$OGv#9Ov>Î"fK%;^_GR@PoiynXM^0rzc@ )|vNU}P e[|~Ws r])3;ƿ} mb},WS(fczl@g۷V3=V%` 墵n(!^4pt6Y!3Wc!qW 7rFv.HлCLn+DHՓ,/fU8pv|l=-p$2$;XyIb.N}U]ui[I>Tyծյh"T[ O +rRS욼s7$Jo.']-JU]KeC +%y,c)/v)I~:+P#/ri/rW\qo0mu\Q\oQHw|~?EzT!2sGUO)h0adž נ:@Ki gzcz|;t |w?|_7O?Mo|瘯KZ_o&%V"Sm_77c襦{o¶*XzuW_1D+:ʰ0^6f< "*݀?.ٻ 8-nOA/DڻH{[DؓˌiN*EoP@IY1zDn#56WKtc^k%4IW_v\y^cklǩ[Yc\읯% {Xwq|Z+|cʺ=mʫ+X9OS43rXh}Y)iks?8~(bw:mqK2/\h\~aHBFߋi3><.cqgu|t=|=f";i-Z/{-CfZs֘5xˤif1KF}[Nʡ/ych-iDWnuϮyrV ftOE~^=>Ǿ?m*JS~$S R;VDwA8BcN~^}>Ǿk.,Vcƺ.6^&M|~ +WԈ2HG2F2g)[#Q甉5nqs;1T+?_~wyyv2ı9}r8ig\x QoI(\x!y>NӞ8Ӫ5og`O/+c]mPv+72^uɶi} #]H)\ƻKݴBqg3:flp<')烾چcz'% 6M~q?sBj}G}dtLdrq}Z%!;\bEFXG}D]NPSݷh8}z1v5z~lsvB/O]683X_N\qnJLfG2{IB Pwץ!Ϯ!Or°ޙR}uռx2vil-H'Ct9ϩu-̮fMg +K $jkg.'[3{2NÔ\ e*̳;q+5)nAx9:VPl7 y귋 x\4L]Y>`u0AtmvI߬|98,C#%.qMGJVt"Nq8 Xe35 A~u`*#NFn*&(y>;?Z7Fz&Tޥw_J;l)/i{s-Ok{3(-ds0$-㴵A& EddlJi-KC8Jwbg%j-j{phd1di>Ke&;-۱[=O!Ð4*SC߇9V eD->swPI }M7Kn9+9iJ0N){m= wPSW7اU2/pUG Z~]rCf*oga-zT~; +endstream +endobj +323 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 322 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +324 0 obj +<< +/Filter /FlateDecode +/Length 4631 +>> +stream +x\[$m~_V+ 0XI~00,0Ӟ C~>Jfw9sAOwPR]-s/39zŚ,#>)\d+1/BdR >./?:M)ѻpWa1SAa#Iɇ3b) bĞY bpAcA >+ 1{V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gs%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p A]װ}԰b?Va=x4,@c#-Ѱ w]AS|he\.QÂuӧq WZ6.ƢaA"P  "װ w!RkcXKB3TQ V@JY`~d4,M,sTde5,x5,mz3iXP,dAƧaAHa`|@)Opnwk9/e1c׺PPe*]ii:ijRv¶>3V*NR_y]I՞>rI< knù'[y~jȹcÍxMkꛧNLk]7{N޺ SIWh15۹קrP\oaO~Yk?w>i~8q5]F}n~1cT\s5԰nE}:_v91G~Xm{? Z,u-J]|]c~{[ֱ|]y/B֯oFU~-ETBPڷkO)cex[bk1 '`oۺjТ(T%Ylɖrawh??X5skNw~k$jx x +i +D_n(J,K\6#pu~(tyCLW/ʻ&,C-z]UNXV@5.9#mqIEȑҲVW.W:@,]:F@̀`ZrI.qǙR9b:H " r4uqQLD>nG{x#s=<Ԑ,-aN0ME6) [6n96l;Ek +TNGq <Hsu>6hnr'{ rw]=ΧLXK6*%9B9OӢ5YJ4S8\Ꝭ&ZپE_m(*uarH\ܮyq ÒZ;.%r7ڃ},TS"`V]g?U(c_MXy#z^<958o/:\y4#у,lk0r[-vA$"ZV'-7^$Ó?>x,R_Gqa"cs.&z˜1ˢ-Jm> ʍP\g &[QF(6:۪0[tJy·QNf1;1?Ol=#Oǃe]-EPV躺]&G Ѥ +<5=%Oq'vҍwdiXߵ\O^OKNO=ʷܴNNlNJzi_W`,HKd6\ l q&WjiK Yy݆> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 507.723057 101.433071 488.973057 ] +/BS << +/W 0 +>> +/Dest (cb9-1) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 488.776036 99.933071 470.026036 ] +/BS << +/W 0 +>> +/Dest (cb9-2) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 469.829014 99.933071 451.079014 ] +/BS << +/W 0 +>> +/Dest (cb9-3) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 431.934971 99.933071 413.184971 ] +/BS << +/W 0 +>> +/Dest (cb9-4) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 412.987950 99.933071 394.237950 ] +/BS << +/W 0 +>> +/Dest (cb9-5) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 394.040928 99.933071 375.290928 ] +/BS << +/W 0 +>> +/Dest (cb9-6) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 375.093907 99.933071 356.343907 ] +/BS << +/W 0 +>> +/Dest (cb9-7) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 356.146885 99.933071 337.396885 ] +/BS << +/W 0 +>> +/Dest (cb9-8) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 337.199864 99.933071 318.449864 ] +/BS << +/W 0 +>> +/Dest (cb9-9) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 318.252842 99.933071 299.502842 ] +/BS << +/W 0 +>> +/Dest (cb9-10) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 299.305821 99.933071 280.555821 ] +/BS << +/W 0 +>> +/Dest (cb9-11) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 280.358799 99.933071 261.608799 ] +/BS << +/W 0 +>> +/Dest (cb9-12) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 261.411778 99.933071 242.661778 ] +/BS << +/W 0 +>> +/Dest (cb9-13) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 242.464756 99.933071 223.714756 ] +/BS << +/W 0 +>> +/Dest (cb9-14) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 223.517735 99.933071 204.767735 ] +/BS << +/W 0 +>> +/Dest (cb9-15) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 204.570714 99.933071 185.820714 ] +/BS << +/W 0 +>> +/Dest (cb9-16) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 185.623692 99.933071 166.873692 ] +/BS << +/W 0 +>> +/Dest (cb9-17) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 166.676671 99.933071 147.926671 ] +/BS << +/W 0 +>> +/Dest (cb9-18) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 147.729649 99.933071 128.979649 ] +/BS << +/W 0 +>> +/Dest (cb9-19) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 128.782628 99.933071 110.032628 ] +/BS << +/W 0 +>> +/Dest (cb9-20) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 109.835606 99.933071 91.085606 ] +/BS << +/W 0 +>> +/Dest (cb9-21) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 90.888585 99.933071 72.138585 ] +/BS << +/W 0 +>> +/Dest (cb9-22) +>> +endobj +348 0 obj +<< +/Filter /FlateDecode +/Length 4926 +>> +stream +x][$m~_ `p8 yGuR]xv0;]D$#R29sI/~=Y_?7YJ]ϿHAH&)NrvoN_qgoJ_DeT@.($f稐3R4D1dH +)C@Ʌ-@ i$ +',pZA,Q +ͱѼ31_TZ%B01cъ1rhYX# PIEb* FKctBːڕUd:VᒉTZ攷4opj4 C7JEabRhDEAkY? 8!X68ƐD* `55% |J' |2e |.R + †bI@N`! SԐ 8B\YB! ,aASа m ڢaAܒ-NÂ%뢆 1r$  T4,԰ taI (G p7p7Ti +a &  3`V 0jX]1>gaw}aw} Pi[<7p׳pד@Q Ǫpz8Y߃惆`f<  +ܟb@+r0peLJ+%beb,0p*hX]gְoQ uZw/V"n` !а8 Uiؒ ,y @ iX06q ^4,]!hX4װq h0[Ŧ kfXwMEÂaALRೆ +L5,łOEkְ Y0 KAJakSB$Y$Y2hX[M E R԰Hfr!Ұ qD>Qhћ*-撆)+v 2FaHa͑@pE&{DA 9 ,5,>#ˌVxhjFV̬aAh$T԰fLH `B̏$۬a$HsTd L% Y@7%L YiXPl4&kXZ 7=iX|3kXPEOIÂB4Ȃ(v LB thB% @^]Ȓo&uȤрL@V-3%ꊁ2|d`VI]3_ɑE2GunDge EKT3s,0 BtsQ-S>~9%f1_0݀+S2D16"D*CHX\DHbrZdH,2;3hTzw':,w A7|8vm\yAdeM12YBUޕ.ȿÎr }$H/Le6ҙXv<b$$"+ hl_NrK%ϟ~9OOn?wr'/ڿ3c/e~Y -/^^D/?ߗі !erWle Q3-["[Z۰#cϊHb-3Y͗A9|?K@!EڽA19ăJcLLap "!:Km:RwN4Yo;5=,S9/6= [J9{Dr;zC=ɶA[Ln32l^y$dL::eNZkIPiP=bd'(YbSGMgZv˳N#x$5pE*n*HŷSaT8G[ݥU$UifIAW0;l[N(01y cs|]CZ++>Dy]Y=N%_HPr V|JLjΨ{ 'ֆ]mg|X=vv i-G}ivӮ ,E3nWxZ"$L)(Ÿ#6o%{ĩg@]5X U~82ȓw>YoR>2W#yFI8X{(h rl,b>bcSFJU a͕iI1$zܽ'kk59*{-gd_giMA.k6aTڗڔK=2S6Q4e6䲎|_gABĥQj +p9<ՎI\\"]u<`0ǘwՍ5,%my޳폨^FMrg} ֒CM>ț=wQ5YIxz9V'^ 썋3ǚ| G@tͶ=tu> 4˖8$()Ikv+@Ft!K &nGX3I^'M+HIw$ZJG$#w?-#DKDK񴒶r(4-{B㐳lcLp04>ÀYyʻ#YNhyOhИ\0ǚ|%g$+>Kц|8b;L#)l:Q#gs+qu> )݁Gn +`3l}ݾ};tuv= STZ}D=޿kC`/5&~گ{!X}nV}H[ rƍVM};l25yO99HB:V Gzҫ:g}` xcyݐE'HZkf[粫c) v7t:YqM|wv_,]і6}S{w#U=QuywKVޟ+Ns5zUxuwTC}b:&Iż_y1-z_yt*i\siձw0L[!#Yn6wEa)[V(w}ϲ[A5t]-H= +/q6ҺQikn0i]]Y-W9T8'w-Se >[|Knη: g[O E?VyW:_Xt]|Θ~>^nlU;S%ȸx…FOh桼>3l;̩t5q}mftpBV3QhV@kCo-q8)y`zsalRyA \6KyG]lq5:AcGFQur)ueJ!Si HuXuX Oʹ6!(o!'wSe;nRw|Gq6>Nvη—XT?NFo[9Fw뫜(OK#wV]ik%sOC!{t@(UN-<VnPJP┺]<=IA,_{-j +endstream +endobj +349 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 348 0 R +/Resources 4 0 R +/Annots [ 350 0 R 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +350 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-23) +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-24) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-25) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-26) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-27) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-28) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-29) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-30) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-31) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-32) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-33) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-34) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-35) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-36) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-37) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-38) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-39) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-40) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-41) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-42) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-43) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-44) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 340.338585 101.433071 321.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-1) +>> +endobj +373 0 obj +<< +/Filter /FlateDecode +/Length 4729 +>> +stream +x]K$ȳH" c>腱SmcQc`QzD$3#f]Ȫ RE~!Z|+395)X%6g|R:Wbן@ɤ| ~.⯗mw]󋰘L)٠ +X֑ +CTXb) bĞoY bpAcA >+ 1[V>9XÕykU &BQygb.K^1b %8f SN/BdUd9KC;Ee*h+dB*gsʷ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e BK>H0p܂>Xaw=a  w!AO V{Ne}||M])k?OX|xLm B*"$|W%#!0n"&1n/n+4dҙzoѢKJ!Y7uR"1`J~|_?槯+k rV/ > =`v0s?-6eۏ46R]k?,]5׵+=v6D<ֺBCڇ_YoD[>m沿Кk3qǵUXnk׭&4KkZ燵Q-M:T/VjM8hik?R|ꊿ,zj ӽƥ*eo5޶=}a_h1ѼʢbnPڷ'E]$DD:.p!$@TLm}!uޅ0+`d07CK E ch?>fj{:Koaa+j*_aRw.ia~F|EF&1uϭERl !Wʿ joXV^su( ײm0x̋SWܠ=㢿@^Q"x(䭗޾_[fr+ Ĝ5XdM񰜩<=*}P@@v(NsUG1bZg Y.Sj&{e, +Ng'<:1sXJlQgH:o;ewzuNvamW D +Bsew4!xyBɘX};G6mj`Vva$cL-M8ڃ^e{hf#~L-GltyOMjpc@*Y|x2\ܶ⾜vN6d٦':!}76]h9Yi t}gqθ:ڈd3"Ͷ9~ju>nbaP=V*OpÇC8Qw{𫪧r(z\2BF#&=,yֶ "5#D?YrBxߚ֖$e&[byc3Wkjy4fF#CSw&32ޒ9wet:Oɲ pc?$ +~5"f!bHu]3ô{k.v1rctvM)؟0Xy Nہ9*In۽hR|dUs qY^lanc6G_G +}S_U .Iٶ -mKm}?q|?en[76no{Z'y6=r7%3\=l @M΅цUʳf=^J~d$Y8_E2[ٷA~uCׯ7; P8/)+׾[bGЪɩl[!ꗎ"jFwKƬdI Wb eG!ّhsk%]uq4Op>"\-*UkM5&JVqRH/mM3Q[bnĽ\iE-H^*i~2LrWB:ZI4|R%}m_.'%$tXaC3HSAM +hr^"t O⸛_3F'⛝ULuXӀ4NBFmv֗V)/Kwm&z*M<[VaM?+gmBAݔ_7!gl,Cowcי;9۝l_j`=YL?NYfS|zgqPܼھ'"</y}$'gY/O0%{wlݐH&'d<݈m& Q64kq yT[IuL CwӕfN=c3rI 1@M*\̷> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 709.923057 101.433071 691.173057 ] +/BS << +/W 0 +>> +/Dest (cb13-1) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 690.976036 99.933071 672.226036 ] +/BS << +/W 0 +>> +/Dest (cb13-2) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.029014 99.933071 653.279014 ] +/BS << +/W 0 +>> +/Dest (cb13-3) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb13-4) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb13-5) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.293907 99.933071 558.543907 ] +/BS << +/W 0 +>> +/Dest (cb13-6) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.346885 99.933071 539.596885 ] +/BS << +/W 0 +>> +/Dest (cb13-7) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.399864 99.933071 520.649864 ] +/BS << +/W 0 +>> +/Dest (cb13-8) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.452842 99.933071 501.702842 ] +/BS << +/W 0 +>> +/Dest (cb13-9) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 501.505821 99.933071 482.755821 ] +/BS << +/W 0 +>> +/Dest (cb13-10) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.558799 99.933071 463.808799 ] +/BS << +/W 0 +>> +/Dest (cb13-11) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.611778 99.933071 444.861778 ] +/BS << +/W 0 +>> +/Dest (cb13-12) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.664756 99.933071 425.914756 ] +/BS << +/W 0 +>> +/Dest (cb13-13) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.717735 99.933071 406.967735 ] +/BS << +/W 0 +>> +/Dest (cb13-14) +>> +endobj +389 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.770714 99.933071 388.020714 ] +/BS << +/W 0 +>> +/Dest (cb13-15) +>> +endobj +390 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.823692 99.933071 369.073692 ] +/BS << +/W 0 +>> +/Dest (cb13-16) +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.876671 99.933071 350.126671 ] +/BS << +/W 0 +>> +/Dest (cb13-17) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.929649 99.933071 331.179649 ] +/BS << +/W 0 +>> +/Dest (cb13-18) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.982628 99.933071 312.232628 ] +/BS << +/W 0 +>> +/Dest (cb13-19) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 312.035606 99.933071 293.285606 ] +/BS << +/W 0 +>> +/Dest (cb13-20) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 293.088585 99.933071 274.338585 ] +/BS << +/W 0 +>> +/Dest (cb13-21) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 274.141563 99.933071 255.391563 ] +/BS << +/W 0 +>> +/Dest (cb13-22) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 255.194542 99.933071 236.444542 ] +/BS << +/W 0 +>> +/Dest (cb13-23) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.247520 99.933071 217.497520 ] +/BS << +/W 0 +>> +/Dest (cb13-24) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.300499 99.933071 198.550499 ] +/BS << +/W 0 +>> +/Dest (cb13-25) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.353477 99.933071 179.603477 ] +/BS << +/W 0 +>> +/Dest (cb13-26) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.406456 99.933071 160.656456 ] +/BS << +/W 0 +>> +/Dest (cb13-27) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.459434 99.933071 141.709434 ] +/BS << +/W 0 +>> +/Dest (cb13-28) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.512413 99.933071 122.762413 ] +/BS << +/W 0 +>> +/Dest (cb13-29) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.565391 99.933071 103.815391 ] +/BS << +/W 0 +>> +/Dest (cb13-30) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.618370 99.933071 84.868370 ] +/BS << +/W 0 +>> +/Dest (cb13-31) +>> +endobj +406 0 obj +<< +/Filter /FlateDecode +/Length 4922 +>> +stream +x]]#muH"8)r`zyo=Nzѿ߇^.!GF#L%E>|dM +jEer2g!P2.??:M)ѻp7a1SAa#Iɇ3R4=Y bpAcA >+ 1=@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9=`B&9`Q,ц K 5A_rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AH0p܂6sw}^zQX5B@a3a +?ŧV5,]1|*qoeb,.&*Ұ wY`5,]G5pb5,] Aq4,f骼blYÂ,y 0 $*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkFXwMEÂܕiSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`*v 2NaHaϱ@L5,5,@ sdY jX}FKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`)vY_O=8JbE|pLmEBH".,.n"$bLܾȐXdvf/2zw'uAyTR#TNy^~4Y,Yi AY&DuLRI 9яDXx3%,o + tYn؈ӯǟ~O?Z7?8˵wULBY# +\TkT!7U7H8̀Mk5cҭew{{Ё$=l8\cj R҄oD$]2do]JZuTȰJ|mk@ve~޴*/ckȿ"t{"\!D~grwc t#!5#$6zu誛nmljSw7v{% +-z "S}mIKlFm2ՖG쐦"|Zms@|yanySUjs1>?bVt5>+9ɢ,8\8СyFgWСj}ؓ{|?>B+OJ? 9kD}r N~iR0y2s]ݷJH2wQ["١b"5ٛHIQ} @irao}e|}W'⣰w :l? Euu޶=}g&vto$ |CIuqܵ{b}km۲ܥLpl1V\L8^$;GAa ꃫ~1WeBJ1!n~J$m-mkt]kcw S`=IR{2g_f7hc~<7!lV{$Oq&w֛DSXףAeRIS&d](.i3a#0zYY;204b/cJNyAߑ!<.=-ÛESR32O:`TjϬQ(?&S"֞YlvQzݐr[ݷpz{FmPVeY&y(BПK_`g~b6fv-NDW-6SjtVsz  z:K̜V{P|vu^\a +l #//y.A,lU[ "DI@ᅈ'Ȑa7 =6$s=IR;, &oX:Bh +Q8"Mo ^#6?I +{.{="n7."9<ʑ檼ȫM"6l=~cv^SU^GA薥ϧ( Nbr}꼎][g wJCG$!#wCp!#\w.{74Y)玵dX}*GH0,>0*CU +EX" Bf *yKd펃|*ehhz(cAYE@H;emhVAV'V1Go|>ûB;;Z\ :f;2"bq>ӟ:"ykX$ns2}dJ0Ѭ窼yA*9L#4`=nw6:Q[h&m8ӏaVKSU^F:-K+1D`GYdQ[ѵpGe.nv=}?@a=A};1J3Fs|F +y>jsw(ܰcn}H[/׃`REU%БSU!s!#sHT!㱐rmBR;Lc; +'3ĹzŹIv;nߥmt,ťxHd0)^ᐹFz/S_UxR&ee.rdJ1%Es uX-Ӄ;?->ޖ]W m[_CXV[÷}.OE[A*uиwN}Œ];+UYyu d2 bKE6Qu:L=`\JG87W.]\&GGIǹ)ۻ0bJt%|q ,-fHe{j'|TޕvZ` +rf^  Hgwl($-I)S{, +bϗ:]sָCJ}mwzUw\VT/6qigiMO_az[|~Xmzazjci䅻T.eK܎=rUIzt/ neEx'd]_듣7Ӷ_/:$'Bf6~,mmZ L.._Kk\Wֻa&'~JlұBDd{$ YNoφD qY e{!Yİ'ڡNeֲ}-mAlse}nR赩UHW BF k6 I!vm1?y!Ր+k9vR-6RʽjY5EN)^U-$?G1eֱy#d[͎q +I):VذHFζK"\T\irn{ШMJ)\CE\rt6bA4Ջ<C!yܧٱVb(Ƌavce#"㾈WjFƄOR6P+Wjm{Ԃ=h5jK0v+m:Q4ͮbZeKU-bNۨ0JSbG%Jע%jP9d%BcF^Vھoζ6 {dj{+=;:WZo] q]]"Ol3q4rwk%ud a&'+F9f M9We-ݧe)ÜݭŸeA]&IwH,?S +mO r +endstream +endobj +407 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 406 0 R +/Resources 4 0 R +/Annots [ 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb13-32) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb13-33) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb13-34) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb13-35) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb13-36) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb13-37) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb13-38) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb13-39) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb13-40) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb13-41) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb13-42) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb13-43) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb13-44) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb13-45) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb13-46) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb13-47) +>> +endobj +424 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb13-48) +>> +endobj +425 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb13-49) +>> +endobj +426 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb13-50) +>> +endobj +427 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb13-51) +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb13-52) +>> +endobj +429 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb13-53) +>> +endobj +430 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb13-54) +>> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb13-55) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb13-56) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb13-57) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb13-58) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb13-59) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb13-60) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb13-61) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 169.815391 101.433071 151.065391 ] +/BS << +/W 0 +>> +/Dest (cb14-1) +>> +endobj +439 0 obj +<< +/Filter /FlateDecode +/Length 4511 +>> +stream +x\K$ s+HÀ $`` 0rXwv*=];ۋLzPRIp_fgr.)駓5)XWKl*[pv ? +I%/'o897o븳7Db2)d*`YG ++QaEg0R4=_Ƃ}VXb'G׬1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ B-ȯ`oSJ^SV:Me&p'H +Av02>*BDlP #7\<,M< JNH\ʹtxhIJZj#DQjf1ـ+qtU,VH"P,$,o +dZX6Gu4>x=xK}oyo)\eǕNL?r?hw<݀"x\Gϓ8,`="' U4Ɗ%8ڕ>?nLLTD~})9jS@^`n@.Pp?ty7FlYVjݱ*cwɦ{;Lgll;yGb~}˳̹o6d ,vov<_ײ4f{al|ֺ؇L{,6墩}8ߕvu#꿛{[̞$[uhB1 IzuT<4V=r坳ln#@\^ڹHhvym+ޕ[r1:m|utRd$ѲEiZPX9Yc>vҷ(S㞑ɫXl[=ڼ[r qbʗDzw=u[nJwkԥТ$~mǮtq^|?Z ,?O(h+ȴ"<$c(d!{6Hmr,>?&JlcM-MQz$XB1<D@|R.FW]uNv:VYVY#0I~Dڐ(GY:ȇX}GVx?Z"Z oyx64lrɄGڿ[3%qR07L|/ٱ:o|l(cm(laIY N/K-=6⩞U[Mm,3S\mG[Z_Dx̳߭K{G֝.o8S*= AX.>2CU~mDBmiYIesr 4f/[wx(28yw=YFi{+Ѻݻv!#ӽ-/x6uzٽܻǷC(^Wl߷CU0YbiCvSU/9EI"crQ"x(57'Rz>~oZl-A'&[É9s#;rLJa|cRtVA' (F c:cx2wR[[i?<ꔣPeg:Ov{=ewz +v;%ڕ _0~LR}۽g/_@ "f2$ťu4rc+aˠlIX̳nO5bv&z4`;Ty& "I.}FT?'D߃uF5דE/vءpjW//[= +Gͫˍ'oq|#xig@wryU!<3s4ucUG1r+ a,8D.'f)3{V=##<-QNp5i+elɔ/Vo2 +Ǿ9ȶ#ɎyafMrX"׋$wt߮W^R8˻eWnt>,@mNshRuuJaihסE[NFy@\"FWX;FϼWy/78[nogN'y60˲j~:zի^4X62㩜*e{&W7j/K]S|ahzXT'ǓNv1e'/ljd!~|.'T%)9N8nh~h"VUc]eָ,0Ob eGC#;5N &K]uq4Ot#^N*7ZSMvMBN d.'mM3&Y 17C^r +rR˭>Sʣji S.M$_|RsKC}(v㯈Sr +I)VLo&n'g;ePSnk6\/P:U!\k`~ovVI3=vaM(;˥mv֗V)/Kwm&z*M<[VaM?+gmBAݔ_6!gl,CowcΗ;N6߈xOϭAk[|zgqP/ܼ|9L?O5y +^rHN>G3gY_#~u%{wlݐH&/1Fn3=O?.YCr[+hR`o%]GP׹31 NdMWn ̈́;N=ܹ{y68tCrsIy8x̃G#$&$EGHTsx:,Cbs']"?SA0H#M7ZT)0sNFEOvϞU<@;e N=Y h=IpZaщG@;FtE lS)՚ZꈳsA0JWbg%^v[((sɬ\SyF}h{C82S;;KݮV;!./ P˖Xc|+qF^]^H+{t&|u^(SSSzb!NVЀ9{TXo d(o%Iz.Y u eUU +endstream +endobj +440 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 439 0 R +/Resources 4 0 R +/Annots [ 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 541.623057 101.433071 522.873057 ] +/BS << +/W 0 +>> +/Dest (cb17-1) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 522.676036 99.933071 503.926036 ] +/BS << +/W 0 +>> +/Dest (cb17-2) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 503.729014 99.933071 484.979014 ] +/BS << +/W 0 +>> +/Dest (cb17-3) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 465.834971 99.933071 447.084971 ] +/BS << +/W 0 +>> +/Dest (cb17-4) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 427.940928 99.933071 409.190928 ] +/BS << +/W 0 +>> +/Dest (cb17-5) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 408.993907 99.933071 390.243907 ] +/BS << +/W 0 +>> +/Dest (cb17-6) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 390.046885 99.933071 371.296885 ] +/BS << +/W 0 +>> +/Dest (cb17-7) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 371.099864 99.933071 352.349864 ] +/BS << +/W 0 +>> +/Dest (cb17-8) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 352.152842 99.933071 333.402842 ] +/BS << +/W 0 +>> +/Dest (cb17-9) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 333.205821 99.933071 314.455821 ] +/BS << +/W 0 +>> +/Dest (cb17-10) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 314.258799 99.933071 295.508799 ] +/BS << +/W 0 +>> +/Dest (cb17-11) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 295.311778 99.933071 276.561778 ] +/BS << +/W 0 +>> +/Dest (cb17-12) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 276.364756 99.933071 257.614756 ] +/BS << +/W 0 +>> +/Dest (cb17-13) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 257.417735 99.933071 238.667735 ] +/BS << +/W 0 +>> +/Dest (cb17-14) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 238.470714 99.933071 219.720714 ] +/BS << +/W 0 +>> +/Dest (cb17-15) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 219.523692 99.933071 200.773692 ] +/BS << +/W 0 +>> +/Dest (cb17-16) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 200.576671 99.933071 181.826671 ] +/BS << +/W 0 +>> +/Dest (cb17-17) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 181.629649 99.933071 162.879649 ] +/BS << +/W 0 +>> +/Dest (cb17-18) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 162.682628 99.933071 143.932628 ] +/BS << +/W 0 +>> +/Dest (cb17-19) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 143.735606 99.933071 124.985606 ] +/BS << +/W 0 +>> +/Dest (cb17-20) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 124.788585 99.933071 106.038585 ] +/BS << +/W 0 +>> +/Dest (cb17-21) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 105.841563 99.933071 87.091563 ] +/BS << +/W 0 +>> +/Dest (cb17-22) +>> +endobj +463 0 obj +<< +/Filter /FlateDecode +/Length 4905 +>> +stream +x]]$}_qXDQa xF7ugauR "E%GJv/q+gr.)_/]IlTbu1OgC2J(Tاv_7}˟wZƽxSJ_S +X֑b6)y ++:[,EcA N-+AP2k, ++C +іUO.h, +',pZElcQygb.K^c1rxpN1tax%PN/BdUt9Kţw֕Ut:Wp!)oy޲Ld5saQ.rQyЅzG%N0odi<.ާ _CMQx\0dBAɄ>R" |abIuyY!jH@xʃ.T +hX@]| h`-64, m.jX@\i5, .4, @.LhX@\vjX@]{ҰkX@] +9jX@] +jXDTyaѐˤaAIÂ܅y 0v5,հ w}A SK>Hg܂6sw=[aAࣆ0j4@a*3a uӟ@+r0pe +%eb,0piX]gְo0z 3:_ ECa7,LWcK0p5,,lld`HNC5,]LEÂܵLaAڀGA^5mFjRh7wֆqo";uR=aHkcd|*!S2p9Y[_ +83>ݵ?|ZP1-L Fn4eN $T)NE }DYbUu̝bxm5P~!}`pxY jAx8YŐVBŪ(6!MwxDX#d5{wtx,\2w=Y"y7_ݱjEe'0X0}P@/d.@p]Hp+$6HGn-@-d`*i:E-:Szo$0³m G"#"+ܐ,y;-x1dSg1C&uu?&DH>-f{ou{?Vc5-Gٶ*k_ߏ|N&bEn"?&4'[+|'lUL/rlA8n w㚐-EװlEz+n/}3(|qʹ5#`ԗdeG|d~bV.und%zĹrّGZurHr1VӒ dξx&#r]_ae<4n2O-^׫>mg$^7t4J3G-Fմ:Rq[[nm^aw-38[߶3vtQ=R du)7mc2OzD+{ا ̖Q9;:y$ISYw CCܠɗq9v{h#~,i3SeOy{1X"ګ6e`A%jEau?F>*z@n<| vPHqwoΠEQ@<\Ww~mk܇t_>zH!`sq+=^G\t B>~MO/ ;FT?^ץ\Z6v0z] +vD .|VNs9~F{9#YaK伽56G:um4s\ CaFO`zuߦCW04B{2O~G($s]cmGLEY㘣)D;El$oO%DgXB˽`BuOR}rxG朐uuP/%2,u9#ݼg``gիvv?mݗ3Tz"}Ez~,ȭ{޽9 ݢ0u+E93BwRfc͟cYN zgMw}Gc&Kç=#I?_6lL %B9wͨ%239VYۿux-Ďl~S=sݜ>&9h+U?mwLupwCe~(W7m4JNrEc` >:ֽ#9Jo a4\i.i*+k +mr@ؙ,? WTb0e[Mp,5"okP_Ks}׹n>uyzAtK}SKUKb&[h)U*u@B'zQإjMQCļRRN!^rsm\G*R*)׎WhS$|eF6oI) +,/mҨ)/]\hrD} +TA դv߬u'XQ'h=BjeB?.g>_qo+Z+r?6ABn}`]ney:{uhRUuaGtgk ѱiC3$/Zᢿ\ƣ6%tUJ);A\k4VjAԮC?< m^h]tESW\hY(}ڽ>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb17-23) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb17-24) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb17-25) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb17-26) +>> +endobj +469 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb17-27) +>> +endobj +470 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb17-28) +>> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb17-29) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb17-30) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb17-31) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb17-32) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb17-33) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb17-34) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb17-35) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb17-36) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb17-37) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb17-38) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb17-39) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb17-40) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb17-41) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb17-42) +>> +endobj +485 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb17-43) +>> +endobj +486 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb17-44) +>> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb17-45) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb17-46) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb17-47) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb17-48) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb17-49) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb17-50) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb17-51) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb17-52) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb17-53) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb17-54) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb17-55) +>> +endobj +498 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb17-56) +>> +endobj +499 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb17-57) +>> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb17-58) +>> +endobj +501 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb17-59) +>> +endobj +502 0 obj +<< +/Filter /FlateDecode +/Length 3167 +>> +stream +x[Y ~_1T& @ (0 Xycfa$Z4YGτU9JBIۈK:3i [RBi)|~8:W]s cRKXR +ĔV[lcAT4=@ m5y,1VU!hag5 ǂRqXL#˃ *q +J/rȵ +x\ ('x-Sx +YR#x $V%YTjxHry%"@4W! ZY&VȀV=3 HDgY{j +&{l@_cz zD9ɆPT~9}˿OoNE5B$6p!dMhS6!'L1J"2@8r3ly|k!I(eu[ CIv%)_Hҩ F̓UC(g,{J}/uߩ#O֏eERkz_Wȧ?)ؿ'(_XH"9Ek6k +Eҏ%,}N%-Z^X#}uO"6*Mf#_;}|@ QY-qIYWے$/l(e%wMi TSжŤlV=jg$lp\Pv?j \%m|+V+mo~V7c^]1Fr}1 +\5Vva)iNGHnwM=hvw[{t`sXѰ}IGFzD/~Fz[66Z]鵿ٸG^'$yr|건xV79=NZfԀ@c[K##pڷ{5V{f>9ù/G5ToOދ1~76?iv8+}cv 25q()w :v.8'>Ifl7Q6Ŝ/'l+jC_k7Ҡ"TG谓C K+9INݑtk}CqjiXQuNm]SRڦZ%FcJfnk;tD$?RqFDYJ_& ơ*f9ܡ" !u=WsAVJukcuq)gW}Yt?@w.*[u x\yx u \ԅv+?\ijYXw·\ yǺweKlzK6ׯ}I4l!N +63aoۈ=2Rb\ɓ˒3=X&b]ˆmJv%9Pɯ)Z.2.etuNbX֋uauv%#'g90A}Xƌ:ϧv/GΑ XKؓQИ^]>Pv HiWD14괱b2cZWvR5Ťj:VJLUX[gQ-(e͑-UHzmm$ʔt7Sbgss_Ir(_P_Ѻ|JODYɺT +"<ўf,K5row.vȽmBXh!VV{ݴGCJ:>پ X9 +endstream +endobj +503 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 502 0 R +/Resources 4 0 R +/Annots [ 504 0 R 505 0 R 506 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +504 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb17-60) +>> +endobj +505 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb17-61) +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 719.279014 101.433071 700.529014 ] +/BS << +/W 0 +>> +/Dest (cb18-1) +>> +endobj +507 0 obj +<< +/Filter /FlateDecode +/Length 4957 +>> +stream +x]ۊ%}_ '́cY$փ6ÈB'( l gQ[UFY#Ɣjht[eŘDlAK `lQ1H4/I`b\6N"K hd?Vi茖*]j0rElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ] (qZk] +XuZI\"-`d%.p]Uw18 +III\&)'q)@cJ\ƣ 5^ x8$.P.(lJ\:c%.@aAX"qO`A$.]}.:¸Bw1QY p`!e$.>`=J`Aע.A1Sk!aK\(\f@1  0 2t Ȗ.tZK\ lA4(qA2 ̠$. $\-霢uf 0P(q V`JQ[@h%.M,sDlI\f %bؤf +؂O€@aq蔒 q`\z3I\zK$xi'Xo" +#3Yhř[-l=5i3LA5 +Vⶁ"s+NwU"!okn$/?bo_C4HAm_.pk@.4]ӂ\RXv-vabDy`M}˱KEΪӈ56&0Hb[^^n0iot{G3:+/{1QVVA]sjeںD +¡w5zdF\t..eM2"/(Ŵziq sq9 +ViS!R/>t긐C(j^U2p)R@; _9ȸ߸l;39b>| /o6 9( tҾ͍j(Fw5y0І|M(mRmPv*ܬ^Uֻ󼻭+DzE#ZwFzz]Wɚ${6;ޠ z Υrn+O><_+ ++]nP@xnR.)?h`F~ldh]xDkMQ7L܏PZ 4F9SZTQ~KZYԅm۲rF9ʋq-zd{c53cSxff>fy集!lxumq"x~Tc;`ͦVkf\F?6|fgGjV%N<6qWcTǮ.-5Su LJ2KwD7\fIe$m< EBdlf7ϫbi" ]G{Q +vN-gWjkکٛkj8~_l%xMӞg{˦6+aPnYTX)tD_ANP> \c!*e2=)e;솇$u{,,4rՒv~WX~w`%r>O[4DNrXDu[|5v+PYtm;AzP[ aݟQ%y޲Gp'}cn~GC乾*FXغ,o!~ wOyאV }| +NlrW<@zB=2ʱy yp?Q~K/W::"ͧ$7fO߼N$<.ꌋrc{eP@E:syelzheO&tV:52?^"4Y[i+.{@B[.yoV.{\#M ,QL?n~x>_Wf~KRS<R"U@TvSk=3Zrm;*2GԾ끝ű䍑{;ZolOm!3ƇC92Oy8d]m^\Y{( kϸ{ maѠuu4o~Λ1v \CxQ\mlqq+.ODֲ'9Q_Ocqe2/lڶuƓ;!鹤T%G޹<rٓqXϮfc)oH3[~ޏY?YlGzY͐U2;<'<zA\YYEϲUq|5ri+ybf!mg yWu2bcO#dC~01[׼޾AtsϨw\ky1ڎλqDwE@s2áy?]ţ4;7 ;T{F_īK|sm#+ƶFқĔ.oG<ƴǮh({zz]ݕZ<0T +5xfH;Vҽi^^p?}CLy][ήo=8ӈS[ۢ([{E3ۻ<":w.Yj"[ި:V,3赘Z=/iYhM tdbӠke;‹-yk {򢫬%Al /i^i#~LuQ{pikIR[N9Vec϶ Z (mJyf։dZl-IRl1E{^iNW*-[g-y[zK&Ax&u=un^wmzdz6J*{(?e'D LNGklJ!C}*:lwׄ*j*l X_e%6>[AVon峄eϯlHKE +7Ӣx#mI??"; +endstream +endobj +508 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 507 0 R +/Resources 4 0 R +/Annots [ 509 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb21-1) +>> +endobj +510 0 obj +<< +/Filter /FlateDecode +/Length 4918 +>> +stream +x]]q}_VXI~0p#00ӻc# C~NEDZꞹw{iUX<<,RjJ~/9=cpOOj^_I(?7V.N^'8M .yӟse}6Shrv)FUJi+b4>'41gI3|tƭUfΘ$̰.jVeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1uF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn 'E93Ejdưpۚ'ɮc/|oNYJj +dtG|A+G1w#5hqt##1ѿrN#7E2s`RâCsf7<&GD>h*^ody>Vۺ5SR-`kiv@Y> +ND1il6ʈו[$`⺷.C4N㟿˿O_N'|w_w|=k:C,h33<׆tkIGy˞\+z~^Di_u`ٖeiL/8%dJ|~ʎeʾؿ;u]@Dy|uie5md'p/y6@aw QGz_7| TF9A/.c{:P/;w<询 zeZsFʱ鐺cex\^}Z}C9k1湵yamԦBgy6ĺxvg⼏G2OZ܍Z6@{0ӡv9r֑Y.o=wq&|Yy:ĩ1pl4dzc{0ϳ<:ְjDW:uﳡb(T簊6Q潈߳'nD~`#6Ps<Jw+B\ᩞ~eR$Ud:z[x*7!XC C>enSlr@{<ZoǮޖ(Y/p(͸JAjU<'pe~m< z@y:$ߎq]zʞmqa-kR9VbTц]iyL#c]ރyŞ,kXqFeԝn񈿖I.17y^wVR4ǙQhg$L4?,㡂_)=> ?Xޮ߅o|=7c1bGQvW7.6˷f'z]sX6cCCkv&Oa6wi=kmz%OB}2 yY;;\&=f^*p큻h +65$7e@ݬTM_͇anW2-u~!-}=2Of!n)rw?Ήͥ"?W>7}W 3N.o6V42uwNСdf/1=`.%K>=˂k'lVä2;TXot͓Bm/K$D{r0e>ry[kw=d+&vCa;[N{/򢫬%Al/i^i^#p&:HڨI߹5d-ay[uv,{9}h-.8F4ls+uUN. SUJզ0gn)-Nb)oӞJsVi:hɶs8:SX2 s7)mv˺l{fpݐ#SճUʇs3:HO ѩ5[^RG.+YԽ^cr֪镾 P}+WΖؤ luSNDj +WKAo7EpI?)J +endstream +endobj +511 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 510 0 R +/Resources 4 0 R +/Annots [ 512 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] +/BS << +/W 0 +>> +/Dest (cb24-1) +>> +endobj +513 0 obj +<< +/Filter /FlateDecode +/Length 4711 +>> +stream +x]ۊ$}gJyH`d X#l$?}"RYQjKTɓQٕ,!9_~9zRER_oR?X]_HUޝ_Nl~iyVCNI{#|^XFR3*ku#e*3L S T`Tfh㥞"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` }_OU-!(ж10m sg!Srh突k7o =^Y/ALh^@aU}y}b aW]5"ɖKo/ב\qu]L>mdnKs>jAz Rvyy>dߓ~35=;>sY-xyݟ3C%;䓏6>GEѻ/Ы7܂ӿWmV-k|עɦ%o33>m4Rϓ{VrK<:3o|t{ [F$YZmn_s8Ϋq[;us-ݾߙph^{g1+#b;G̛gV9rh]'B ;hܗhh4~–sgYOݻ+#w<9{0? +6B6C2투m=ݞxd;՝y gWAM ,&G[ݗp݈>o³*z[Bkd.D>ŋzdzyЍF3fI):(3~=m}BK=]G;lk;J[}hTD;4u vOsYV)Eo_GFJGh(; nÿܻhRv a*Ŝy~nz6 +[sÅUjZM\Y(M+EkNGy +#5y痱M>SuoYiuЂF[2'PpE^Z}j6׾<׆uo7}uS+.U^GgG-Tʡ|Ѷˈ]`;vGs8Dm<%,7>gyTW; U~c;786aGkg!ekWd~_Ԟ,Ϋk%WSȻn\mG\''9^{Vonߍ3к!ֽ{"s7I>ݓ蟙M"i Hm"[{o3ᐺ ;(M򊑷/j;vs4D}dyh7-Or0 8ۙpU_i? +xP-ڴg< +l嚲j{Minñ Ƚ; qܻsq^_W};i687kݙpF . 'E'9{:+QBnۙ;tpaiheimFCǕj{N) ʢma#VJeҵbqd:a_/u9TԪl.e:]sS$(i%ɈP\6jLd[Iizߴ]q#RWl[thE[mqbc~MvyP{rc$-Kut23][[SFu-h# 5ۘ,T'B,+%lfIwVŧҟۖmFmYZ*7x[-};QS_202.RSS,mu܆ꙊRk.?)"C=^+}!&4J+ikBw Fk%` q[2tg UHP:K=$S@\zZ*ژN!Љ^G4|~ +endstream +endobj +514 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 513 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +515 0 obj +<< +/Filter /FlateDecode +/Length 4924 +>> +stream +x]۪ʑ}gÑ~p c?z00{ۘ}ߟR^BJ{w]DF\JU%r zEM+S.f/V.N^'8M ׷ .y˟uu}5ShWR9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-%xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝdr &_qyռSVjsj +dtG|6iTm, ",ld&hz4S'JAf>4AKS?3,ha@ ͠E}[% ȴXӷKf>b:맟.^/oJAӧY}&,\OuB`m(o+oeZeTZ>-C[T_mdfguV乗Qi*>}|~?9 +8 7.zsYϿswް﷞G?>/ul(Cڥ ]#UH7=! oz"+艬g^׽^֤!ϝdVVfv|l726RpZ8Jy:cC!rCI32a|ėlM7$uL=? MF=tH=juިQ?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu : +j_ǡsEe؈3m͑GBifl{ '<q:g&0$U<^?1d|QAf\leBګj_fiD >'<c\+gxFtKeX%(2~{4=t+w瑧Y:GIW9Vxl:`Ll&vWJ9fvÙzP'%7kCڤ'w?)itF X`wڐN]zbϵUF }]<:<|Rf,~IGZgYLkn7zhS.eE;CkZm{jrTJ5 ]ծ[|u4bIk)I>]9qQ#G7qPpZsc}Ӷ꧑5}ޒ>2Z%g_c1tc#~^cK7~,_,x-b9|iGaVhYAc].[X|6F}Nx =r*;]>0^:e=`. { ˂v+aR֮zzDc.PۥYD{a}&'񆒽!3?d|;^Ւw=OO=u! <`y%QB}l\zᰎ19)hw Ir`ڽqӃ*G+RSw2ϓ,u9ܧ^'<8sֵzSv97npJa0Z I SCGNAy ц#6&W["Q'˵ːK,rcR>6>Qt#qΓye젏PaMY~h<\w`:sRJwaL?n"5Ǒz.!5yacŷ}Mj$Ս׸lk;|7%Oyb[F̍p<2>1Rk:Bt}yBd~su;ey3)!sy3Qe+pGGHODQԷ:WX[cB6ۺIa݉!O|8w'{r<2f&.Eaᝣc8sfGzY͔U2t1zy:މ+chÊȿ =G|m7cQP?Jnޚn=vv{lNǏ-iSy7ZaNˠثV&z4aꨫ^׵>"Gl 0Gzx&,\m9Kj;N_za޻^vt_{g!c.Lc~^{$;ʯ =Cq۰鶟/a~߁BI7љᘯͤӵX}9-U E//J颳 j'S/B s1 Wr=Pe7mI:|5TMdw. B z+֫I1Bl +:؄@{ƻbmPظj6ׅ.lsi5; M;kQջF5eF&5eI.Uv̦gFo]ɵtD[OŖ*zҡNOunH?ƈZLOVlwm$vG!\|ZVn'ҥ1UWahVW_7)1E)z7plⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kzs0_ybsj%]lTzeL )tqѷY\Gkc-'kdҌ{2OszCOw xD?.e7iܺ~&ӯTa6Lh.֩ m7U'R7M˅Mіyo[ }'j.xsp)ʊ%S:ΰUe+3 zT`a]ڮs}EW +!`yye`7{19@FMƥa$m'K|֗mαuv,{9}h­.8F4l%畺*[UZ'F*k%jS(٪['K]Wi{9^ TnZd[9co)[,Y๛ʶuuufnH葩&=cg3:Hy'DjyLNGkk*q/%5p㽒H+5;&g~Q6 |_ )gJlc:ͩN_^!.#-w,~(*-Ua~ha}2?x[K +endstream +endobj +516 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 515 0 R +/Resources 4 0 R +/Annots [ 517 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 423.873057 101.433071 405.123057 ] +/BS << +/W 0 +>> +/Dest (cb27-1) +>> +endobj +518 0 obj +<< +/Filter /FlateDecode +/Length 4770 +>> +stream +x]]㸑}sQ,La Co}ؿSH%Q/n[U(%w%r |IM++)E>џrq:?)fob8pȓ,賙rF??)T*~ p9K*3VaK*I* 뢶 3LNR }TZmu0D9g~ +h 錞B&FY;ג.O!$->+-'D]NnuF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4swWF5 Do +;[@`X PdH\:c4j) p`)e$.>`=VtL)E]NG btb-qRS ?$q̀N; b-*`*g.4l-q<]贖 oPdVAI\kI4s֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` <> +ơSJ€֛I\qI$qA +M,qmf ;ᢈ:) &Ib @$q 7ы!D( >$xiXo³ +#3YhřĈz̭b@{1[E1f@F0+ĨU( + p5CTp3S}[sdv%5>Ͽ~o{zU? v0 LFw{xoHLDRd! |&s7Ro,,?m>c/;@݆b!X? VXa Hc!vW*H'um|̗X ;ӯG/Nor<Ҭ| (WYΚf.߃ZeN79}d^txvzf[Zڳ8^=|~ߝtKxp.Ney N<ϛE:s7١K_ʹ\Mu]nN?_a13@uvma D.|GN]s4buTSԛVO^(&{ń^C~4r +iUBe}bqi30@zvV>(GnIQ[A}-w9]ly\FBt~eF~*Fn\ +If=nLCʩǬL+fN&Jg a ҷ8{ue!UqiSCǏW˲,r̷ӗ<7P6>WE;}$ 3($,Yǘ[FR}E8BS"D s4 r廙Ƹ]F8!e==p{Djr.$ݻwwpihՕZV87C+g+COcIGy +-y痹O,y]eL3OZ-ZarIW{-׾<׆lz*{cc<.cY9mletY0Vz9{Mgz2~UV=ܙh_wwyDmtcw{7yEwPuѰ㌬G]o/j&#uӭNp%L36|•YCW}q?ۙpU+hyhu{a3+eWZCFc&ߙp]\y'5v +;s84n?^9z+b$S[}lWcaԷñ2rz<3ѐ]}WG谟Ln`l1'b;Ir_"=)=:i>a/aׂ9bs/ya蜾 +qO;o}xݙp>$ !#ORTlϽ'pOVrBZkղvm<ί zYyzw9} +ٛkBֲ.u9x"hx{Wh,uۼ 1Dwgaz_lgAׯaQ7#Z&1Ĕ7kkHWh 3{H^<CC{3 +?Olok~9~7b~|%`1;|~Ҝcmc`;.Xۃj'z'&C&}=SRtZ9l[ˑڐN-{My>ճкYe7R-4,\vg 󖴗eX[[{fgĮ驵U/{Uode-ՄE1N![z\[oϭYZr qn)g^[7a~*r(k[f{r$uH`3 El:5t8=E[/W:/ـ MJ_]6ŀS G]I畜r?T{z^;p} ;\:'$7:v;T'SDsع>7$Vm> +endobj +520 0 obj +<< +/Filter /FlateDecode +/Length 4840 +>> +stream +x][q~_ ؀?8yc# C~ċҥ{f{s}ZD~XE)uNh1o.?_N_N8UISGw&~i\{G]HkTֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-KTp3cL}9Z2lZ.}{\~Wʟ9O|%ry&mMYCFԌTyэT6]Z fg&_]ԋPAgm;ϧ + >׋y:C#)`^KqDqg3}k@=kM_~/oHiZC1ÈR_?"Ӳ*]TrSu9 2}~6 6ԎLҒ,gˠ|5[os]aʛ9:T.N6(j 4\T1y.uի̗Ttt,`j.4j^WKWtH.2Aɽ&emQ:]adkFvmDZ h/_2;ʷ@KKÔc{<3zIEx]-NMSOq^ܧe&?[# ew6}gB!{ +DCm2 \O"%j$0%܄ ڳFm_W[|:o6Z8UZic"`ϜwK#XH2{<|(7x's_B,hE;g }$lV'ϻ'WGm]$j|HOOf#\gC;!Ǟ ˖^Lqy&ZX7}_|uH2jza'<z҂o+/CvQhV1riy}fƧƚ]ܖ%aT;Gsho)ʱ={SzytCt9;ϗ'<j3=;8ή)]C[#bY];Hծm /C>|~ Y\:|x~nTϟ=ϟO߆|9 ukg#y }ytrQ;qc㹏dpD$D=r2ӡ<uw)hcDvFEEAg1~^XZw==pY +~F4?kt2I.1Vs4k16J6E t)Fћ7f[ٖʢO2AC-϶N:x|w\ׁhw}uW *gccۮe>HZ_lYlKf._ê~{K\b +rCQJ7ܰ꺑3b皊HF sdNs.*YAO 0!Cfq変/ˈeYUV DDS'|jᴵtd},L޻u"Wk1]j[f0󙯦jU +}V`x(VFvBʮ&ֶأhWt }өKZ.֌wVJ(EղLgTRWRhάhI lMJ:Ft\PSŖ5o4X6^ՍiRL;־Í^ ogHl Lj׸B^hr8ʆ&Che +W<@ +)#JhlVzcP6]s*fB Ϥ'ҭk-]uyDR-\WBTlDmU0䷦=8ҋyJ+"eIѪ12(z-o;XUލgKY +j4~C~b^ B4PH;5FzM[; m|@] +endstream +endobj +521 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 520 0 R +/Resources 4 0 R +/Annots [ 522 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb30-1) +>> +endobj +523 0 obj +<< +/Filter /FlateDecode +/Length 4786 +>> +stream +x]ێ$9}gM|Hi  ӵӻBH >'i;Y]S"ӕDOU.}VJR/ߟ~8)zꢨZ8yCI`71NoN:lOrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8H:1%aVY-Rxd#Y҈:Ɵ?|z/h_iv.uXr헿y+zhk)Ӣ[8^6 CPV? a׶Zh^k?/~ߝ~a ʲLAIY;R# +8Wq|K7/ֵL,_"Ϭ0] 2tD]úѩp<x̾ޛq!==ԾþO. $ڻF~&=Xs逬7ɣD\S_HFWp٥'OcwSTJVב{!zy ֏и.A~ ~N=ƋVG/28ͭU:OckX;ztD +E s(r[#X IuZ{뿰Hu+2 qih۽0D~dH2RM;g<R͍\;V/ZƉ:G}[7Zq#: +<.ӗ]! |`C|v/Sy'{-ݱ{γ]]ȽQRj_F]62C60ּ2D!;B5{]ߠcAM[3ڲ}31ۊ͑'τg;dy:__GwVI!z~F)2;\cp(͸JIf226x^wcus\+g7τrdgl{\XԲ'rUa|=Xۺ+1}.:OC<^yQX|mKL9m%oh ;o#khg$L2߬_bD)׳j伆o}Xgï+w瑧YwsSGrv^cms`_Y)X3_4b#.`>-6%kǂm)+TO>J[VW岏Pl\lSd}?.eS׏6QkkԎk5[*VhPt4+{Ό+3۬]Z˼2n7 [`yUy@3;꜎ئn^s;7kvtpތDA8+HXkQ<DZ+dwQ{IȷcL^xϛ^)yDu9&ƥGZlH8*vhs]u7{}>MqC/eY<n9L*ӉQCB|˴bEc.ТUۥrZ=j0e1j󷥷e!SN.u>޺s-с*wx҃BVm75K,9y}V耟;A\$eP{6#)36tZfe8\$7S׸O}{)7\z9>`R˒idyga(=aAl5 :tI3@`mQu௡(*3 jkhvXC5 +sZqsS>E=8GMm90(v4U"7PT}=謇CtM]@]GX>븬-(p%_/l=J2FZzٳZO6)u93V4iCʟh!3Qu.睚(Zt~Eab)CO:_6 IڪiQvԝ v4pyZ[N*ǒjyw7)N/wC}F'!zE;VLw&44*4S(nޠe{M VXw]l\Gu u -k"k Q&J,T.VUfQI}-ĵqD Jզ٨I0U V.rr-6RJjt/. @`sDr-6*1ܘr.~;(+Bm:^4*L*s*|5HYwBsNXI.]:ƆY/PHn[I˘{C$mޤo\nd-a}b-juv,{%9}j­.8F4jK;uUF*k-jSXU;Nb);iG9Q nx-[-αߝ%[.Y൛ʶ}u5ڞmnH虩]wܙ RSvBtGq#P;T + 2KlkulwD^ 19kU=y oP +T=ZV-VP9 *_TˆPTE&:rj +endstream +endobj +524 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 523 0 R +/Resources 4 0 R +/Annots [ 525 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 210.123057 101.433071 191.373057 ] +/BS << +/W 0 +>> +/Dest (cb33-1) +>> +endobj +526 0 obj +<< +/Filter /FlateDecode +/Length 4688 +>> +stream +x][~_ρ~؅$ By8ӳ'K8!?lbl='̡UU>}*eK\9k gpR8s\;fD\?Gr#]_sX'Wd!X)_?EVy!T*.29'%TV0\b +f^J3Pyj +0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RFIb %SEҁ'rUޭ)&uO1;KQzDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW: 1AEqJKFn4\R\RKKq?CKq{褢'cn +?OR\`£H]`¡Ɖ~Zf@qbR.S\gQ%+FjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\:t[OYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMN` B4lHq5XPJy脣90 0b<0:).pP\y Ϝ 'x Aq ^z2-#4撨jJygz ,` $u4Aq'N `i-h q).H.).6|Q\8lGqAE78tS\|Sj /|S\|S<e|Q\4l1pQHl~ N|D,lAS\MOq 7ѓ!盎 wM3Q:.8a-˷?> 0z977߈-o7~åCwLcRIҤ4}Or)'}|2iˏz[O@1zɔFMtli5l7Ke.]?s}X֞l5s cu-2֯qU[:T(e0Dy i~jppPJvʓt;Xyqu;kYC]q +O0P;r )ѰJ%cl2ms5md,c} gב=imurVz(בV2-{ʒo*aaCf_!lrhv,Qe4x3b?"f}yN>o1Y.R[#նdͥKe 12KoJx++QH1s#wnYzõ3鐻Et޷f|ߙlhV~ 9#fgѡ±_mdi\iŰ`yNm?vTb<2~u7gjGnxrqgadleVH눬 VyڙtWpJ7z,KQ;;q3w⮝gЌ-Q&.%XBҷOhiPݮ٘?(۵#벵S:SUzs:FK=*UnBKZ9gow*b'P{z]jV3鐷s.:ѲڮHz>-o{$7FV\3{|y\^RTWQg{55Ki}'*~|ů4JM13P_:껔lE8+r<ŜynZ: +Zèk:u;}8J_f6g ,1g 2>ǔ.I3W;MX%]V~ƢN2' v%qBG 3g\ns/_;ֽm\ա6#."<{=N +ිm ÌwXٙl;w}-_3t$kXj؝yN_ GDm\3EVZEzs6hqF~j'F޾Hw +rG={ u9w|']O~jզ.,_AouyL q4jb~=~4O԰X0!DN+xILMG6blrB]-',wBJhB^WR'{Dܿ-W-lz]ujV9 U]@өRJe2*dI)sNv!tj^j' .tv!Mg3\NK֐jR|xB6$uqp~6@jk+ȅv1:"~G6+IЫ:o{^Rfŝ#U,3:C*&WJ!ofjͬڕUu 2f#ԹfҪ* ɼHRu WQ% Zԅ=ww}2٦ڳ LxT v~uRUS)]zvPcmJ`Bu +ME x3djؓOQ?5mVɕhViޒ2:wR%ٲl=/;2t1ϔlf.y* fpJkN*4r8vdI$4Jq'ޠTo>tK:VD(_DSSrC& zs 244ܼӳ_1< +endstream +endobj +527 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 526 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +528 0 obj +<< +/Filter /FlateDecode +/Length 4917 +>> +stream +x]]q}_ 5py)J$KTIixӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?z &_SV4!00}k41`CژYDlYuae+L%c+@SKR2+Cd^[$Jf_HlO\Y}mho[*a/Vbdg+Vhh|aD6V*FdVze]ސ{cyu :XKEe؈3mڙmifAu#\C;ہ87!z~wRd9 uM_qn2[)b㔽W2pe~m<d.>|ZۺgZֱ4fhcu!@mCR]1v>0} 1ůaQuG\&1ĔcG12bFi 3hg$L4_P/qFkz4݈l5ߕGfk$GJX逩3ju5F(;/iw6RnRu2XOKjxڤo?Dٞ5bYg/a6g紞sm|_g4aKY%v-.J3zݽ漤٫ܘ\[~\XRc,[)v)VY{SKoӝI̥v%O[l nSQm9ji#;lmYmf^l#A9 7__T2WkjcӸeI+߰>syRmxbRmKIyf˒6uhS<&r, ~LAh\qHpf'֗nḠ~kW;oOwmsMʘ0zqfv{̺Ӊ>u ʮ}0W?UvƑTz,u;'.uۊ?V0 ~Y8He~~lN]v)gpUu X e29yn\ux` W:R|jq2ϻn{r7{m*qQ(ln ZΝ[at\t +A%.Pۥr:ў{}GIKP;ʹw=dcK3ڢ=vt opΖVKM7-'َXZ5>r7\e#K̐NE798(Obpcb)CÇ35.y6G0:bYm_oEgg^4_,!_y͊ڔQvE:yelP xbn -%znqi;HqtH|}nm? c;HZWx=k;|6K3toGkBwӰp<2!ZGJc=<G KAa7.bQx.ϳ0[ϰ[i{G`m5!u>Y;G@ ouuA g6ۺIa݉!O9w'{r<`5f&,Eaᝣ8sf>U2lv,F(JZAyhˑ&. tD~ ɪ?T^'pݕ9bjIYy)T jF<cy+feSam\By.U!M MCWzaRM8V_wrR-oW2_zZvtD/Il"N^tۅ޲sa;b.U+V@qcJ'|xQ#x}Fos&osł9ފjҋT&\f +m^i{=] VXu]l\GӛMB6ӹ4D֝GQ&Jص]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡnSs #}#֏k1=GZ%.޵oԾsz\hYMTKT]YeF +ߤ7b*lÆ c:0v=^SƠiw2i52mb do=_8zv^W[o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}s/&:HڨI߸5d-a}[{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<îk1Q;T +3Klk<{%WkBwLZ5}lU_OΖؤ luS%Je߲lHKE4KAozJﳡ#~}R~W +endstream +endobj +529 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 528 0 R +/Resources 4 0 R +/Annots [ 530 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 450.123057 101.433071 431.373057 ] +/BS << +/W 0 +>> +/Dest (cb36-1) +>> +endobj +531 0 obj +<< +/Filter /FlateDecode +/Length 4900 +>> +stream +x]M丑ȳ, /|b)Fc%!f(̪ng/܅JET )%}VNR/?~9)z꠨og\!$qٛo'7o?:lHS VPy?h|TAObΒ +f茻VEr +f8cJ0ú* T0CgVCD QY#负=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)kQ~Z%鴞 ,h׺$.]봒wEMQ[` J\V(qb 8 +III\&)'q%@ sJ\ƣ 5^ x8$.P&.(lJ\:c%.@cAX"qO`I$.]>Q'1¼(O:,qbx.3I\ `?QtL)E]NG btb-qRS¤?Q$q̀N; b-*`)Ad.4lA-q"]贖 ؂hPdvAI\{I sID&i)ElMH\fK\6:b %C$qAJ(#qI(qAVYd @)%qA M$.f [&x¼6~3J\lQDlAДy N~$l1I\CfaŔ@f]L4H\7J{{LLb@z=V1eX3P _#Ie +b*ZiE<8a>U"!o{^ncןJhC|i`2}ktH,!#bFjt##ѿ0rzNϧDŽ3y9a:Z|g4N6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJ<=Ovcsc\YQύVaxoߏzac9#~?O85KtZ谙;"=V=VdRDvJ7%&v]>jkk2fqJ۵ ~hOe +/ӶsraGY{9`gvF7֞g :F}O9ꎲ⽑\j{H4O, ߳c^㰶ȹ6l; " a a<M+O#JXk,C UqmSCǏ3 +댨-~wU~YeҎ_x2se,z( a6~}<WHV' `Ͻg&oD{(=VP_r0o[a%r7 1Gmyxz`g9åaT7jMov ,&;CXQèzKeis>?W$ӊ~AnXl@uҌ~q|tډ1]>3.U>G11X>[vY0]v`cuQ&B#Ʒ>U:OQ?w2va@`gC1gXlڸdQ~b}v~Gw]6ڛٸ XJ)dmth݉!Aj]p%`8:Qs!W>rcw{wyewPu<RwaG1N`˚m wHP"<"wbU]W }y_:φ`~7r +b@Y^v5d[=:OޝuBWC=VƨDoj@yǃu;WN/=uE쀄-ˆ@n?p!GuI}'޾?i,ù\:φ\,~m(.Xޓ" t}݇?ynԲb܃uͷcn=}jv[jYV9]<{@#d}<:φ{2U7ySs޺6c҃;u˹~H\tԲqxq̖{ }3q,>=z`Cν]]U99ly/lѦeLe~> >p_:Oҝ +vweǽ|ASߜ9oAd1rSyJޓy6ƃוC1mn]S1:O۱k%{5ZU +eot_.W]3B5{]׿Bǂ-ԙwqVl<57t$ GCRGRTwe'ٞ[(mjueVƵ8.7'u.>V|;Ƶ~SzvƶŅK-zu]αso,Z^c6Vw`)KqXNTrJq2N1'ЎGr-jUvA <>|׏P}_ѣly|bAA_jҋ^ۖ&ff{ bmkbb=^ц.ta3feMd%pZ;JD),6UGר&̨ܤlqOrߩڴ3y^1 Skr-'.'ҚoTUsnJMmمEC戲ZLI5܎s%k3N> +} ++вv8.',͟05^X@Tᛔ|ЮA^:ҏIhn6z<4qh{Y6\:ƆY>^:)[g =2U*=2w:CA*UJ&D*,NGkly J!CI2R#w׹+Έ\ ?19kUByل7(5U_6/WJ} :ͩLPypSB0V^ n)MӨ|a2ya>)? +endstream +endobj +532 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 531 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 4820 +>> +stream +x][ȑ~_Qφye`  g1هumEJyTu5>]K(/#B*I_~'bLS/dU+ +Gw6 !9}˟u!%oGVB A9AR +*.* JI*ADAaZ` $AF)QC5Ncн3z1$t:Igi%].J:-.)-lqHI:B6IaV:bb.I.+:آҒ.H$t*UNVaEa|tx咨-*#,l!H:!Fa^VY-l1&-|-*x%L%C h%01 h$7OA4tFKD`lq%&V-6ZbJ\`H\`AoIi/qL%qI kX.{uF ڵkI+ k-j:K\vVZ22`VK\ &F%qwMT$qwM €5h%. q8i5dQ78- X Cghl0pK$.p] kl5蘼#OԥAn1ʃ>I\ب F;j I\8 ]QbwAKFƒ`QIK\2P RASҍV6]=7L>3PAcm·y F>#V_ڜ6C'{o>]c_;l x O_~PXJ_E/9|Icae>&EYqlnF87 c9eu#4F{XfJ'mlȳΌz=ձP1~?2n6G3lK;<mhl>N0]Wکd6ߏ<7{áLvP ~KVml^*g^.XxC5&"`a !b^E%Fqh꡶ G@F?çj+/;ͫ6SSdc$lv7A%r&@Ob-! -ףV8hQmUaΤ=tFyry1BVE"g/f>[Uż9A>ϣ@ uK&/qf"g7u& +[B.p>q:li^Wm&3|)靬kpܧ0VOsl9Wv4ʌ_.V<*d-mTt\ڪ^u̼(oa]N:%XŠ!j_,;8NE:φP Ahq!MQcQǟ(e;ee;>âP@ue< ʚl'^*&v(+B~>k̏ $F_UluȬhB;k|z<~k6H=WwPB.;]Ԛ3v6GόX!uuoseeqՉ+i:;f6VnQEyK4&2SCO2y6d:GJzg #[Լf|?rfP<#f'< +ufCgti u}"3sA2#yKm[g<)dbPsuy>r&|Wfvm|ڏ-xGc?Gfćf:v͐T4| x<zʓ:]Բw=ZUmF^&Yi<=ܖaT;G:φXo>ޘx7YyZOy:noշf??YмBڝ+bvVF*3̫-%b9ڶƑ[Wv>)MQ|{>y:4+duw\T/ׯwfw7R+>'WWfG%fV/^k\]2WOy6dwA]Ǐ Q(#vړuw[p%mu.]gb=}Hչo k'<B'U`C.CfD_M\KhR{Eqŵwm̮^4.:K۾tZI ;ⳏsu~ߙ=Bkۻ r__Ŋ@iZnŪ:B|yγ!/\_ķ.rw]ޑ]54}<-_": Q:2A["dCA>tݓ]sanSEǗWO̷ӷylJ ]lDtӡyt(e;IY{W{VJGhQNy:g*"X";#꽘3?/QвL/ςݭlOpq1k5G87o; g9b0{%wp&e6գV~ˢ/yڮl)u∼|y:Yua=:\5~ʇXر<.LR϶&LWfݑ'<fdyG'<Z杻gfZQp| uγ!%\}_7޸C{y_ԙɫ%Ո)nsY uk5>Yz}!{ d''>kfLR[tH=Ȇ=gTM򁙷_^lx!7Yu7=W +o{'<yV:7r X%MN9 +?M, 3͏{jayՋG}Οw&]E6^ ?W|&"'~ay)OD1LXB:'?ɏ('o}Wٔ.S$2d\~yeg칔i9ϏA~w{HW~vTt&V_7j7>\K)~/?8?ih\9J5~RG  Bz-Wң8WS!UlkU<k:[ U]*h~H~:߄~t7 t otk7QʯZ)M5lgTRWJ :Ovߩ4a25~`(HT˥RN.b5Wg*RUMe) 6ցdy&i෸ukDq.<eUpcVQ]MvqA(WHkڭ^',"}#U*e4UH#Qf:$våCKG%gҭͤݐuyLRO9EXM'4~ʺ5{)+텮a'6Fnd܎ȼwnچ=rre~A +06m[kG\mВ*o]Y63wR~*,tnڦMY>\` ;M3{^^d_VK+W[/'JxC??{+.PmvkV'-Zh'TR:-E TCOʰ3(S4vAtUYnx[r=C;;JV_2 +2׮Rj%myevA> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 728.673057 101.433071 709.923057 ] +/BS << +/W 0 +>> +/Dest (cb39-1) +>> +endobj +536 0 obj +<< +/Filter /FlateDecode +/Length 4862 +>> +stream +x]ێ$9}gM|Hi  5ۻBH >'i;ӳ[ ӕagK_~/9=cp.j^_I(?7V.N^{8M ח .y˟v:)`R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny^~]VvFPR;W&=o@1 *1Us7Km62 n?ld,rc%h!kSJwXcE`h춾:]#b|mlk;IyVL`XzzE#%~gbf֋1cLlm#%S'PS>Sٿf&2;GDfC3(hkV2]%31h_O@__iiw!4vݖN뗼>oeTNҙ~oK]u]<$͠r`oթ/R%o  CD{]~a 2I +h;,/Ŝ8Mr?0麘W8iӳl$=P&Oݝa|ru+O-Q U2HdG.VG[{LO$t!{mq,Zar٤C2$LcpuǜG_&!t25ErkDP $g|NKOlD5xފ`qyi(=1D~ބG;HdC@8V/ZƉ:G}[VP7'Zq0Gy|^iiwwhdCxvoV˗>?yإݨEFyC{2ϣǸ*QMG[\·q0 k*kZyM<#y}\z2áNs٦:@ftcu:_na<&=:yH~ms98|?iFcaE}ŷ^ИH]p=i75Zz8tgCQOgVVfv|-nޡpHeGݺdZwExFtKigNYM/j~y8,vmOtԙm;Mjw/110,Wq Bh-_&oo)it^ ~'L0ZɻsZOT[6_oi0z12*2˵Y5Z*#5f}kW=|ʥts/Yj +ݫV˖*GG4l)Z=J7wP-uZʙg2(&?pE|sm+bO[ڟ-+r- yf#,u9Ｃg6inúow;aH3+b-s[viӎrUs;]`fS`m~Ѭ}Q"?3͡觙zY]&Rm7of3PK缵E3LfY<=s.Ѽ5mYPJKĺumq5ǍQY~ +hEGNynjSJrˍE&v+aR*7zm fZp.SUBۇ){?dۂP{CW|;Dzgz: jy4rףg(/DTP UB@rlQ9Vtxk=v2ϣ!*k}ͣkaN_ ۹%>{[w:$z`vl ߽tOy\y;(챟fRB1 +y4ju.`rLoOΓg?6ۺ"JaJ8aѣǠad ow܁W]mW@:Et5@QtҞwM]bvoGL] at7UᲉ^nLYnusyj_7=ＬMJ6%"u9%X4iC_#p ngbҩIYk7X}Y|ᇖj>EG4Œ_tv,g"N^t˅wع~{񎘄Grݭ3NyLիZ>[?_[C}Fg:Ur\ DΠbj"H]B36[x^`xWbB*V]Wt^ms]f:wf_ӚȺHxZ;J_D)z^5,3*7)[Ov_ZCg6=5:;v +$N.b4z*Tgݔuٍ*l([?tJ 7f#]k#_.> +} ++вr8. +CM +ߤA&͸w2 I V<#%;F50[Wb>b^*lÆ c:0v=^SƠiw2i52mb d>o=_83LWpuOWV$(iҡue/-[I4דw #v,/J+X_=o^ɡ6jo.m #i#QiinՐV'?. +endstream +endobj +537 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 536 0 R +/Resources 4 0 R +/Annots [ 538 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 292.623057 101.433071 273.873057 ] +/BS << +/W 0 +>> +/Dest (cb42-1) +>> +endobj +539 0 obj +<< +/Filter /FlateDecode +/Length 4739 +>> +stream +x][~_~`! 8!ٶ&<+ґTRώ5zuN]QIW/Z0zt™3A>\׎7OQsHg/_.iq,+STiŜwBB*csXBe)@`qZ T0CK J;3R #T!9'u0k$Y4tR0 A'tJ10f5ib#hEYIl)J`DBa Il J3kMt;?InJqJ'3"uQ$-@`Q\R:[4(x(=1Ze݊+A liR[H [`KHRS$ bkOiE2mp(."aіb%`%uEMq (.P +H(.P`[ P\@Aqj., + 39 +(P.(.P\@t1 +(ЮR\J Nq*^Q\JpGqbI Ы 8+Lz).]鹦@w@Th48jJ%+( Io +1;[@`N* PpK(.0]0clńG-N[2 xwAp<Ì*).0]0SS:𮐁S\` p(.tI]` ,ơ <֛RS\qכ₠8֛X6(כ₠aB` @[p֛`'Jga `m\oz f` tdkҁwZ p&<[jmA?>8=1^ pp/f+G 87Ƞ[2jiJɰ3NGLI >9J2WO|?)KZÿ0m} h,GD#\(F +tFbaC*W0߫X%u Vs,0ZQAFvWr=I :Zq|̗X ki>]o|ᯀч?MxlXr~c~P1i-i)U.qBlhԯƼbz./ԟXӞC.0(p<],y{S~.P?TF5L`M@~I5y26es5uɰK5;odoia%iƨ^v9`ZEB/![H˽!rZK=SW!K=#>$oTLu?ROܾzMA;# ǒ9:}PY@hH\Mu9B7}fl4Depz,!Z2zTgb1}{^lm"w,:SK_s:nFK=*?}W?cH˺K~aTNJc6 ;L%=[AQCfuَRe-'׷ꘀڔKC9fӷ<7P֎2,]:}}օvMRZ߉*_##yW#|D֎ٿ*%ؙtص;}5GԆ?lD: )fkWlv_TO\vMkWWW_K+*v`[G\xו=ը{;?-3'tO|?f6- lɸ6j}yNԍh8#?#o/j;;}w<ywlD: vW}Zvz{mςVWZ{s:n.W5okq⎝yN ta7S&${S]q%3pY_pr܏ݙt{ӷFh?h۩M@3ِ׽F{dwdDVй]%Os:$?s}H~XA铧f?m:f;[Wl; н -GջBjKh eE;wܐ6#@X +y-2R7YmNlT8+pα.'y9}\EggׄNٳ5%.Le5\+rcL ^8ԩy'L0fgFPW/*@LkMAi°Japaup-<7/Íq;E~Ich294<;dpbDp/~ߩ-NÅ֘?CY&ϱxQ6N'囱ʞ SIum^(1A[τZ"poH$ׅËͩw51CYlH!Ae:(K|&Nq?y.K0n`bBRǟ!L)M:ߤl}GDjxϽbBV9835lfKN[ +,7BJhB^UWR'{D|]n:[D)tUw oTZ )oDME֕f>KBfn,#w;0J(uEE,|Ik<.e׺dSJTdm-4 +ЕBU-cV#hߔ ~ɡ_PA}:8Eʔ|QLZth2.UX613$7}_]b]AFCUtLuI6E.ꂵ+ {}4٦ڳLxT vzuiej䔡Q\ =91ZI}6&0u:&"d> +endobj +541 0 obj +<< +/Filter /FlateDecode +/Length 4922 +>> +stream +x][q~_K8``#0ӻc#8/%N"c%U")<]o?_~)89"ZQN>,a +əo7\.yL)yoYEv +1UJi+B0 *'41%I3\ C[UT0* KAۭ* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T q3M.Z$֓6Ì l%Q[UFYBt gCl5I\X 'F+j I\8LX&]Q&bwAKF“`Q&IK\2P xSzN~]H&s}yaѺbo-'̓P6|]p(uvNu2XTAuQ/U[IӦM#H BŲ6;L +s9cy)78nWV22Ye6E[]9GŬ +sNwVeLfbzިT]\-TۈNp;FmT-'hU۵gV;vYoyEgĶ2l~f1 ʝ_lrSϥl6?.c}wvd4,0K]aΛ/:tnCmvݍ}S1; B)s[viӝbpeNe}0Cwm+[f^Eev)43R++VYz)9oic%#ˮv柞{z޹9 sw)m~im]I,>]4ul^;9qt, S< +C?ks^EFxgep؂vN<w+L9߼*,4aSIJK46M"%ףNE{r;?%Fʝݎceq=dCD伽C}pL:VΫMT֓:vqOXy=O`Eq.-[謋${n흎#h9w[牟I|v4;G p$k>rn㽓r"8oK7+ ->I|>*J²weEPDSJ.=T"]Qw<{(\kn˿au.CoEn'SoߴM/l2 + 1$y5CٽͶӋdd4eezT[b$py3˞C}dVia7~-+6+Ej0#\CjC !vЩ-grͰya݀ b\/QQfg8ʶ%,yҝ[;jo]$sg.2SC~{'<2ڋ#k%->!}tK_gZ5nύ(#g&3bvQx2ӡXGI0nnA}"Ƒe˜u'V ڬHۺIa|H'38wC#=A_7g†w#vsd>4zJz;Q)h}t=+KV^:l]_+F6F^Yi!<$p$wޒ0;G<φذo>јWnϵ<ßtQ|g.h=}wL'<ލ?zAHsEwlq:"W"{8rlǭOgX(]G[>"uA?쎚!N?y)Ϡ}~O m6 ~i}y6e,9zV4u{g#y}ͣ{$E)w^~?x<|W#4EF('<J˳QGr6FdgqTT}s5 +ڮu7GOkF'wPgkpq@,0ܱz'g>j9_|cbIK/:O'r,\4ۅOd'ALԎ8pjYEv-))g+dHD67W,뭘[&T8WSe*lR2Um {4Z7a5: IkB7{Q&J,RT]vF*u%e$nA*EQIga,@.tv-:R-k*=LiPSQn7#ʖk1RZ7f#]ՙoԮqrzvVqT /Mʻ'L"*\2*Lv*YN徲I=)]w*f gҭk]uyLRV a &n4eVv/ )$V寗 {/K_i~y7ܺ+H<)o):m:Xǖ4uܘeWKJ]TWm/t;5v=v#ѱi |iKd>ڶX9Mgے|'mK:d eWajd@Ԯg +uu-}E[% l`}ie`ׇ}1ٗJUKkXZ O|חuͱP2y[ղl7lurh.zvز- \_)٪ҲPTLY-1tKnq{)TIGvGoreūޒZTKY}(|JEu5!yes̝9ϰ *?y'Dv7jME!_(v[#+& D֪dޠHNJ]|r&=VP9 _wP *Yvz#-LPZ>4&Zm`У +endstream +endobj +542 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 541 0 R +/Resources 4 0 R +/Annots [ 543 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] +/BS << +/W 0 +>> +/Dest (cb45-1) +>> +endobj +544 0 obj +<< +/Filter /FlateDecode +/Length 4929 +>> +stream +x]]$}_QφMa ?b.ݵ6װʔʪ陭5+# +YJ}VFR/?~<)z%ꢨZ8yCH`71OoOrg"!p )_s5 ?R"M<=LP"ܚy6D1ά;Vָy[_s|?/Fy:߈U?;hlbW}Ōς8pK[ky7bכzϨֆ1*|tahhua?RYSWHzW~Ykñ2r`gC~^ 4mP?_?'޾0iLss{<rům')BE@u@eGh]%?yͨEF{ =Ǹw:G:rv5 >1;rg2?{@WhΗ;{``Cߍ8ߑ٩Jܹvc҃+yɟDG0Nosxg3qzY|zeSlrA#7yk빷5JVjjW3.{!QKկLtqGuot,){;{ ud;Fy`#k'gody:__GwVI!z~z)SIg|^GQq! +ieVxߗ `gCrZa='=;cZyܗs=?Ĩ WFcnF<~=YPװʨ7#~.]bʱkw/y;+])Ll43[P/qF˞toX]+?_V{%`Ǧ7cĶ~po/110o\;`moGPODddDHڤobCCkvtoa6ē紞赶nȗwQ/,@Dž';:zy[rN$5=܎KSEkbkiT&5EYպHaiNX#)dKg.KyiZ|rwrm9n)+\#igmq־y aA9PvpSJ͎Kj_f}Mm,}rUgF؟g~6]}Nϰ-}}-O^+i"5J(Yo}g s|8_U՞Ň-x{,bfBݫ z7%L^d,Z^T|:t#XX:,\RB1ƚ'z] 1 t[>WuZ>56͒jak6:F֩ȖT!rSդ1%Mv +qx^`xSbB*V]WtDxs]f:wf_ӚȺrBvRzD-zר&̨ܤlZ? I~jY*\Kk:At9|R5WwS:mjdVl([?ŴZ%^N޵'Ծsz\hYMTKɌ' *Î*|5HсWBcNXI.]:ƆY/Hn[I˘ѫA1 +۰aBwN=hh1]Ϯ:ה1nZ.݇Llt32x27}ž/mm-j.xsp)̊%S:ΰUe+3 zT`a]ڮs}EWYiK ^ӼҼG0 i&}06“\eslYX=ʲlC eԳ- > +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 127.623057 101.433071 108.873057 ] +/BS << +/W 0 +>> +/Dest (cb48-1) +>> +endobj +547 0 obj +<< +/Filter /FlateDecode +/Length 4833 +>> +stream +x]ێ}gyH8 lﮍ`C~?("tٵ;V/%X*!蝹~zRER_oR?X]_HU]/l?_~yyUCNI{=|^XFR3*ku#e*3L S T`Tfh^"P^N3dQI;aVNSrp!f*Zh,lQV[([w` K(H@=`*x9PE:%9"X8&\V[t4h[a2 5@ tkDhq\A0Sp\:8qJ N 4Hs\:qj` qq2h xWK9.0] #qzuʠB +p\`c +`u~𮲸n*+r(Gxbyw`9.|A-wenji CtX >V̸E+ҹqbX.3p\0* ,xWjԜ+UX.q0H8`~tY]D  -) 0 "IX$qxC9.p]LVk xW=8._-3B)8xWH0 +#K&Γ@ `/Xq\tpXpm9. buxq!8. +h8. +e%ovy[v}`` kv/oh?!\=Z1]M&Yޚ<yŇybC_,a橱ֲ[mlm)۬֙mI6>cc[gϥl۵ksO}.~3% J/X[Ƥ߂n>oz} <vVok~ ~tm`{|ۤ񾱵iN-3Y$]jOӯsYjӤQM7XHuȮ~ߕ໺;.N̻n9+ oX<òvܿʎϓ}lbHf~'~灂G"e8L4Pj^|ҏGZ1\]m(d)r|۾q&?"L>$/0uį%?&ޗINǮeJs[6ce5=v_6&|6qqL[SMXcEn]T|ʦ +Lh&z9 zNY8zAPikVG{ҼNr&}}7˴󰽗2]d1[B=5+/׹2H2+bAsU:*…grKݞ0 MAY~=潖ҼpzGq>^v M2t9fۥm#+5nm|RzUȴ} vۏ] +p,ꙗ̝\=f-B@hd-{Ѽ#>s:d:;P)Rm iŻXK*+&wXbہ]ONrܿ`ӡuk{ݱ''tOb?f6}oUl}`!u'pQ<#o_ll嚲j{MwqJ&qY_>F oib3r%UDjeRJIGka':8qo/iSڪNK:H~}19H1OuR HFrwsCzyc%ˈH5;x[1hz]E} *͉E$() T.=-mLi/0Җ,|~F +endstream +endobj +548 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 547 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +549 0 obj +<< +/Filter /FlateDecode +/Length 4894 +>> +stream +x]ێ丑}ϯg#~ c`w/`؇)F}HRY]= Օ%<< R_~/9=cpۏ.j^_I(?7V.N^G8M ׷ .y˟~uu}5Shrv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8DmѓٝdrgL׿Weh%C|a`2#h-`CژYDlYuae+L%c+@`,{J` ͒և59"&A˶vz$[F1y!Yy7vq[10h<lm#%S'ŤDi~fY>`a@ ͠E}[%ݧ tbާo|tO?^~?}?^w_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKm.=w'HG乻t#W6[2Sq7D2IONy:$߉c9z.g~G̨ul4/dPH=l51UKC؜6yfamfGv\FF*C8ֵRwF ]u5->V8siWc3O~r0,\mIC_9Ɗ7Sse^Lugncֽkf]D1 -wiӃȧyusKOy/vRW9LZ6ϝ[aPanMTwK46O>" +%{]*d s/S3)7ILyىx纑n-3X<=}ׅ(^n7k>.Vcx@x'a{ϟtۀby2wH/:] ;un+d'Y6qͼP>w8`ztAēy<.9pBr֏c\grRl4zp#8S|q^>lym4nv{8$jVӤ5GQOy: G?g4Z69 |8mG Xμ2dܾZnyG&)-o9F۹y[W8}JK +vmfɓwfkArA֢G/zm˛1b/lkxj}U/Z9(Zr'$ayQ=^fōFBXP~Cwwrgi~T?תiW,$V~=gnY\ڰ鶟.ES7)UZ7K`iݤcu'gZ;+ƚ^aZ_,*Eg7}Q򪈓]vpع~s1 d7jћZ>(?_[C}F}t&͇sł9ފjҋ!Mv +:Rn^i{=] VXu]l\G;}B6ӹ4D֝GQ&J]2ruk$nAE;tfӳ^TZ\ EL[OŖ*zҡNnH_:ƈZL㵾Vlwm$vG!\|ZVn'ҥ6Ь2z;)?SoRbA)zplⵓ<4q=-saK'%'mVR2&G$c- uMLVӸ U5uoP~[ UZeA3VnƝo\[kz]t0_2QLO.6v2&솁[ة?e4.iXo~`5}]P_;F50[Wb>w夓b*lÆ c:0v=^SƠiw2i52mb do=_8^\o.S>%_Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}u/&:HڨI߸5d-a}[n{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3v<î 1Q;;U +kcKlk<{%WkBwLZ5}{lUYRΖؤ luSaelHKE@KAo/9Jϼn]mr +endstream +endobj +550 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 549 0 R +/Resources 4 0 R +/Annots [ 551 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] +/BS << +/W 0 +>> +/Dest (cb51-1) +>> +endobj +552 0 obj +<< +/Filter /FlateDecode +/Length 4696 +>> +stream +x]ێ}gy)ހ $Aaϡ$^Dnݳc vJaD*d}pO_/sF_brЫǙ:#) +\05u߾{G^UU\)Hw;' +P 1sXFeeK S H\`o8 <0Cz +0C9I +f`vH%!H+F'MgQ)YT`u:Ӻ.tZ9tI$8l!E[-XlQiN`BFa YlVHNtg'bu:᝟0Z N'egMУH1:[0t8xh=[UZh lQ-h|-YЃK(: +8P^ws,|9р +#ZH@ brL%l!\V[t -HqְE@m h@nIqߒ …  ( 48W;9. ]twqjc[ 4xWxWkdui5R8 n8.@vX*/*!չ}Ps\@]ep UF( HY #Xo +1;[@`Ni PXp\`2`c4ت>X xWz4 tqߢ;imw1Pi x9.wQ+5FjNޕ* x~p$ 0uR.t"xq;$ud X.q +5+n-+ @ni8P` +N-Bqa@y ``/Xq\`=u9q :|v868e:B8.c<NN #肄N` SL@q31*t~t1ƼQ7!ß/-'W雞s,۔$_%=[Lw#)w?~6`a U,?1u]`Ti$.ULMS }K爰TD'7?˶XUV]KQD&:xyO3<5- +Fְ\1!e  {\0[o9dAۤ-uВ)OzMF;# ǒźΟ{,^#T1ԝyΆPwy({"epZ,!m  ByTgb1}{]lmʷvCk `:ov_ӡvOMmv~b)ze۫njs_s:mܤo淳δ`;cuPhy#uZAһ- /&g"N;|=:ߪcnjSFǏ +wOrȷoun%eGUrhg[ډE?UGzJGQ[Qv9J7˽.e3h#,ΊiFGteu|kkv9]|S }MT12Hv18s'0^G6G%}~G:p8aі 1x^:x|wk_kú:vEdWk=ףr[Ѷۈ~3cum3ِj7awI^1f c qVw; ՇdN;[wgӡy}t6^NFa*-TӰ ~^zs:٧#tcmg=, 7 +s:$?s}H~XA铷f?:[g}O& 5wCqĸ9ְUru0oO cعTbA\εĈ #Nq?E.dJe7BRN?C.\St51IB$R"3"sqzQwl6d3@ӖKMԢPT+bEwUg0^W?Uj5VJ㞣TJd +YjR ۉ.K&4fWwn>r1ۅM7frKʗ!|1@]\񌬯QvU:mlWQ3b("~Ǥ6+IЫ*7(x) ]3W*LFHʐ{וr7xZIf!$.\l]_ &}$ݜ:DZUY%w!I*T,38RX̕P$#p"6/q +YYrf|.f{slԊ#}:I+GrJX )qї^zkf-ɸvsJjխ,y/|Ͽ.t>m6JdP['z$+{nS U_җ&!JU|M%(ĞR̠2kk)uXU"5Gۦ áN` +.C*G1iҡ%UeA](b$T7*7"ꢣ2E'YU> &Y4La{=6(Ԟ/4_Xf㥺?> +endobj +554 0 obj +<< +/Filter /FlateDecode +/Length 4237 +>> +stream +x\ۊ$}gRyH`d XcnK#af +?}"23*gv$v<]Ul)DӇ59Zk%6M~s<;KDWS,}N]⏧|v綎;{Sk.UL.9ۨ*TEǤ3b +0b&OGU %j* *(pTUّ WcVT֪:D+:MѓΤR}Uu: L.:MWMJ)MGu.KtDV 5]UuK.u+*XlN`b-DBgK.GtΙ + +lXb^`!h:D ez^"xI &_cQVa^8lzH`PXj(рPY`tiD,DJ,%TҸ x`A BOA%xtK: K.`Z 7DP.\j\ܩqAbg X75.@%i\ո!8`G\ x785. .׸jIX % 3U `и>b z ' (ch +z8, X Chx%D5 2ԤqAﺂSuո +V6.qAb +D.h\7QvjMuZ "xqCԸ` gẪ[KѸ wAK^04.8T^5.H]Cи w-!Qu׸q tXʚFjSh:uaM޵6W xM Rf/A5.HL9i\!KQl!,U,I֦Z4.Xd,4.@D`CwQDLD䘐.yS2Z\ָ g2؊ȥL׸o8\Ҹ0sqAq"S<"sMAtsNѠdj\$LrY4.( ` S:`Mh\d;j\&U,!xN7^&Yj&aqո|ӓXo j7)붆fָD(X4Ue݂o4]_I゚E7ѫGͬwc3i:."Ӥq.o"r{ ,qz#V{[e|9GR eIU(U ,8a9}GT g̃X~XRl9ovRV_a鎈|$%uD-n ;?l8CGmE" [ I1{:OBΈy|p:i*ﴕu^ $9F:nWvka cT.ڦ4-@[aϬ "GtP&Tϻ)(yMߜ@+~\ +6Joޟ/_}ϰӛ~gS|~D߷-gHY(eko욣~:t$MG=#VNhZ_n]MT®Nc7ߜ~f-z?WcpZoqn6\貝OsZZmˠ2~7>}]y׎!l1Zpա;zu>5v&5yvׅ:}bɴ[LQp60|ni[^Qqw;?nr;y:r-(\JTXxgCxr[} oWݱz;py&Vĸ_L;_L_}?͙p:D֭gl ?[K n>ײ'xmX`tsczoX>|*LjI#<cch\&uԃgp 4hѧeax"bO }G-NϽk8}ie+d y˳ͭoNZa;,1ʳli^׿IG^a[wsv:?Q`r:߲{{tlmuroؿb^}Xy[v|D)y2 ߴ۩u|u;ll }JN|a /pm&_I<G-w׶[o>rlx4oI}LHΚaqWLxgb0^$3%FЇ 6Z'n BevXuة8{-PMLJX|KJ*jdjĜiQG܃|b +W,ԏ0DJwHQ)otۭXkRTm7pBgy*P7|3un'ܟk|[SL^`y"{5ˋ$obI^.Tw>/=TO'y#mYގ"Q/7?pZw3)M+dǥ=v6a[ n(N{m7_"tzXzŴ#!P+{-م߭5R tߜr<,r?dA'H٭/w7x6K} ipJy7מy(g>y[4Y@Oku+5۫d>Re,?p.kmߟڭP=koM=ŏ'~)bCN1 ׏vEnĢ]vAMݗDrm׏3`{c ׏? +}~XfrG1m*ń* (ld+()8~v.M.M>%t/}TT.. TK 1OrR4a2^? Kw$j/.'Z3G2n ez("̯kĆq+a̵-oAx9E+qO1+ +N# bLi.TX] U!ei go$iipgYa.Yi/WRIwHɄ<IjV 1SXJ)8\q#8XюΒGSw>Jq3w+| /mc]N۱΄p)L&uLq/Nm!z>N{JdFo.-֍XdVrrՅc'AS,7}{4I콤 V +㴡axCxYq2;7s^.C#.ppY.-,[:EE\Fq):&;d񓜊} Fe:۬l(DA^ȆN} +`!}10ӥ]s™/mrҘm. +iQvJ]o. ]6ZSZuJySt2嬤CYnx#Z +#ҝ%G,YYfeǾiwmb4Y-J^v:STi'!WI`&g׹}Vr<g%'LlvW#ihVV:@9 +4g'AE큺v 4.3^AoבeorVNb5 +endstream +endobj +555 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 554 0 R +/Resources 4 0 R +/Annots [ 556 0 R 557 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +556 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 536.373057 101.433071 517.623057 ] +/BS << +/W 0 +>> +/Dest (cb54-1) +>> +endobj +557 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 299.626036 101.433071 280.876036 ] +/BS << +/W 0 +>> +/Dest (cb55-1) +>> +endobj +558 0 obj +<< +/Filter /FlateDecode +/Length 4808 +>> +stream +x][ȑ~_Qφy30?beN1=>/$EYKUit)"//$}UNHz1Oן.?_¿`T]08|tןX`3_/;l_?u )y?b VP97`T^8Ŕ$p ݪ̠dLTfX +ު0A: (%`"Fi7x tF>&D]N#| KEIG%%-N)I[ ;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&B-pe[ ehUn$a(ٸWx:vD\.#=ZF?e=ǭش]ژ|gg`@! Q&;hEw9eب맟._~Oo-gz:=ɝ=7ġɲ?BMb  + 8^f2;=mњOg&89oѡu]GMwdΜKs/Ǝ*o:gk0n[u)Sg:Kg.3>խWf7Ӝv~G]h&n{/\w> +c:qyjS ]}yA_p29'U4FmR:!_܏*&Vm8%UrЬjV[aGvl,.`gg̈́Jq[A'i\mtstVAKU8ٴ0eҹH3њ[&%:bRC"8ƉMs&5na`DQcQǟܕ2e/_ۿj>{ یhUĨ(;V$(fm.Œy_VRg36(˳B~9kc;$NLzۣnmZhc1dw}c0=^ԔG:gCxsRhJ֩[%zͶq}]7ڑWi%7omuFϟ GF5= ;,]˗ՠ}U4~̠yF6 +9 +efAgT]IHODV?-_ctE_Sdll\uBv|H|C/Oo#X!oLJg2,G}d+%#D 7#m۟#?ѝW6>62 W|[-&j-_+FnsS73 >m4V2wErk:QXas:n?}U(O\Kt 鐻2:O쯉շpм;;l6;gW1_?ֶʑ[V6>)9Qm4s64m?vza˹<3}=xUʐݠ?{o drڗddՃuNɻSPuWټ6Q"x+j9jw p:]kh=̥y,փއY7>p`!t'zQ GҘ2j ˈ&{~:Twm,^4wn޶/MsRrN/lXJFKZ]FMyVߞ{no.±5{{b-+zy_U{WH/9vwZfvqu];Rײ=bɮٌ +2A[/ X!x'[.o9˄WO̷ӯy_%{&wy4":Xt;o]k')J}')~?}d%pȈڻ`4G*emQQP^̅(Yf;.k{wksFnvpՕ:F87; g9b0{%F[_v_zT}oYe?O}pP-N7F<8_:Vtfc?Yis|<:;m}ѶcĻXys8>6c* s6Tŝżs>o^);W_#?7^C/H^VfյגJ]7Nv /|ו}Hߍ}к}C½qwϘ˵O&vyl:CN6M; +mYcVJ&?qJޔ2j|>"Xj|>yYn~˓hN̰cCdh}7r.ʹ|(J" i}~,,~v-[wڪFn鮊 e{4 bz;t\քf:tk{(WUd1*%˄P'Azߩ4a25~Q$HTʥ\N^rskT(bWS*m,/1ڬeǥ V^XҮrrz6qT/UWOXYƯ'pE3~T ůG^EV 4B- `/PI.#6CC1IXuA]3)\ +U6U+P~_,UJg^7pw*;[q(3Kn,|76 ;bnW;k0BW}yvwuI;oqCXaUj~`e ][3F0[v'Cǃb~ me 5_:ֲ.4|MĞK h[c؈MѶ!|F82aO6xA{:8Ug|m[:d8haa-d@g +}5nmY6ES.mچI=/l+ڋci!> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb56-1) +>> +endobj +561 0 obj +<< +/Filter /FlateDecode +/Length 4950 +>> +stream +x]]q}_ 0p $Fa cn<%%VnwӪGxxX(*_rzJ)ஷ/\¿buQoW\!$qٛo7\o?v'I>m %,bzAlzö^X,{6mH C1)31Q`4*ADfC3(hkV2]%31hϗ?߁O'_\_0bEvï3=}KAfy," i^"?5C;6W*,m?jKmQO[d02gz r>si^X_;V9]#?5xG;\Cߝ sw9:Gldf0j;[od\utH9z.g~G̨ul4/da(L$zOy6v[êόJfl[z<Ⰺ6S棈gv.#}a#[wA);O\CqS=Rr€ւL7Ǖq%[=? ŨMF=tH=kvިkud( ~#=q]4݆^}'<c\+g7g{l{\XԲۮrաUa=h,umȘ~.Tgu;z(mFKoWtzõMXrm9zz|s[N[ +v`ZޱC\̣^ ʙg<2A~&Fqs,6L٣Ϥm E]:pΖIwxBy/78ÚK,9y:P\䤨= bN`aٽlл(2==TZFE+yz̡͓ydAڸ/z}3[􍋼:5 $N]nÍ"BQY$t#3LJSZ>FZ+bN>IPͦd0׎6!/t| ãGHAj#\gCjև|}pm||rxD#Eu$-+ص>%Oy=A}tqT۴  dtȴ5rn󼟟>Y{G +{缙wssy3ޱ>Y;. ҿ6ۺIa݉!3O9w'|< +3g)o Iݯ3Caw|d#}dgCVwLCM/<~Y Meѣw A5Mrul"^WC6] З#OG7՛YCCKn[YL]V?(pMrc7r~#~ӸtRݙzÜٳa҆Mr mX4iC_Yp n6MM8V_wr/zZAUŒ?_tvJ*iWEL bѦ;b.U+vRn 81Z>T84ޟTMd!rSդ1}Ar)tS {w*&[buqMm ]LӬkZYw oTkG(7עwj2ˌMk! ]ЙMzS; SkrM'n1Ro=[ԳnJ::ۗؑH_ƈZLZ_pc6Ż6⣐wPB -+xҘ04ITᛔ|ЮAۯz%46x$.ubOܥclI t[汕cI5XuC]U4BU@u]VnoCիVY šq^m2WLlnSj] a .4Vu6v*!Y>A&͸_/e3:oQ/kkyܨqJg2ΙtRLASm0qXW4y׮gWkJT7-C&6 F[ ^lMK[G'*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`Wbr#ڛK[HOr֗mαVC,ƞmAN=p Q&M=ےJ]*E Tc),٪[Jb.+ҜyMZ*x-Z-αN-L,MzJ[eۺݺ:^Y3\7$Tl~]3vT_h-ݧRG_]b[#9+Խ^cr֪[eޠ r&=a+Ӝ*eC]FZ*ҷY +z}YPTZ~vnI?iEL +endstream +endobj +562 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 561 0 R +/Resources 4 0 R +/Annots [ 563 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.873057 101.433071 330.123057 ] +/BS << +/W 0 +>> +/Dest (cb59-1) +>> +endobj +564 0 obj +<< +/Filter /FlateDecode +/Length 4793 +>> +stream +x][8~_H|)$HaA!H }>c\!#1G=ݩb\8>+}_$=ĘO'5oL1;Y+ +Gw1 lBr& uҐB'c'qAP8P-H8C)J\ lH\ l q Cv%.CIG7 I\qכQd֛X 6YכADEuNS-8 M$ yכQXo£C17.ft]x^` VZ+ de+(F anC +܋*1k$1h3^`ZR+1l'CC>ɄaA뚣% ɮL1RV41500 }ks&l! |$O6"f-NAl$|cf9 nfkI"wfyGGm=d2;r+ @@!3%dӏO~鏀ѧ_~_~;GI7!7}<ӱB9嘕W~oz_qfwh=] t,c,?bvvtD \uH.neSO;z8Yjg7CH\8r~)=VMSq}^Y[}ȝy+ m>'%7]G5- !Xqڙpވ>SA=q˒L:ܦ(?je^S9nӗ<7P֏6,vwE3g7HfVV)$Eǘ3#yW#4Č(}y r廙_V=GUQ>]hG[}w?7EݻwwpkՅ:&pn&|Yr$;L}K0f2壖5Ӿ\ Zl)+{/~y/96p Őpނ=;v>݋_3Ed:ʻ n#pQ=#o__lܙp c7=W>rھʸs8oﴟ^B]ۏ{_/ +\Czֽٕs8nyG!e4; ~?] }sׇk\SW {S]y%3rY_c;>|G#O& {~}^ԧb;I글v?Kq]ퟗ83:FsUuw~+$~q\ޙpHU_߱eOaî3м>Z} +񅫶YZ/2yfr{Fs8}ه{"U+\}B./{X@ڙpH~.U"=bgO͸~x<f}w&.< {s4 Խ=G]! +B"~;w܈6M#g#}^ (}`_ݙphx@E&ֳ߫7ׄٳ5%.,eu\jٕכrx"hCWbe4uۼ31@wgaz_lgAׯbQ7#Zffv)o_kKHWgykQH=C#Vg~2~X_[ݗp݈ +=XuKZ +M;cv9bحc;.X忛i;+* +$}Hy}9<!3LJ!''ϿW}x:rSj}efi&7g.[qmqIN믟XN,TrL +W|7p\9n;A೧!wHN[ncB?T۔U~b~U`J?t!7QM9hS~- bgSղHUv!)+o|؄Odo$"U<׊!rz}+g=ۃ`#_Mq a+xV`˸)V1*V]*t 4֝k ^&J;KKQu2ˌJUJ!TI]NU&tfճ^o~ +ctDn*՞ +5UlYSifJF4ס1l9Ud17QMvrAHW(WDž[Q54i~ffT43CST~];jYFr_YZZ\:Y^:*!}&ݚLʚC*e1늺*Vڧr%bkbW67;]{kwWmb_Cq_dX2eبgRIUgV6@ +MhmZi| 2iƽ~9cI^>i~?NtCyu7:,=緺a6Lh~Һ:ZvՈԕAurkmĦBhZƭ/]+VGپiЖC56BX~:8Mg۔|fE('mS:dXFBq*LͲ~]as]쀹6i]dY$p-?敦=}2ٗګKei%> +endobj +566 0 obj +<< +/Filter /FlateDecode +/Length 5021 +>> +stream +x]]$}_Qφ װ6xa?LL,}aPHeTfVO{(ve>BW?h/9=cpϗ_.j^ῒbPOW\!$qٛoox.yL9_IS VPy?h|TAOhbΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+0I! +:[Yot8t ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&<{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[V=7^/"YԇYp`&Qq&[{6o?] X#&]?|{^/ GпY>,S\ +IwX~WWʥ9-r/~*EF]~Y]򅭜';ܽ.s}^ʥ|~)e?r*TmCoZ1涘wκ4ʭT/Byn? K o!um[ӗv,C9˶`)>*{prRVص#{vޖھJ6ڋ ʁ߄ RgWո]|RmKZ +q".O* +K~N/J~* /}X\l)ϵL{}72߽j6{>2jN)wyҙQϔ<]ƚgknq5tck<#qvl6U=vվ|| F0V_}vr9(>uic nW+ԑ{ih7b}5=1G"s qGzOr_ _⑏h3*W,۹{Yw䞏`͝uO%}q@[%s~T@xhw-(Xw2SN6rU&v5Q[21 L7DO?})F5\ֲtb2q֐c.K=%qDc3VxB(KH(ў>L٣Ϥ4|X DLy`x}]-PL*>cag;ΖmOz QnQn7p5y FYrc/+:@ m%JOD[ 9 :Z-Z콅6ЧCLUCed!=U%0?)];[ sY{bȡ0tnq浏FF]MWʚuXPک`ݯu*vM溴NjK99ٖl]ZɄ;N!\'Ap7=7$UH%2"u쭚!tpnU6[[ioԵZ8z6{k um}ai?2[/nk[VXq,tXl450囓=BCǡɆ8=Xl1Yxq,K#c9y:,]^3Q_5~ Jɱoy3cdČ0ۼ(Ʉ\4F3[/hh}Ȱq< +]<aH^ Ft'<~t#Ga=ɱ#Sg"[>{C\`H{`blϯUŝu_[E6Fw[m6=5r)½5Ϻ\7#Q}.ϓ\qrgQG<^f;/{7mg+;3OݶQtQPv2ϓMz|^v*UOυeSuĬ ^+iHhwõ}d6ia/czS}?TGjňLY%Csyqx22g٪e8Zy~%nHWBL" ѕ={kU[slo.1)5rsy `?[cÇ8z% o|uчT捛y'ύZdp=*i_Cˉޗ~{O(ǷGx{=/,;NKs9]N;P{*-|&?Tۋ#1 qTHƈZLwVlwm$vG!\!oIut)EJ' * <3U&%)kKxSf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\ӍV.|F1A?Jب6ʘRNoE\Gkc'2iƽ]~)ӜНFje"_wcvǍjla|&I'2U؆ hui}ECǍa|zvՉԍAur>dbӠke;|k {~qtGe\oS>%_Yx}JP< +sle&W\O;b,GuO*+`I[ vWWF{x}s/&:HڨI߸5d-a[7{eس-Cn1ʤg[x^UuhtVb6%[uKiq[LѥW=IKEK@9֩ŒII]Oil[[]g+k놄oR3vKT_ ѩN:Zc87DyJ;"uׄ*jEل7(U|QΖؤ lu^)^aI iH_g)M=@QiR>).;B +endstream +endobj +567 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 566 0 R +/Resources 4 0 R +/Annots [ 568 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +568 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 597.273057 101.433071 578.523057 ] +/BS << +/W 0 +>> +/Dest (cb62-1) +>> +endobj +569 0 obj +<< +/Filter /FlateDecode +/Length 4809 +>> +stream +x]M丑ȳ6| 0|a,0}?R"B셻P] +! +?iIO1|IM)+%VE~;kEar:?e SH~==WYg3v~*S!('TJ[Aq^Py=)I*ڪ̠dLTfX +nU fIR \TZmu0DY#贛<%ѓ$QH:k'H;-wQlqIiI`DJ1H:[Jtx' [(`JKd'"KЩVg\VI:'lZQAAK8#ΆjjI`1DlK `181P^UL(p/V 7Ĥ2z1keJĴ" ''CCd´ Dmыٝbs~; o{zUɔ&W&ao[_j`%r>hzګ_z9~/Z/upN5E\i?+h! ,}Ǫ_^ ZaCQ]>BW^p0 0|y ͙e\c47`G\6nX5e^FW&cIeV}체Qυ[VO9bŖJN^>2,_<*{=l4~Ef#K,kYl,ζrw0ֱ:!SF=#kݷ>U=`!lAA[:VPu=yͣa|̨OJy~)<REH v\u/[=ۻnrYO]&ڶs/5y Zޗu,fJ*cu7⯯bHs;Z[!r$3G{M'Vίv9,̤H=Vz#vh""ibL}{)DJ+:1Ϊ;mԒ:3&2ٽu FA[=-|f X(AoC pDتړpAj}ˬև1*|t~h;phxdˍ2;_mi2Ȳocwߞ8X{ +ֿ:Búc=觱 Υ;r<rX2IA.X3g9E5"JF>h_,~o3InxIk֥m~;spH> cexD# 7v8qX#:r,_vew;#=X[/{$śQqy84_q߻W:G:rv +SrϘz͝Vyf4{/6e;<܍8#Ͻ%Su҅-_$dqpH~_DG +5@lbaE}Ƿ^b{áƽh NqSs #GB8U6ߊ[ѦeЏl2twJ︯`C +W3< !c.u@REkA&_;-_9,FU4-@:TAr asn#?a5&7ޑ=Xz=vm#F^Myպd |_.W]3B5{YߠcAMR;oqVl<5wp5fV$ϐT=?](3/p(͸ٚi\ 08.7'e.>V|=Ƶ~vsM!GvƶDžK-.Gz86WJ\v[w4"Yރu 7؝~ <Ψzc[<63KLnq޻TJj43[P/qE~cu7r~W~vK +MomF^.v+rLy$Fb'K>?8$ʏ~&}=S Mӵk-lgО;u}k|)㋴zFVvt,kWyāQsbuv]le9\w_UjTwmR1/]>:[^XoC򃣷4ҖjG{vޗC>g`[~Wd|.xNsܿiǨU0v_yAfkfLu++"KKߟ6U?S/vmpz ݾ>]eW|>5R(x +Թ&W}fFT{;Kw"/}WUSfviSz_d?a)w6~ƪY By =ԣ/kי]#j:9+>^+gz9bo#fkjౖ8=sՏUlx3λw oEZ?,O ;mSbl"76+g d~͍gl)dX)+e +Zf?CMa7SLDg4f!6reY+h_gE!iQa3l?|y.OWޜ=My +霟%]IN򲠟[A*R ?Nz~;X\'D$k|Y8zůD=H!jmn1o] SKZWcGjor}Wg𒪅ly +|bA^oŹjҋ8/'Nv9 7*&t[bbC\绰]ײ&&pZ;J_Ei~KGmzר&̨ԤlBm$Si`6=Y+K rKkThb)66 <06G?icPl6PuPB -kx(f'EgpM| ޏIlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jNŮAu%v6Uz2]k}W.mu~t0_(Џ$]lT[ɘRNE\gkcTcdҊ{9T9cIoQ>8:nTc Ӹu%+Y~oY<(16m.ֱu m75{-B}ĦAh</[ ޱ |hkp_cپ$Y8E-VQn H~l?\쀅ve7]eB`xäI軧׻}1ڛK[Dz,ЯۚcN֖es϶ OZcIcpTeօdZj-QRh1E{QiNt|Tlnx-Z-rΡN-MJi}ڞY7{dz5)y3w:CA*UJ&D,Ԥ5UE!_(ț\ϕl3"5WτZt~l+鶂5U+WKJ :ͩM&ʱ\- vV17+**}R~Qye +endstream +endobj +570 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 569 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +571 0 obj +<< +/Filter /FlateDecode +/Length 4937 +>> +stream +x][q~_Vxր <ٱX!?_EJ= LcUI-wEC)x~|QCp +rAV]08|tןX`3_/;l_u )y?b VP97`T^8Ŕ$p -UfPNR 2& +3,m3L$`N.*`6J:t %у$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t.E"QS1ĥ(7htZش+ +䃠3+DlqVIga Gҁ' 1 +jI`1DlK `D `/H\# )/qO +:|8ve:B$.c=$k #-p-%. 1I\G ơSJ₤#MC`]r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&/jE1Q֋>Z-"๵‹-k3B/N!=Z^_.{_h XOǿ7חdBJe~_/K>O[9+hyn*Om\8`-<`EbtzzðШk (|Zti>@VIsفuLO&ʭrw +ΏTeƱ:5]M:+{tH TQ&>ز} +sm8een}rԭ86FjV])nMy]6_m(7ةX]nc +Vlϩl}[aն8?j>׶Z+64d``s!G|I<#"}j4;=R*u*R̈́ D1zVP[WO7& ڔ)cck3uns[fX6q,s:,&f^=:&Ԕ17X}е#;6ZO`n]+ oXvO:òvܛ2#x/d?7[5cF}b~/ ӵ׹7ڍQשּׂe O.߃,YmcXax;n=G.lzxud/s976|.x\ p+úg8]uN@Yv @ڍ7܏E+u;ʍ75e_u&֬حnj&Ĩ(;V$(NHLVye0+#2`2l2[}糖!6.gκdVisߎTkH%F:gC*M>.k;Zr&׬22v+vn{ۗ]nl˼c}6ctEi5 b!H292iC(;v-H 3[WP8~̠yF6 +9 +ufZ#R`IHODʵ,jR;*u[g<)\SZ``!oLJgc{53V>KG#m۟#?ѝWZD:gC+"]D^m-kblӚ7:̂O[= 飑ܚnTwGcGo<*fik1:C-i-]кV9ޅ?AHsEhCey׋z|s,ץmG>n]+֠t&9@VY<3ݠ=qWZlZ.}iO;'ڟrYAmooXӡv'QaU=qot{,ݝ^b=}H/ٹ"ꟸvw=xݨz}em;1*J ~ W~w3=bhi{L6Z&wy aOU2Zڝpr3߅Z:Gh[wPJZ.V;ʋEڻB|y鐷szfWݵ#jhxx-[#:m WQ[Ap_8hK>Vtɟ~_:Vt񰞝fcʧ˷j;/3v1#zȃuNƯ}>f:gCUڹk;͸vD`!ekW|;eoH^]{-F\MNum]9)'mM/u^uNHf{r~/GfGPN߷:XtHɆ=gTM򉙷__֬"ッ9m߽jC\a[duYg^u6$1+;r)C,aSJ֪~הr-:ry+Sp9> +endobj +573 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb65-1) +>> +endobj +574 0 obj +<< +/Filter /FlateDecode +/Length 4841 +>> +stream +x][,~_1wt@08`8!sap򐿟-Z]=;eLWR]$hYKSJ9wpZ8yCH`71_No_Nu}6Shwrv)FUJi+b4>'bΒ +f۪"p9yI31IP%a]v0D$GAF)QCs:IgR6YEt4)Dty +!$lYiIa)I[MQbU;Y%t%Q[TPZe;u:bO*IM+УH! +:[Yot8I:1%VY-Q'q˓!K\ L'F#jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @n+i2` +IU-,J,qAҰ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[E8؂HQ0ٔsD0W%]0SkQQ݄XK\Ԕ%.O.I\3Nₘa dK: [dK\H:%.H  YfP`\tN<3I\\(T3M0- >4`&9X$.Ht3I\l1H\l|3J\lA'qAVa0Y8tJI\u|8 /i$.Va)o 4ߌd[Z}%"<N_ßϧo_}.uXri=Qj~DF}4ί硌AyÐ2CaײZ(^g?.Ne[͠9%Xs75M,OKY",] 2ti_j"- bT݃y \'ߛ!5=ԺþO. $ڻFz&=s逬V"G$|e\ӓñ;e)WY%C={=}[3 4mP߇_lE#/48ͭY<ckX}=:"|й\9ȭAy,9-Q½Xk2 P{bdwy4G!v^_uR4~iJoصa+qa> qwij<boij{:OA<nĩ<+̔.N'=H<&=8:ѐl߶D{0NocxgO3j c/3<1YKCN]l9̊*NE-;'Spl<!TO?1k*Z 2W bT&]rRy8^ks ~#~̽=&7n5؃y zZy2gu:!Š ]q: jBYT qVl>y$45X=|=~k\QZ&GjsWGQq! iwVx zAy8$_q0 =d{l{\XԲ;cu!Fmw>Kvw42X=0}cwiL/~ <Ψz[<2%{{ɛ3ۑQhg$L4P/qD)׳gc5}_Ϸp,ϣX,vmOtԑ&v[WrFE5j Bh[\VTZ⯿7#[ӵEԽaOzbzwF/_eSu~Zgz8.v:,ݥP{!'o̺l~UhM,\fd谘-NʖNlZl/Tv.Oږ,}ٖS쯾 ^AۡؽU_ۂaɛnT9|3W 8ͯU_iJlcx$?[IGG닶foSZDD/[j s#Vä2W3TX/R%BVnN!Ô=L/mᗽ!SMt>T[7r p/.D>ovX~wɠ%r>/p19))=Ā=U@cm@e:yjң_^)ΚCydָ/uGЛ 3h 0~ }!fuxhkn=@A[v^Ir)k{p`GuqyZH^qu=qH?,[fק=O?~do:b>x0σ5љkK1QOV*<@XlYo\}$~1<RU>پ?~kgI|HjOZz`vl> +endobj +576 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 270.123057 101.433071 251.373057 ] +/BS << +/W 0 +>> +/Dest (cb68-1) +>> +endobj +577 0 obj +<< +/Filter /FlateDecode +/Length 4725 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e KņgId?q +endstream +endobj +578 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 577 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +579 0 obj +<< +/Filter /FlateDecode +/Length 4962 +>> +stream +x][q~_Vx@ &D]N#鬝| KEIG%%-N)I[  3wL-$%qop qI+@WԥI%.p]В"Dԅ @'?T$.]嬕wuF#q0l1 guRL!J%xW$.]6%.&J\'xFiJ!x |Ru~µ ((K +$q)%.Xc$.e4o1<-l(qlH<1ft-"t:H\MA/q~bwI& B-*`*g.4l-q<]贖 oPh"L$. XM-Hq%.'v%.0A u4!qm'qsDl$.p%.e$.69 $[I\M4R$o(qA +&BStm QC%QG5n.uة':n(؝:_u>-}@4ߚuh/뻁{w(Kv>@<_mv Y瞧G-` d^h _uyrڂr_y:J݃^XU]m Bu=Q/;O4o711Ok=uO^,Yv[FkE;1;78m[6!;۷f#Vo0嗴VWԓeTj7:za+?۹Ww6K5/4DKvi#ۍ8mZx3o[NҞ>͞,ۡڽp{7lM]qPV_ [&Vw֘{e{( fȘ*i^;)Λ/:tnCmv=mS1; B)s[.긐ۊy~T}*nM{I_Crl׽6jf=ok[FxrT'Ǟmʶ+X/e+w9S~< +?ѡpސ`(ѡ =˝Vo (@bُ%B(7żhQngR/ע-Ha!ͷsS򙺴/ʜiQ'Qv.ϓ-lA^b\v!f[q+u%_> vâS__N#M Ww^וTwH=鐚vPB.GvЩ-grͰ⮡݀ b\/QQFֲ%2͒'yG[}lCWZ"y2ϳ!]8=PYPg Ku4u] wP|? 3bQx.ӡ(F8[1%'"kɞKnw2^A5 j3"}o'):!}>wC=9>}0Lvzha;_92C a?jG3D>y:4duOBT|,;{+d]Y+^ᯞlȌ'ڟ?7|6jQ~:?{vsy >aݽwFSWV}Ho?ػ?zzrߨz'^QQw72wP~AƀPe '(ǧGzw|dýOsRrNQ{.ӡOU2ZU% +WW> )ʱ㞽T[=1 8vHz/Oy6䥃}q =gnaW /C%~<O?SA#떫~M m6 }`>|<}e(9zV4ukg#y}ͣv;/|,`KޚZE\ \Rh| GSC_8m^uUX&9Qy%i{0UQZB|WxK,#a#My)?/yQ+ۨ8׈_9-pZvD|܁_^W;{Va~헋'=|گr 8 ȧDZҥtnX}3/5 +Zc6s7K_r|щ&n|B>]eq4墉. bvhÁWU˂ m 4R/h_+w]g*l>oX"[1߽"]|5_V i[-X[ VPG󹳵|V])j(}|zy)QUf;Rv~D A Y]0 QMJ:At\PSŖ5o4X^ݺT0J7F-_b>#nFx8#..] + +zʭ^oE'hgpU̓hSpUf:$vͥC I-vMC*1IUXuE]3\ U15P~[Uje^wpw&;zq=Hjo-|FK%MlTZeRhFoY\Fke' 2iƽ]zӜj> ]Pq*[ʭ+q?ēb}"æhuli]ACǍZvՈԕAuBڰ +]m2nGxZ:26aϗg‡ p.c6%_"qI۔-.#.BqUe+3}%~r]EFm:jl_tE_0ҴG0`i*}XZ O|חuα(2x[ ղl7lurh.zvز- \_)٪2QTLY-14K(R>EoiJmDߤrˌW%[ 9S-e% }*ٶnZ]fkw 3U-ۤ|gyU)UWBtlc&wTB&b4pHY+kBwLd +P6 t*~(gKJ@X +j46+A'c^~_F!|&j$?2 +endstream +endobj +580 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 579 0 R +/Resources 4 0 R +/Annots [ 581 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +581 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] +/BS << +/W 0 +>> +/Dest (cb71-1) +>> +endobj +582 0 obj +<< +/Filter /FlateDecode +/Length 4847 +>> +stream +x]ێ$9}gM|Hi  V)`?;R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-?">VI1P^U2P^VQ3P _Z#0+]LPj%n(/1yoQ!bL1,Ny_;#&}zY)?BI_a5oQ)3YCF܍ԠeӍG+a8X aDtE1nyn!se[xWwy/[mLIKHi  wfyG (,:c(#^WnWN Ŋyo]2hߟ~??O^OB)g~_ta]_y3), Uבz,!z\w hj=|#V}dm)_X>3> wPz9,ny:ވ]oCC=ZƨDIӅM;h|``CtKeM]; eV_-el_d?k{<r8bqnB>)Ockk={,~m;IQ.ؾ'sֈ(;G:(/lD;I,oN CMutH~bE8sڗ9?'97CV8ck{--vFm+>t}8#]-ތZd4b܃y z)~s#wmW=\S*{gM<#y}t/=;UWйY)]X;>yLzpu0!\H~ms98|?ly0A/Oޱ={бU$ʸҩ{ #GB8U2E-|Fi[6R{KFโy s{;!.3 +tX bBtR]|? sym9Pt鶜P|sŎ]XO< ڠ Y({f/s331]lIϵd=mib{^k5+û阢?٤Y.蛆!lxmkE^:jnkl +moz?r[~3_> v~$Қ<$ٰAfij7'oGmygo,6SV悑RcƏO?c?z\Wnl,,Cq<obApo7ҰTz5hٔ=wn9L*Cj3A-`Q(ѿR98ў[}GIc-7=d/(;[κs< ׅ(Vn7p5y FYr WhlY bg*X{63QA&͸Oe3ZLq}X>i~y7iܺ^ޔeNU؆ hui}ECǍa|zvՉԍAur>dbӠkeW-Ծ|ikhqL'WpuOgV$(iҡue/-[I4דw #v,/J+X_=OPGI7,2/ۜc˺Vec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmϬzdz6I=2v<î0Q;%*q;H+5;&g^g*vv]:e%6>[Af'Ϯ> +endobj +584 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 142.623057 101.433071 123.873057 ] +/BS << +/W 0 +>> +/Dest (cb74-1) +>> +endobj +585 0 obj +<< +/Filter /FlateDecode +/Length 4736 +>> +stream +x]ێ丑}ϯg#~f60@/ᇮ)5xeR %ʫw#wzE +S,Fx{肽Bva\#j)iTF>x/,P :FKS 2k&˩`Q*03RUf(/ 2ZϨR `0F+F'P)9Udu:zpH+9]s6p:[lYb1th-*xuJrfuQh$-N`Bq: [ 8xj[n-t( -h|-;Ѓ%p$L0c` hx@ h[qh [ z.-: -HqְEq 5"J 48. \)8.`\@rqjp'9.`]m@v  F + xWkdu8h4.:`eP! xWa8.0]1:?j xWY\7rwUF9 #Xo +;[@`Ni pA-wei CtX h>VQLE-ҹqbX.3p\0* ,xWjԜ+UX.q0H8`|tY]D  -) 0 +"IX$qxC9.p] Vk xW=8._-ӧB)8xWH0 +#K&Γ@ `/Xq\tpXpl9. buxq!8. +h8. +e%ovz[v~`` 3v?rXzgkÇ; u(c;09_S:ʗu/Uz9餞5,[R'˛mSNҏyS4:5]9/oOz?OM6rA70MT@\:_,Cb,J!(kH5֌WlSS/K.`-ނ^1fEbݮҙ百5wHƐj+Tk6s:[/?7i߳\Wϗ;Vi_fLΘnAۇmu|Lߜק7PfFDY_ 7{eu.33 ۾TjKi%̈aske$F5BO nKYEyjܣm9Oöt;kYcVLo|@jT#/ِ.rᕤk= jZ6CƼ} _BI%?)淚č'+?Ɩ>F˟B&KhOٙtԻzjjdĭk}}Ow,Y e4o~ƪA`NGa_ӡ_-c*$lqz^ԖXd-Ys2FWe?Lo<m]d[u>Aư>y>dے~Y+U-6~s.-xٟuߟ3)C%{z+Qs62;eYh9"z#/hcJ-OMygu;g=bs6;>[D8#ѝz6w9ޕ?zApsFNϨC_md/k +Gw[I!Bhs64}?v~a͹2̧U8nݙZ\YX![?y:"kc%3y௾.+ټ VQZ`ٳT3P{O}7z{UѵcI\\gb=}p޹o {yNЃk}vuҊyn(NwWZ,!'djVm,u|/#ۮZuhWqD;4v}yΆZ{ +-H~:>s(k +&sl{ޭTlbYO41]3l{R+\hju \+# EiƠH2s:ʓfI;}򙒿.+?eQgm l>oՙtH==g&y۷5@+; IV#sG#{ ѽvd1Ti|{1Һ3k='$&ˣӽN?sٕ=f~xal^ܸ. RўWgZb㕶P BI+9ǝBͩC'F{L;Vs_"OQ˶ mh1p)L v]bRA?c>9|loS6ڀÈH[PL3Btr-ŴYf|)%!,'4ur’P,v-UqELGJ\f몓UW͹']PnoKJDʨ6 br;1ۅ~'ҩ 3V&aH@29]L¦fsK*1|1@]\lYiߪ~.ŎZ nJxX{b]gR&B]7(x)RZ8BL2&f)1vRQ)f/+:i|I[U>c/H75VUV}LIeXeF]\Y E2P~[6wU=dw[.s[-%ە0q`3R!EDJaR(Bo8NqY:7.?_aNi"~8-i˒G?sShǕl2.HFN1mbTBe*/bJZАq*6%(ĞR̠2kk-uXU#5gۦ ӡNb4형A}98 Eː|N#JZtIo2>)cla&.$W=oTVuPtΔa>uWQ% Fօƅ=w}6٥@LYVK4/[1G_ uRC\{:;9k,jVP l]IEitH|FlrsT-|)约m*m*nΛF-ξ\()/sg))u6˲h{.C\LEfW)GΔ:p HFrwsCzyc%H%9x0 xN6og* HиBTq]6e[OƿDq +endstream +endobj +586 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 585 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +587 0 obj +<< +/Filter /FlateDecode +/Length 4893 +>> +stream +x]]$}_Qφ,aw1?Lܶ1}aO(SR22+P}BGG!2K_~/9=cpO/j^_I(?7V.N^'8M ׷ .y˟~uu}5Sh珤rv)FUJi+b4>'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [~$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓٝd?vgL׿Weh%C|a`2#h Xb,{(1Us7Km62 n?ld,rc%hOZ*X%krDL탖me>b2' >m İhFW4^|V/7ނ ;ƞF֣:t(eO-M| + xDil64Qn7. Ŋy]2iL_?t~z?r?~_/k\{dqH濴\?׿Յ*KnCy]y+z(KRmQ=-ْQhÏCE{ƨGoo/i βZIqfC<5x%`}M>}2Cֱ0j2tT"dR,.{2ϳWCVEVYϼ{}^ֆ^:ɬ(n>p_HeGݺvPj(=P9vqj@ CH *Z 2a|ėlM7$uL=? MF=tH=jv֨Q?(`5[Gb{1i Г+yDZk5J_Gu23zf1Qk^Y ڐ{cyu :XCKEe؈3m#ng?6񽄓y 8~ˏ?qyW/EƟRG{2( J3.dRвY!յj_4|^wly1ֳgZֱ4fhcu!FmCR]1wt;4FugTF-sSfȈa1<~f10|YCSouc{~sywv<4]K$zcǦĶiR{)aqe)쿊;`mo7'z]{9:ԮM*=7;OI;4k7Zg7{4/#!<<@/uF!;.B>K/12'ew6e=Yl'}z:-s Ced^{3[N3w2ϓ,#Sչ#5xFKtSzYRvIO//aDאgd0OI~g)#* 5glȋ>?4-/~|-<;,yHeȍY7/zN#*ï9yd'A;̪P<~e.ϳ0g&ԑDd*H᭗9x_xĦ}[W<)n;1d'<ĐcOFd;#6st=vs c/>jwbDms2ӡN\9^VDгq|vToC+={k%+Z4'<M>Ms?Y;x)W昩%ݏݽh Eo=WMv:Nve16r餄D-uJ\1WyźªWrF. o+qӷU,hwиcqMnrV&67 VFٮWƄ0Bw}+:Z;, f2 =odQ+yܨqJg2tRLSm0qXW4y׮gWkJT7-C&6 F[ ^lMK[GˣUe:ۧ++WO:2KVa$@J~ǻR]삅tii]e, B`/xNJwPGI7,2/ۜcc/uv,{9}h­.8F4lK+uUN. SUJզdn)-Nb)ӞJs6i:hɶs8:SX2 s7)mmvl{epݐ#SճMw{ΜguR՟Si>&j5|J!C}Mtm> +endobj +589 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 438.873057 101.433071 420.123057 ] +/BS << +/W 0 +>> +/Dest (cb77-1) +>> +endobj +590 0 obj +<< +/Filter /FlateDecode +/Length 4866 +>> +stream +x]]ʑ}_Qφ+,kX,fYamw{" eJqizȓ'#C*I~/9=cpϧ_Nj^_):(Y+'sH3 lb& O:ﺎ>)`?'R9;*CTO1UN1gI3|t]"p9yI31IP%a]ZaI*J+ءR(tON)lh$SN{-BI9ҒS8 Dl1)ZIawKJv99'2t*t3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ U"$3Ct(6ӯ?c=_LYJi +d Gq6 -DRd! |s7R?,?m>cDŽ3ru*h0u6͆ C\ܪo?Ŋ9X/vƟ?|0zSʅ|כ/@m2ϘGhu9j;"*xGO>.nKeJڞ_Q';c\Y}#UpO^/G~dc7sӿZD p#cUރ/Yluo@+*uh(]FR ewnl9.e_>jkk2fqJ۵ ~hOe +/Ӷsrɰyγ; 둿t:? ;RU䍈+@Gn~fHN=f5MGD401=tv7s}]y#%FniY`Ha*mjqFA}/붌^ O_A8K:@:JBC߱:OcuIbGx8cs(")Jy:ėGl4ƭƈ0wXRm5Gm%݃umt. ^ݘe7s3c}e1i1ҽǒF[/K/y_eL+/y6 ݰR9ye!GKuk'ztX5aʇX>[vY0]v`cuQ&B##Ko}g;uU6=7ˌډYu )v_,6mGWcnoˮi㎓Eucs=ImRLY%CLoXCN_ n}u3sÕ6Dͅ\ʍypUfRBmtHɆ=gd#i6 4>wX鐺~bE8xuZ½`]+Nֈέj+ׅss; >t}݇?ynԲb܃uͷcn=}jv}ղrfy}G2yփu }a'Nsdnjta}޺6c҃;u˹~H\tԲcL@/O^=Xлso8ZîVT +Vf6ڼ{yǍh2܏l2t?vJ`C}|;z绲^ өoN| U<%`<Roʁ|!6)@`Cص%{5ZU +eo#3D#j]i]ܻ:fj\5%[3K1yHh~J| '{!vzϓ4 I<4JQ]ߕd{n=P|RV_ 08.7'u.>V|;Ƶ~Spm k[Zv꺜c}Z!Tu2>٤Ye kO"@6zm@j rA]k'l +uw|-m LX~=<-=KEv'/g\ IzMgs.GzP 9(3Cz sŝysܯx0=Ї y^#)p5lBy./9Q!M[M|'ct&]5˻~i)z ]`~;XRgP=h{y*dA_N;W1 t[p삀0Ny,i}}47[gC}Fdwsǂ5٫I/bz}Zr)>T! :^7+UL诅uU{4n.ta3NeMdyKx9[;JD)6UkTYfTnR_Kqm$Silz6jY*\+k9At9|J^5WwS:mjdEz$#֏k1$mvܘ+]]vQ(;W(_DžIut)=hYe +ߤ*͉J*KEK@9Sd% v^Vunw]m4\7$TjCܙ YT)P;u*qFK]v:#Rs%' UQӋeޠ +T}\-+s +42A;zKIH[Ez7Grvi>)?fm +endstream +endobj +591 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 590 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +592 0 obj +<< +/Filter /FlateDecode +/Length 4800 +>> +stream +x]ێ8r}ϯFK5a6ᇪ]5f J))j9Bu"H1DF>+_$=Ř/'5/XdY+ +Gw6L!9þ/;׺>)%o;N!JP)msSyAKLIR е* JI*ADAa* 4I* J+ءR("kvG{Igc2It0NK4y]t[\RZ94tl u`%]-]-@WuEy%]KH%T Zg\VI:'lZQAAK8#Άjxv[esŘ@`%0% + $0!L I$`(RX4QVD>-UőjBDX[P@ka!+q"qݒJZ % 3k' ,(PJXpwJ\`AA ֵ ,hRX%$. 𮵨)` ,qq:Z k +xH\QC/q25Q5K 栕k2xא(Gxdw`%.zd["qO`I%.p]1|.M:Džy^IBe%.p]g?aE58X%xW$.p] Nap$.6i芺4 Z2`T0HZJ\Xޓx"=h$._0Nʀ)$xWi*˦>D `/H\#M)/qO +:|O8ve:B$.c=%k #-p-%.M1I\G<^tL1E]N B K1%.O.I\3$qAHSE,ES4%-p%. D[ J\MDXK%)3Į&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&V8Xu{w|aH ºni3DqG+}׀×{sMЗc~vPJ0.<:p\}N斿\/.e,|.2rrs\wu|g{qϱ2/6Teuq~?co ;NnqkKڝ<oKgkg[s!gS9Rv>^3[]>/erkCYmo aݮu>?~V„snlޜcl֬8e,. +Bl2a G:wM=U{l˨O?}y܏?h`c lJ rv~> ^ pFWq{ўØID/=\QsO伽Cm9W饡yw#{d[v-9!AνȟջLҕ"wy!lr둵+{yB dVn +GLʑglXC1 uHY]:rq${.FvE_sd>xO +.!qoo#XCގ9dXZn|ڎ-\񎴲m‡F^ɯ>kooNoXgC+KV^yFZG|ӕ7̂O[=14HnT'#50by:nO~4'z=bUcu>ΧqDwA컁fӡyGw<iu٘}v07#b;m#;oI Jxγo^?O׻yɫ; 3dW/^[\C뒌Lz!s_USPuW3|g~nˍMl{=VPOox hЍw RtΚzگ*_|ܻ?Xw=xߨz +9")g~5 RF !Q\P=>t{8>=/G۾v[IM;|cu aOU2Z2X<Q1~{zvOx +rx_ߩ=2ss!gҠ˃uy;j #;8)]C÷#bɮ~'mi~<w)랼Vk*:(ȿ{Z?ee ׹q=+ш`C1s^;IQ;IY{WGf 6_Q{Ol(;ѨK9D#38* +>-kݍe}|i`݃>\z\p™l ^cIuJQr׮}[[}ٗ ybKg3CW(y:|xXq7Vwqic|:;mzΗYl, zȃuQ;wc#2|G<SǼs~,3jNdy:}򊿚o| #yY%WKWS(O8}öy|϶&{<ZwjHق#;܋~>bgʤ@j:}u;ٰI>1˚@Old(*ˇG׿epmmFثnwˊ";0-\x6cpJ~g4[{/-Ϗm):575heviMܼj->2K{cӲ -(_0Ya$_հryaWqҜ=Mtm0ܱ|f~/=yZeǵVÍ^NLl Bi׸B^hVqT /MfVLJyMR{;jܬu'r_YZٮt}騄LtNR1IZ+ꪘ)O^h]Jtu:U󺃻mb_:֯v/K^h3ci]k6@ +Mh=l +$Vo!0_{Y?(G*{Q-L֕_b7,:m:XV4uܘUWKI]TWm/t;5v=6#ѱi |hδ} +06mK;%h[ҡ%UARv fLdHzVwй|h2۟UtE?1ѴG0q_LeR{za,'Km>úؼkl7lurhzvت-\(٪ѲPTLY=c(6Z|QP}&[ӮډU[V-Ρ]j%/kW)Ȯۦue=wA? v +endstream +endobj +593 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 592 0 R +/Resources 4 0 R +/Annots [ 594 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +594 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb80-1) +>> +endobj +595 0 obj +<< +/Filter /FlateDecode +/Length 4861 +>> +stream +x]]$}_QφIa k?z1C6˝>ʔ[}gl_2BQHWo4KNO)凋WWR.xE~Ov%Ov˯.Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaßOxSFmՒcu/1 E QFD$qqr8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZ'wVQ02W'0H\L&%%qk"Q'A+q&H37xxe$.p]L@?J/+q{茕Ma3?aL&rwuB< ^tYDe%.]g?aF5x𮶘%xW$.] ^a$.6i芺< Z2`T8HZJ\޳r{DlH\: [aL#XSH:aIU*f xM B$I Q $7!+0K\%`NS9I\ lH\ lA q")kD.Dɦ *邙R]&LZA/q~pIv [0T$.T4%\i؂ [Di-qA2Ѡ$234֒ps֙ID&Xi)ElMH\Ŷ,6uz'qAJIₔ`QF`֛Q€` "> +ơSJ€֛I\qI$qA +M,qmf ;:؂) &Ib @$q 7ы[֛Q. ft]DA\`VZ+degw cn U ȗH2q*Z +xm8a}[Tp3SFf 辭9z2l/?v0 LFw{Dͷ)w%jcfiFfa£퇕0En#KR2+Cdyke[xI"^"#\+y/v~"ԋ=郍mdҡa#>I43ߙ VX#" HcrĿt.V풙Ncr4˯o@_~Fݖ\/y+)ݐʮ:5cISҫie)6mm"wl"yfy_i cXZw-%;B9W?}oOۧ5 J6Qp_HeGݺvP(=Pz"TO0{*Z 2Ww~w,Qvɹ{H=zhlk2)6v=ؓyDZk5J\pg 5 ,mȽP^7XPS~wȢlx߈3bsdpddOy6uqGiy"5ƀ8 +7Ҍ lVH{u-#|Z0$sX۪u/_g:S4c6>.2cx@x'!{{̟k`N`tPi;Gs.F/x޻}~2ϓ,cMHҴ.Y.*KölIHlKHB̆Lǯ >7SCGˀĂ$o͹Ny6y1<=lwünyZy! +. tח=/?qeTC0Oyu>B{:J=fÿ#=(\?rRy?Ry:C>9sL|7HZWx=k;|6K3toGk7э]dƇ9ِé+!~~Bh~\ z>`夳c^rBePആI@ۃz8|kmH ,ҩj/,_^22M,(շn*Y,7m;b7OT&-_M^mmKfj0/biæ~r.'&m'Mt;b$Lt&];9ER-8i:Jt#XP:n">wUԋ.~9N;opZYXCAvy))P~ÊGkk(Ej"[N +VLW^[ iUhXO ULBŪb=m ]LӬkZYw oTkG(kQջF5eF&5eI.Uv̦gFTZ\ EL[OŖ*zҡNe7vS7ҏ1l}*1ܘv.~(+Bm:^4* *SB*|5HIWBcNXI.]:ƆY/Hn[I˘aϗ6с*\2uS+Jڧthaq %0wVf y%d]a.v]4ˋ +!`yye`}19@FMƥa$m'Km 6rVec϶ Z(mIyV։dZl-IRl1E{^iNW&-[g-y[zK&Ax&u=mn]wmzdz6I=2v<îA񘨝*q-%5<{%WkBwLZ5lUQΖؤ9@ +46;Agdj}D?6ݥ>O{Rp +endstream +endobj +596 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 595 0 R +/Resources 4 0 R +/Annots [ 597 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +597 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 273.873057 101.433071 255.123057 ] +/BS << +/W 0 +>> +/Dest (cb83-1) +>> +endobj +598 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x][,~_Qφu `16xYbOʹc?e.UigÞNUF)}Tfw +R"]o?_~HĿ!`PW% s/|ڻum˟u4j^SR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` ~w_`<;ÅY-q*eyvXn֍~35ݪRW~OF:N7Sv!CtW|!C7E3EtW3.N t=+ȮE 4r]hHYBnA8&ӥXա*&#/3ܼMhޜ'6N#K/ qs::.B4ݗ!7s_=uđ icyب N5 )jd\~7Htgn4W6]R!R$9ޙ?ApsAȠF1ΟYun[cѺI*w9;CVnYgYLݻ+#wg7CHC28s~=Mcqh,|ߟצ-{~lȝx+mDmPۊ8s:oO)Hrr} M?Q0|z:cGM<}se(sZ;qwGW|ۺurڴ/:҂F[2'<Ꮌa㫽ڼ__֣}ա>vw\$Vy>sp>)mV ȝyNᱞM>ϣ+yΆ*k;{fQ} 3鐲q+~3xav/jO\vMWW^K*+&wX`ێ+'9^Vkޙth>p ͐pto܁=C|O"#kfHR{9R7aI1f<";w9"ݾ;Yڍ|GZۧ. h_]9}$?S/׹w9R7|w̭hNvݗYpn霾 +q;><'s; a}v5\Nfa=tW}A>#=gݙt;OsG"U+\}B.o{X@OڙtH~.)'O͸1~xm=L\@ob3{ BOݫQsT+尌6PQo~p k8f6~lyΆҸrOvwN0>𘀭g s:;; خ{>O=k`w9Z70d=PTrW3S{oGmW?5醽}D(u3tb |m;9ꮟBdw9#OHw|$x^r+;=E!d%?59-R]}"h>\7ׂxN mryHf _>_qM=݈CDpcJѧw$ovUJ݃I Pc󻱙).#5Q* Jw RZw erB&t+OIvg(6`9̺헋IEWG"RARа꺐sx}/%Fe^^urs0e/*H퟈S9UvIo%FLAwp)KYr"}JcRlR~̉^{Ō9KFqzpf#SK=Z7z&],XoԶrz4q/Un̲*l&~(*J￫G46xH!i.}l^*H&}"ݒD4Y#1HT +8QXn•Pf#P]巉iPseN5p*v;Z/= Yx&6 !WRZٮVa *46h-4<~Y7. Ӝ6VGpFw^ i^2EmiJiDMxK8@g'kKFEJ5ɲy4;϶4g*k6;K=2vy* S1QFkLNpBB9g=V2XI[C1+m7(ⶢ)m|,-J5 +4'g #BЧ+e Kņg|O +endstream +endobj +599 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 598 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +600 0 obj +<< +/Filter /FlateDecode +/Length 4918 +>> +stream +x][,~_1˺_ lHyB9gm:`!?_[VW_fw}ćLWIRӧԭQW_)/Z%bL)/X\dUISGw&r>寿kG]Hk宿|&5"cT * rNgT^ T1%N3\ڮUfVȨ"06(V% +fRv(-%!Zri%|L: +#|)NENgaKRq:[Vr:bM duE`8]-I.+:"T.R%d q N)MУH>0: [tgtXt gBLoԻ49آu99 +@KMr$6ȱI G:9a} +ӊ##ac`Eeu$qѰ 8.0hk8.0`[ p\`@V&qZ< 3%kP.8.0\tkЮs\`*qQp\`Fqi Ъ8+B(9.]wu@4Xv7rw V{ l48>- X 0C K8.p]01}l%TLUPg-,@e8.p]g/0j xWԜt8.q  0 %]VL1r\%qFa!# ) @B"w1' ;R뇟._~/@K~w<0zz1.ez't~Y>6z7>uiOyϴ2J"/*erc4zPCagCʾ-mXC.Ӭ4$}X4ϵC,oA]V6;5t@\5ti\{jl8;6FHWdLdN2\; SU2~gS5C*ZTzOy4*K~~Iڷt&:{cȼ`y ;W?i .K>;5 Z^vhDlcn +MDٲ0yCW/="<_ukV>QչoNO> a}=5'C{s=F8٧}<\GgwvV?Mm<%&^6l+,6}>3ocO#cyn>Iu6TzqMŐl.xk+84KPm]݊U{I_CmW{~2rm[vվ:DaL o&vV}MQfݳߥ 7l\G;>mnNyբ;tڋ It] rWgsj;Ӆ S#l6. gP!;jQn>=Gɡ͸9 )Aˡt~:o6A2kHk9la;9g>jY_nIFM\GCo8+dž8l7k-_jmڊF昙ikZnmF8<jSo^t[h#}}Ckk;{'<B]OK8yV oGܿ c@(BU{l#};>xaMŜ69ҙ =PTɣ ^g,]z=_➂;NZ, %a]h4dC>י]DJkj{VgW6ŗ! +e,=syo)ϠuV&6Ut|Pް{Z?%% <@KM<s^f)ſ:b={KO@iH:zdGCiGM9L7FhgѴ(0" Ke뮩25<<#zU0AFG]pܒ7R)Йt;M~zn+3|(̪.o' +ޟAN/~n.o/Ӽ>Mil/rz{޿ٳx7Pê~|JDӁWo"h*ͤcu#gk $fLYf/?颒|A>e\fq墉_.teֶ$z/ Ev)Ɣƕs#v6ߕlt%M3Bj-Kf1|5^vCۧm7lNB{Z]盰޻Nu_5vAfR:ܪxW*3QJ]IYvbD #J[[4fwFNXdkT1ۅM7Ֆ +5UlYS|3AxFv1 #]|]T2v+lMrqIWHW Mw*Ii6}C,2:?QRbE +):g]BoVIWֱ -m.Bl/%H[H;uyDRĺBW+yok ֶitiJ +:X:Mgڐ|n+Jچth2⢿).Sla&/}S*4Mg0ߺr-$Mتд1>K i*}饵b$KM:|CC^{9k..zvز \_-Eet,zPls\z)ԘI=VNt}UZojdjz8V;RX222RR"[meU6C|LeV)_;SaՁKU1 +Fs2z!ni> +endobj +602 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 555.123057 101.433071 536.373057 ] +/BS << +/W 0 +>> +/Dest (cb86-1) +>> +endobj +603 0 obj +<< +/Filter /FlateDecode +/Length 4914 +>> +stream +x]]$}_Qφ,k.xa}mcaPHedUVuܺ3twe>B2K +R1O'5EX]Y+'sH# lb& K_Σf9TN1ŨP)mSA&,`θ* T0UEm 3LNR }TZmu0D9g~ +pztFO!eE]NG#鬝BtkIOtx휒t%]-6X%`IJ[ ]-@WuE%]9QS)(?dtZOش# +3%(ElVIgaI6$VC*%-D'` :_b`AxIq d'\X<D&Ʌ%JCgDVV+`Nk` H\`-l1J\`hnZ uJ ,f* ,צ$.\@)K\`)qbG ,X`$.]RwJ޵9El%.;NV'+qZad$.@NaXLJJ5I9 xDL.NV5MfnH\ƙ q2 wA!^` V+q +   B7ӯ_ӧӟM)~󝦿i.u\yMg(E+bwf'ڐetǸEo?CvY}a\B1;rgy~1#?w>\NO^WaibmKNt6y"-=Ee[Nt-G-\}L;vޖ?wmtrP΄,=ʎk3qT-6UoKK~',oQ0QӼe*j?٤Y>蛆!lxmmķ'J/Jڅ ]`fS`m~+뾨~ʟ몟觙mնƈg>IB;\.o!C]zyD1f2RꟼjmSigMcqYsm">~#?cn"9r(`87{RAUq(s'Vä26}^zjA$qо[UhmE/"tXk۝=rzmA9Lrڪ5pڅ(ޝcF/ZYa23Q׵ҍO/Q qEծ/^f2SYnZ"HA<e0{VQF^-mtOPI|Ҥ K%mT|Nnű觖~C=tFuF~tXaU3/QEGۉ^ 1栘Gr-#:NyL Q-ZfI0~m 5TMdѶsł9ފjҋ^“&\f +8M t +} ++вr8. OUFO*|5HWBcNXI.]:ƆY/Hn[I˘"qEI3,#.xdnL$w+,.XA\fyUVZ 44~xxC$mޤo\FFxԖ˰ls- :xZY=ۂ>4zhVLz%畺*[UZ'F*k%jSXU'K]Wi{9^ TnZd[9co)[,Y๛ʶuuu=fnH葩&Cؙ R@h-/U)pEylwD^ 19kUz`ل7(m+:XΖؤ luS~DEj:XKAoE[Y[?A} +endstream +endobj +604 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 603 0 R +/Resources 4 0 R +/Annots [ 605 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +605 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 123.873057 101.433071 105.123057 ] +/BS << +/W 0 +>> +/Dest (cb89-1) +>> +endobj +606 0 obj +<< +/Filter /FlateDecode +/Length 4704 +>> +stream +x]ێ}VxAH8ȃ nF0`!SxUݳw0;*^JaU+C;st"o);z{肽Dre\#j)i|O*QEԌ{err-ȩ`F T0(Uxת3S gTR`u0Dvpht\*:i=8o.98-6 +,l`s:[ӂt(Ndt]tQ6cX]N:%`ւI9X`S:(tN'lduj8-?GADe8PA& +q0kTqsV\[ Xl1p\z: -Z) -p8.G0D ]]O01xCr:A׬.@'=ޛSk!`s\]f@' >  0 A3t.tRr\l7qAPL'8. $AqA0n W 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lpQXlq NzlQp\fnِ֛@g]L q\ 7rk{ l@z-V6d <3 _Z#Aepl*Ra?fV0E<&#w%H6~|?7c,H8cj +@Et-qa9ZIKX9FFa0e7dNBڛ镍֩~=JT= P:0wfyEVpp 計B1. +Hͻ Fl͗Rd>+vOo_OIS `+JȲ 0 +xqyA!gwPʽokVg &,Wj֧ߏX0ٮfT8edY׌vȏ*kQ^7Tʰˈ(s,KB }z+K7soe1 nK]E}jQw̌6ɔTV[R}yΆT%vC $Xs.ܖYpW۶Al?-HH#KNIk|Vs1d|߷bmS|[Ȥh3(pm ps:d]ͭ5P֭'@,h˺ +7PX|?cbQؗt(g}X^r'k.T~O+e_\קö LmwT?HA͝yNIl]d9?ìViߟ3C%䳏 V>G<ۗl~eiiWD}ӳժejyi0̌O=jV_Ymٛx;v#3o|v{ {F"Zm_w9r}_[D8-ѝz86_w9ޕ?zApsFȨCi_mdֶ7ʞA3CHCjB=M\K걄h3oOhiPXvihK>j Ows:4WkAsoj{|R_n odw9rc܇smq^_wm;i87>ks:Qb*Iy=cDb;\ww崑*o o +qyNv{ޓ9jw|]L{L$_c0oOZOlIHpU@Rt^qmw1|"SwwOϧێL"xK7vSzz758SZ7e͟rBb>)?=~Q1;=tnCxhpaN:3tHIMrlXy9sN5).:e:8-˒"ͷ\Nq%2[̭ q=ѱSL'a6PX&4y\M. +23ZhKVbZoM+fGپ)t͡MgR%pQ.C2%_"qEI˔.UF\ԅⲪ0f Jrӓ +MuUALf뢓l* \`]_YW0F?$ǀPTq> +endobj +608 0 obj +<< +/Filter /FlateDecode +/Length 4908 +>> +stream +x][$~_1wt@0ؐBÞYp󐿟-Z]sv 㙮ҥTV¿4R1O'5E_I(?/V.N^G8M 7\ou}6Sh{R9;*CTO1U>:㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)A=Mu:v +i%]B>I:[|VZysJgSt`-&E+"l1Nt ]ItN>'D]N:䓵Ji=y`ӊ:(tR|u[e$-$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8Dmѓ+qGLSVi%C|a`2#h Xb,+1Us7Km62 w~Y +SXJ(RT );,"04Kv[s䈘 -|eNl;m İhFeHFJb#ԋ0ȢG3=hz4S' 3I|gGDfC3(hkVp.V풙Ncr4ӯog oQ}W>͟/˵_f8 '<ӽvݭPxIce(o+oeZeT?*u_kr-6|?{Y乗QiZ|4뿟?|w58˪j'eYw|,qw0;7o<賗 qUKw*&eq݃y *„zu{㚴6IfE`mJ"\FF*C8nuݏcync!N {aP9a@REkA& v2-F~@UhcyA_u{Y# +V^կ}$'^ë< =;к{]yTw/:g!Š g@z]ߠcA8kYT 8Vl<Jv6`K8lב87!z~wRd9 uǏ1 + 4Bf+-ҵ` K3' +\|0!y?ƵzS³#\X: s=?Ĩ q{Xۼ+1ރy7xȰʨ7#~.]bʱ~1#4ǙQl43[Ox`u8vtlOϷ{,ޮߕGfk$Zrtԑ};M^cmc`_Y)X g BhެukJOw|?}Jڡ5]¾yy 9'z74-=uc&ϓ8.uz%yV_=7?V6U;j^>dKoSigwO9.ww赽#~#Sdc1}S=q(9]GufwSCF%HCi\eS W+aRV3/<(_ov<hϭ>L٣Ϥeo؛2QK烽/uf-,yz Qnoky FYr!`/_ʜ= bpk"*`ׂmAezZe+NL`ޚcGyy_>}#>_\׸7m[Ni>-ܘE_>-}ґcEo:bx=IPae۶GW׎49)JyRl| mH~tHͻ|ǖ}k1em*.re5^͒'_ybjאTCz s0 zhXgCfyxg"==HDxޏOw@7G^|=s }t(</޳ޛ|ԑDd]9LX~G}/sM*ۺIa݈! 9w#{r<3f&][=ja;{c~X}0ӡq?vst;ݰӻ+w= GwGSEwG3=6>x~~|DxlPEږ~^Gz3 h kJI?apXa>RM̔sYGCٽgv4t/Hl^=W4WPؿjNjMy,@GtV~=NY=҆Mt +'Z4iC?$qnb>{INnű|%gZ9^Z_,*Ig73 +]v_Opع 1 ňdmз|WQ5lVKj"[8W,3識Z&(dL#M t +} ++вr8. +Cݫ*|/5HUf塱<]it _:)!=nK<21y<"Fknkbƕ\}Jmz* ݷr84|z\˰\*͍b~tQm1a7 ŝFߊNM0>ȤrT9cQ< wɝX_&/be*lÆ c:0v=^SƠiw2i52eb d>o=_8z^C]o.S>%Y}JP\ +sle&W\O;b,KuO*+`I[~ vWWF{x}v/&:HڨI߸5d-a}[M{eس-Cnu1ʤg[x^UuhtVb6%[uKiq[Lѥ?pO{+͉Jؤrע% {TOb$ݤUۭ뮳5uCBLU7);saAJU1Q;U +GqKlk<{%WkBwLZ56lU7SΖؤ luShe/lKzo!Z +zSTZ~DFYmCՕ& +endstream +endobj +609 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 608 0 R +/Resources 4 0 R +/Annots [ 610 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +610 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 438.873057 101.433071 420.123057 ] +/BS << +/W 0 +>> +/Dest (cb92-1) +>> +endobj +611 0 obj +<< +/Filter /FlateDecode +/Length 4773 +>> +stream +x]ێ}gyH8 Nc#)I$KRK3b<*^aDIs%r |I +7X\Y+sH lb& .ỵf9ϿH*gbT^Pe!Fム +z@sT0Ggܵ* T0UEmUf:((%`rAA=Mu:vi%]B>I:[|VZysJgSt`-&E+"l1,l-*(-|NΉ J1]O*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01.'Ivp%LʃJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSX`u8*J\FF $.p]wM 9h%.p]ik (Gxew`%.z-wu'iՠSxN>Q¼E/:,qbx.3I\ c2t۝yލhuU-9 +VfVʼ[yFi6S;%4>p`g4n+geHg;'?/>; k-3ᐺ9Oخ_؞,s=oˆ`w9Z7^/d#Pjjp%^GzҹũL7]#Bů{^Bnj1[(3Kgq6Y;'?<s8_y=QTz㑇F)SI֛{8 +7+k[i!5jYVD=HK; 鶏k=Clwm KYZv꾜culI?+qc6u 1@wgaz_dAy֯bQ7ƺ#~*]bʫgoڽgVR4w^ըg$L/]+ +o_v6V5y ]~ V=W}ɘ[i19WrE4b#Q/1u! jƑ۟aqJОkawLnVSOi=1Sit}%Oj%"45h'45gޮXFBZUY9"5科jl2Q˜z~WW[ΙWi)Vk07^)kjM}-aakCȖ4jQiE ^tNӹ.glC0`ѣ & +n&`9"_Oim(>fnC'eZ +&g6vn #3?eرs ݯ5:EOLcs_ {Rj'S.Dsع67$T,+7kxroF ֗?/d;UMSł9Sՠg1}- v +O +l7*&BŪkb=Q.4a5wf_ҚȆrBRT)QUfQJ}IYqD \٨4&a*@r5].$KubMZ\zҠnSxAvalL9ls)4eUb1Wɻ:䣐7P@ -+jxiRz9fU*%ЮB(ҮZ%47xI\*8--.c,/H=.cyDR i*}0V“v ˺3]zeܳiSnq1ʤex^+Eet*Zb,69[閱IX}&R;Q WiܲUoVs8:RV_2 sWk)m]u̚!yeW)GΔ:Hʿ1S j5vƸJ!C}&2B#w+X 18kUxل(U$/gJl} ͩH1D>e"}ܒӛ裦Qi9:~#o>g> +endstream +endobj +612 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 611 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +613 0 obj +<< +/Filter /FlateDecode +/Length 4944 +>> +stream +x]ۊ$}gJyH`d`X#쮍$?}"+ouu;vUD^2OȪΒW% FN!D1y+/X$*{O>Z>ǯ.ZW5蔴_>eT*!5v^YǨp1r*aQf0`90JF`6^* T0CFC*!X h褝q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +]-@W`uE8!9]ԓVN ;٠tRNԬ# + 3wLREqoqI +@I8.]В$ @'?9.p]aw`5a2c$ӁwDs:>r\4mr\< TN.)z8.pQ@չ / ,V[7`V` \ LQf-9.M!qZ95fu:9.L%Aq~"w4[0T8.T4ϜI'xIqAP ADNp\$Aqf 7q "M0%- ?l[  D```MqAQd @ qA2`\R8.Z Dnjۨśh`` Ȍ[pMsEEqAtq ě%@g 68x'7rZW8b @s+d O;#(2Gdoy|t{d2քa7W3}'k6^\jF SEW$,V0]f4"vĈ<Nᴶjz_=Z=֪䳫Eu˗* c)F*c,#͌u2σ 2eCYJsVG9OC;Ud|߱KK2kyN?[we5Ĉ(;AP6bed]<̊6ɔ3̟)FrKYL]MQT+oG<TˇBxĚ3޶2V]}Ɏ2<ؑ/pr1d~kS|)c`;B≮ˡ][GJ8B|Ȓ-} bYWC3B|?cՄbvQx2ϣО(lw+u%RA},ƞJ}?#e_קö dVÉi{/ 陠}p;!Ǟb]dǜ_ac}Ψ̇jGz;Q)i}p=+jг]Բw=ZTlFgiJxS$eosm {.!v|1-nnfk=?ѐ}7/ѷfu{2áy]7;W쌌~uՀЗ"{qmѺŭOJ2d<ح;=Rϼ&3nV|'Ww돂]![x:XYK^5/m dC恿ƳꦵǷ Q뻵Q\z'<jzk}Û7WPꯣs^;ݟp=Xw=yߨz 9")et7q/ +X>;<#k=ǧ6N|+ǧGzhۇ.wK}9MNp;P{ +-L~Q>WgL[ߩZe=S+Qut;\C}!]ugwu|"kxxk|D-fI5/}6[}h맯)Ϡu~M/m0 }^q>J|K<<\Qrh.FD'<G ~?>{H@iMu4<lߥ ayQ\y~je*<׻'}0XMMQB+1(ҽ;10:S"On :LUeѧ}렀-(O"_|_'<⁇uow}uS*ogccsĪ +[O +lRNhBU{hrk6d%]w /VVJo(EUtgTR[R1~-JY]^0 .t¦˥S +-k,-LiPס6<#Km^ՍRL{־ÍZ /ԑ/ԶqzPwVq /MJ|Yd2?SRbt MZ%46xHU1\ H[ڮ}{!pbԵҮ:<"JKb>+{(F&/ q֡jEĮrK/%mm_v/4QL&VvN )4qї$.A͸ϗ\40BNKzSKe|y1?y\rBd^pRL*:l:27 --hR_]4b/)eePYж6ĪBWIݵ>XMS].vܤMU8/t]8mJ֨.#NBqUe 3 }%~w΍StM}EKX'}Fƅ=wW{6ٕ@JUK녑/-O뜣feen䴡\ 81IC˖ؾRSdJDQ2QdD_lr9[itŁm%_}&GҶڈJKzK:@oW'ZKFUjZJ]dͲ2^0> +endobj +615 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 683.673057 101.433071 664.923057 ] +/BS << +/W 0 +>> +/Dest (cb95-1) +>> +endobj +616 0 obj +<< +/Filter /FlateDecode +/Length 4791 +>> +stream +x]M$qׯM0ۀ !5^+$#Y5=ӕ$3|| FVU;SJ9wx颦~ju_$Sp}7^W3׿@*gbT^Pe)Fム +zBsT0GgVaK*I* 뢶[U&j'`> +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQA +QϢxGҁ') jIa1щ:؂آb(3h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wEMQ[` J\V(qb 0p$.V&wMRN5K栕wGk28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ ;/㟿ӿ^/'NO_痿u},\܆z|u~fk7]0hߣ}^cC k^}V?\de4 %߱u| .s>cf߃Nʴڨz5Ů@_zTH_.(f;:`9wd2>fA.rNÌy.6*sکp<z1ޝ 5G}C'M>?<$qM}="evn<~=\bU2f:F:O8b_q]nB15^:)ss E ).{u \Z=VBM@C\enkֈ:HRx(/lF5x݊`q uih۽0D~DH;HqdCX;V/ZƉ:G}[v*oNصale7ӷ! xdCxN⼯dvx7jA1:OkwSe4j)hq3"ua5c~[vM;<]c\G:~&YOy6;q?"Ͻ'SuN vcғ;u_sU"#rv6q^ˌZf8o,>=dCqLaWaSs #GtYqXEi󽈿g~.3}a3[w﵃Upӡ +W3" +-{k:-ў{}ǘI{[kzȔCTvC? rT?.DjӸO8ϻd0˒CȱMQ8z;A GX + ^ tL 7-3{ąMt9y-p㾬ϿGjy8pbm&2qم#<7eqgos^۠|$p#,cf\zkνUd2j͛χts9-qumPK{rَ-!n{ ofe_~Uެs9Гue `w+eu;w'ݡz7Qe?Р̶1^rfPϻE.cz88lI#btFfvK.^6/, eSY{hPYnZYmuOJͥeSʒ`ya҇Ͱt \N]fV!MЗ7\YRW: 4)t&];5W^J-߂`l: #XTNjta>^1h?.N;ӳw$\^֖-[e7lXkZ^0-Kko$Ij![Ro,Q3識z&[dLd/ULBnU{4\]ײ&<.oΚMUdגm@\'AtTma0; Skr-'nҚo#[ԫnJMD6G/bҷVlwm&vG\Y +-kxҘ05;gMJS^h Eg~Mv:Nve16r餄DtJ\1WyźªWrFv]VnoSիv}kC7.m5@m2W,lnSIV~3&솁[ةβLZqo]2g7)V)(K_e:nTc Ӹu%+}N:)o6m8F]S/+:n k׫N쵤n }!]-?/@kǦ/󥭝7\.Sپ$_Y}IVQ\nL$Is=PP_0.m׹򦫬Aloi~ӼG0㾘 i&}16“\e[slI=ڲlC eԫ-*aSڭ+^l > +endobj +618 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 236.373057 101.433071 217.623057 ] +/BS << +/W 0 +>> +/Dest (cb98-1) +>> +endobj +619 0 obj +<< +/Filter /FlateDecode +/Length 4661 +>> +stream +x][$~_Qφu plcfjm~%lsEfS(RRWo D;~t[C^$/.I`jﮯ_/6EN+{IEFུ*B%aT +u)[S I\`9  +pÐWfpC{E +nh=R~(-%#hFpt.DYNyΓEᜳ|Q*NgUD2s:_3thNdt]t\6#9RաGgt8i#/H |!p:5>Ի4Y'V_h_wKhEM ` + yo8 +rs<`N+/FBeuDh_4 ؖ dT-I8.0 \)9.0`\q\`@Rs EwNs\`@w )qw%/0`GaT0x(9. .*Cq"t j!y>h8. 𮶸nj+5դH6B,,ӆLh%X> *Dq婢cuQ(g-jY("p\`q8^`DX29xW(9.] A(`|J. +CwAKB0 @RDqbx8p\:bq tLF*Sp:ThaNޕG x7 8:p\`q $%tX8x e:B8.@`-њ B }/9.8.a>ZtNA׬.@<ޓP8.\Jtz @"K q\#|AWC9SA6tS゠ A e:qFh%Q՜dg 9BE M0S:&ۖL~04ctn B/Zj 4D _q\)L4D0qeo obh\oz "M$7N\o f`M 4lk#Ӂw: p&"[nn/A#>!81^MHp/F+ $7͑ؤ286kaJ%ٴ"'ܳOmcf&#!/sZ,/?c__  hn[CC+1i>b:@c-9/?L< 7pxL0}rMteLԉ9ĕ&^sq%&äӏ_~Oѧ_%%oT Ϧ_y~/n+e,GyԿQO4 ^'Q7C +oMY6qz'UU!/i +!&H |3y_ήTDܼʩis6u,tg'3Z7{YNӡy=ţ7:Ĭ65[8ū=bޝ?ܷʑ[z61iZX'@mlN8v\ R<3auWgj9Fx%|lle4HۑY=5.- xu鐹&:{|lZF"is6Ԛ|곱x TQo }Ēϒz0_z,_6s6tȻ|nT"n4deQ_reDX?FFrqh,|ח.{߾oxTjjI +ĝvPJ-Hhzr]u[EVV/Dž4?w'KX6h==w(.^Ԅr鐷񜾛:Ӳ/Giv>-{$N+H5ė>eȻN!6OĔ{u$o9yԧ(~xz:ǎ|x^Rǁ5˽36C߾xsY;q>vG&Vx2<Nӡjc;[fQ} tHxZlB_'/}gIe|ۑ>$kX;mΆV!ڂ={D_蟙M2i Hm2[{otHȆ=g&y˚- ;mN}dyj5' +~ N!x#V}O(CӮ,'{lߛw];mNƍta5[rM5tH9צLfn>6C'ڭ'օ>ozlq֝6C%&(1hh)>Y?qPftȧ틜}}*$5z3"<{ِ6bLkyU{Gk{YZ{=}bgwڜϭ><_|$sĸ;mN{U_xj;^CY=Hj=y}Ywڜ}SܑL +:Wбx$(lH\?$"Wp7&롵l\c mӽOlwڜ wU3*zjWѦy[\q4 [絀9J7vwe7IWoObJk-tHr ur?OqOoѰVa/%'-> +D7l r!HV~zȹkHpEIѧko?T o琢Re=$=v!՚ 6O;,O_3$BSYw5~2륤iO N]?936`=̚]R{tڜHu>^^OARP`9liS)5r,ƇiӫXH""rv%FLཝ$?r.R`^ľBc9nfi ʹ_ҩ8ݽj]}0+X}ڲpSlv.XSG]Jչ*,UeosMxದҴh>U]-4N"di*ĈnF̧&4f7vd Cr1cD [n<--KPMcJ PGԧmʛ>"M8ehpgRUz)m+WH +Ms"J5,gS-<ERiOzT/fO+:Հ"_6ե/mKɔO[JH*k>fIUA]' +S.WŶ@u"~U|1r*v;_[/-rYx6 !_,]X# νcd܈{2 sXm,u7{mq\pD܎diwSv[mXZf4q\놯J칤* ZXje+[W%ym}?4p^ᠽ3uH6Q*ZthI78hO悱z6q3H?Maҵ&HlB`'&^4Na~{=.$-^Xf8t2k:ȝP9i)AN5AFX,\4. YVOn42q`kɗJִm[Tm[ʦDK@w'kKFZ"Zd4vmmPuTV3;+=w6]ց+L +uKS ԤSPhShR#ms%HΕWBs2Fz- +EV4zw͢doX0Jsr 2Œ)!!T}*8l .:yT^*654OK +endstream +endobj +620 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 619 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +621 0 obj +<< +/Filter /FlateDecode +/Length 4980 +>> +stream +x][,~_1u@0ؐ`8!9gm:`!?_ukuuO0Yt.ҧO%G~/93/_ObV_JHY +'+ |ʻ }߾8kGSҞD*'QEԌ{errBcT0zZar*a +* mkUKé`3*)`TB:"ъI;98q:%'C'tZOi%sNg`Br: [4Fp:bt`uE9- +މ.+:".` ЉZlZp:)' ljVNr)ℍX-ӰӁ'!0UBKNgaRް:؂@9"(#h"^8@y? G*8P!N{рv2.z)1`:آ@+؂h [hZ8.Р[#@o …  4(Phpwr\A ) 4hW8.]mwFNV[` As\`Z +qb) Ыp8.V&wUUSƠwEP2q\LF]P=tJs\& ޕ3V q\`2X]Ǚq /OҹqbX.3p\0* ,xWjԜ+UX.q0I`~tY]D  -) 0 O"IX$qxC9.p]LVk xW=8.@\-3NB)8xWH0 +#K&Γ@ `(Xq\tXpm9. buxq)8. +h8. + d%ovy[v}`` "E dSp\z ^tNMY]Nz 7bqRS?Qq̀N |-*`*Bd$lAq"] (؂h゠VNp\kIAqA0nP 4&8.@br\X:آ EqAE qIMqAQd @ qAMe8.f j&x̸zs\ lQXlAq NzlQp\fa֛-@Mnwm3q:."Sq.Dd˭zg2Њ3;k1[܋ʳ{Kk$vfbekiJ)mE[Tp3FF 辮9Z2lWO|?E)+?BJm_a%]p_ޓ)AyӍG a8X9 0DLJ7Xc}hl&ߜB<r떯k^6'^ fY*A4&EyKZvNg2ziu%ty^y2\2i[Yڭ6vm*6|g;²~?;imuey Ƹ _?[Fn.=%Oj0!AׯmEߠԕ_[ίKSØQ݊y RVQtYcl&ّG",e DMF 3]rp6FcS.Ǵy8L]v'cГ_}>(zk0b29?3Ocx * `tMq %bg<~[k$>5p9.LMpU߰E?WmtIKm6fot85q˱]x~iv;߶Űe4t o +DC?C}~B_"EW3%ڗkMHgcۺ)Z;wc%W=scPPY8N΁=; \>c[nW`Нqq(Yv ^)G<>MT<6ΘcbR&үY}W4fRY_~?濱Kg{7PF +bA (kf9mmm6S>&Iw(3է˞ȬhL9ۦ(~!rS)6om"ۑz,!5!Yk嚍s3XeEuvy/K!b$%^wݵ>'n= ߽dK:2`~ƪIX1(_"au9kwHc/y4 7'cq{p^#)mC/G޲nv?V!C~m+uz_k*n&r\v"^~K֊Z~yg iKVɥwK~a$}ٙ#L BYI&F Tܙ^왺MIF3ӓ"*MzFlL{|eY. OqLmy+^4?gj~[(tz\1#DN'bjd7I+WM{hXj Z(Xb7V׹&]wݹ'Pޗ^*UtgTR[R1hά譳0 .trbl)_S57Sugd#BK1=^Z7j%#_O3m +a zʭ ^ԇ* "wv3U*%IV *^::4%%`c iNc1HR,+ꪘ(re/TĶBu!nv:TݛYdw[mbW^\v/K(&RI+QgVY'lkZى|lq/OiS*zjiI GY<%ĪBWIy/k ־i|K)dz}q +}spN)+Jڦth2/]Y0WR]O+4]ta]3m.Ԋ. B`_W0F=dWFI+Wk/ #i%<^ӥ[^9Gxmen䴡B 1IC˖ؾRSdJDQ2QdD_lr9[qKjq`kLѤ?}T'ھW*-[f-ξN5 Դuee=w0"SѲUʻ3vT'^ێHN'sC_MFnγW){%}Mh-TMx"^WtE[E660[Aj'(}VLBRCOShi}~ 7e +endstream +endobj +622 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 621 0 R +/Resources 4 0 R +/Annots [ 623 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +623 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 502.623057 101.433071 483.873057 ] +/BS << +/W 0 +>> +/Dest (cb101-1) +>> +endobj +624 0 obj +<< +/Filter /FlateDecode +/Length 4869 +>> +stream +x]]q}_̏p Ly!%%ԭ]촪Q*KjI~~/bLדSWJ'w֊tѝ C^O9>)%o;sVB A9AR +* .* JI*ADAaV` $AF)QC5N^=Lu:vӒ.M{%t8M$l!zDl11XI`w芢(Kvr)!nuFEkzruQ$-^$`H: [? +wJ-$%q"npF qַI+@WԥI%.p]В"Dԅ @'8T$.]嬕w!uF#q0m9`uRL!Jc%xW$.ݼlJ\C(q  |)%.IAO N₠ p,Q[(dS b ؂ADS҈l\Dɦ$.c?J:o@ע.B!ЄXK\1%.O9\f@Iₐ` XhK: [dK\H:%.  ]W`^t>3J\O9T;M0- 0>y$.MlsDl$.f Fb qARI)ơSJ₤#$.(qA +Mly qA":؂) &IybI\(q 7ы)ALw]3I:."S/qDd+g2g3 +밶)jĜ=4YF/f B6P_c9STpX3c'0-}sbv؜۟O}{~S2eG#@( In[TLRBHlDHH Z\nH,yae9 to[ xHl͂dؾY Va(c!T*O'ub΁Cf>Klɸ_N~ӿFNOJ:_gy\!boӅlmk9eq$Ȗ&mf}:AU~YeҎt^ԩmΟpOk@(sTJ>wǪ_zز*JW7 s.ZW+Qjpːڃw݀D;-SY{s.o*4!3 o``g)vCP:XFF#ma9~ ˯_NCۀ>et]m_tKW9 98W!hVˍ}Y1@;@Lֽǒ.1^,sY}e}a8/W܇U]R9!׉32ױ:Oգc13.2|9񸜏e5mvX:Vu=jʨxdd}˨2:φ*s={ݣa|̨OJ9;t)<RGL-B_16j{Ѹ{͎Euαem;-q0n.wCaޥRLIEӧzӡF _ n}urv}m3Ĺמ ٔ{aUm,̤H=Vz#p"ib̼}Y3w.VPZy6D1Ϊ{OJ r|ewdy:߈U?;hjbW}Ōς˭>a̱U'?X{#v=rzϬvcT"pN;h| xӡF|:F㕓aʞ"v@oY헅X^#˾K:φ\:vka]nB1xj`XփuזI +GGPt9(rQ29G6g;rL2^2uih/(<RoĪ/BXh'=s|h֟p/9`׊5bs-ua9}bgy:ľ:1;|e ȯ6w@`Cߍ8#ݓNvW= Ǥw\<ߗs.m s;8|?lǀlgQŧGtqo8ZîEegCQamf{;mZff*Ccy(Wpγ߸`q5S=2R$"[p+Ũ&)B:OԃǕCukm]SlrA9؃uc6rokjW+N կr1#T㺷u :ԔNn,Uspnj3̶bs`#Y[(:O_cFiM I<4JAmʎ=8 +7Ҍ 9hZfn̯ua=Qo2y6$1kBO95=.m \jٕu9b}!Fm~ߕ2Kv[w42t>/vgA_:3*Sne%}gE*!*VuEYj?mg}eks +uv h17Ǘ~/}{͖`|Z7ccn`(S=wKgpΞy wwyuů_aspyMyێvr^9bse双 3s`[~@Wd|.%˸-mY}n>/6eny"7KY>Cp^Sڲ}W}lG?`q!Zw[k6و돹 >+l?ǂ:4.W}6xdM/=rgs3rc;0&)5~kM*.Ka%߽8<[qʱ0ލ)Wpl5}9|k6BG6mʼo bX:?+j,r#>>й M#x6SO8KcvM B_ue^tr ė-KܴQ.3.گ0e(4-s ۯ'_I)ΐQYutq>,/Z;(cReAH1_yG*hA9w & q.UktC삽bXҺ _ZW?W&wZ~v3ZȖ Bz+g&{d#Lq aox`xSbB*]\:߅t:͆5 5n("J]jSջF5eF&udj$.'AM٨gXD\$[ZsmB+{T=MP9^]؆.DZ9l縿 7f#_N.] +*вv8.A?ajVY~x +פyM R-wf徱IzY.B,J(In[I˘dbӠkeqW-y{>Ѝ/[Vဟcپ$Y8E-VQSlef$魯>O|(l0"ڮ򦫬+0iiZ#z/&:Q{~vbYOrׇmͱ|P'oPk˲g[ӧF-hu1ʤW[ +8)U٪ӺP4LUYk1TRqZLѥv|T)ۭ+^l sgzKFAy&^VٶoZ]W3; ^mJ>̝ΐuJ՟ ѱd 5`- V{pW,5rw빒mFJxOUA7@&|"VۡjItTP9WK%!wL~Ao/* Jru>)?? +& +endstream +endobj +625 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 624 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +626 0 obj +<< +/Filter /FlateDecode +/Length 4751 +>> +stream +x][ʑ~_Qφ#%1x0ƘekN,} ~/RʋХx.E%! +?iI1zE )%fYGwՊt]b CH}a__]>fHUdCPNP%ʹ!㼠z)$` dh +0Rt +f1QPEa)hV%a&I3trAPi;QJEdnt/|L&FY;@iIｋ`KJK:[&RAybU `t芢(Kvp)!uFEkzpuXQ$-^$`H: [?;wN-$%qop qA+@WԥA%.p]В"Dԅ@?T$.]嬕wuF#ql5 guPL!Jc%xW$.]6%.&J\xFiH!x |Ru~ ((K +$q!%.Xc$.e4o1<-l(qlH<1ft-"t:H\ ؊E/q~`wI& B-X*`+g.4l-q<]贖 oPh"L$.XC-Hq%.v%.2A u4!q懃m'qsDl$.p%.e$.69 $[I\M4R$o(qA +&Bs]Z޹CX'g>dx!TQ*Tuv6Oj]rÃ5uz;;{÷!]%}r5T~˾obAZtGTx/sT0Jm(A9Oۍ(-#H]=S]ֲóp y a|6ϛrK'xhf`ӥiv}Td'͙g2= =׏Ee֍OTekέ&b,:+{4}"0gH)y'g7Ep<}0|EUBW&X(幟jeY%}3X=5rΞӪb[X&m®{_FA>:^`=WI٬f y76sTQ?΍8*#e⦘Y!r1E{dNydRڝ3fFoE̗$7fҗ/ԕ}ڞK^3,ڭ, {C:uelC{(Ä.v2/lQfd;يY;j +;ޮ3mg2+ڴ΂msD}=WSݍjw@u#\C*{Zs.qb+ĸmn_ ,=:q%MywvLu{c{ܳ*fk1:O}-a5]zd4;}γ+82Pa^-n.^ֶ5vrO-T:Ssu~žsyfO׻vfw7R+>'WWfG%fV/^k2WOy:dk=~olj(#xsuw[p%mu.]gb=}Hչ\?Y'U`C.CfD_M\KhR;qŵwm̮^4.:K۾tZI ;su~ƭ2u]kB?o.ʱk~}b++ziRw?>57suyj 3;:]wtW Moe˗'N;Hf3jm)c<)Ϡ랼Vs*:(ȿzZ?ee-eUrthrg#u }᜿yt(e[c{VJGhQNy:g*"X";#꽘3?\g?v^unvOpq1k5G87o; g9boNXqae6գV~ˢ/yڮl)u∼|y6׹:O99#.U>lϜŽqPme&ns+3V|ȓu Q*q|lf9-@? ·8Y{~UUZh0qNrgV9@\yWx`[hve㕝>.0[V<+jLQGuяmZXdo~S; ?s83=p־a\9մ|:B8hoz8ҕ%]I׍a?R?D,OLE'xyQYM9h 1`NY8}T-ҥ`aH˒pf1?WΆRIacǂ5^ՠ'16+v:~j/lڪNBuĆ=_P7a5:M)kB7{ڥMzJSet2ԕuBΓ ]w4M̪f_y0 +crDXnjՙ +TlUSfJuYI=Q|=@k;ܘvqTWb]\JB۵[Q54)_?ai?0U)3OB_ЎZ'6x>HW!i4V.Bl?^:*(R3!:wa&5*z!~_إF+YgDJ 1*h~lX5U^-WKJ<@H5[&5(sBΖ J~M6K^ +endstream +endobj +627 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 626 0 R +/Resources 4 0 R +/Annots [ 628 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +628 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb104-1) +>> +endobj +629 0 obj +<< +/Filter /FlateDecode +/Length 4941 +>> +stream +x]]$}_QφG 5x0YkmL_>#eJTFfe5+# +*}UNHz1O/j +N_I(7V&C0L׷ .y~q:)%okVB A9AR +* MLIR V`$ c0RvJ0M +f䂠 +vh!At/錞|L&FY;@iI&ｋ`KJK:[&RAybU ;IEtEQ[WZ%;D]N:䢵Ji=9`ӊ:(t\uYe$-Ip6(VGUVK:[ $` :_ba +^)&!LE & +J4`ȧ U:%" +8X [#WHk` H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵9El%.;NVG+qwVAb Ыp%.V&&*&` +uax84A)#qw /q2 wA!N` V+q +  xW'L˜[M:&/qui-b:Ѹ.^/74:?_Z:754X(0^]uҐ&#t! =_yNڧgYc9u&;﬷Gy/lD5xފ`qA¤4M/ 6"һ#ytȱe +=>esڗ9u[Nk ]+N1p`K煝6W 9Z<bړywٽYsy4.kF8. z7jAs'NgwйY)X$xA2IONy:$߉c{r6qˌZbaE}ŷ^P1={nzkX4qXԍφ^:Ϭ8^߳|@;@_HeGݺvP(=Pz"TO0{*Z 2i+?6,FU4MROy6_wvV^խ}$'ܻ۽`Oy:Ǯ^()kpvksZg]3C40ּ2D!;B5{]ߠcAM[#+eFy`k'g~dOy:ǯ#;J$ϐT=?Cw@1d|QAf\lAfW2pe~m< zAr|y:$ǸVXn =e5pew^7աUa=h,umӈvyOy6Lӝ]a>szk`XqFe;}7]bʱ~޻;- Fc<#a +V3 +oίi~y:,vmOtԙ&B m +K9eUk|{=XOK6%/kKOOOwhkY <<ֆ9R[6_oqp٣͒~)fowFؖUXgȏ, -3v;vu҆?*ž=,=e[o3"_L+\~O.3z}X|e[U:kSՑ1١z[V}d-ؖEOBi_0|]|Qmr,s .R⿎%`Ó^ql_k_>jCqV+q|g5oK|f"|4UWƂ^C_/Ιwr}݃;xԚ6]Zzᰎq rRxq^0`*({6|2Pi{ .qUG$ }Q#S?~'&;>zzn6UFc1pņL,jXL\05[ҔA0gL9k=w20cFs(Z(7עαF>i˲,eXڗ{ǔb +1'=IPeyLh;?4>HzX#~Pػz2!>cJr;7okN@RGҾ]Y򤝑{;Z+G7vIɅD0C:]Z_,,E 򪈣]v+@#jenOT 4nRAސ?W[-H&ùbA^oŹjҋ87Cr)Cw*&t[bujg6.lsi5 ; MkQջF5eF&u5ej$nAE:Ysuga@.tv-S=kt/n쑜leǵ8?5ZE.Hⷋ Bj׹B +=.&KCЬ|*i +פyM Rd~+cNrX$h +=-saKG%ϤR7eLR5/T#X75qƕ\]Jtm:*ݵr7|z\c\*Fq~tQm1a7 ŝFߊN,cdҌ{R9cOx(K_i~߿^z<4n]L#'̩6l.ֱu m75{MB}ĦAh<-־|ikj.xsp)ʊUNڧthɰUe+33 y%~]as]삅vi]e, B`/xyie`}1ڛK[ò,ү/ۜc˃uv,{9}hЂVL{%R*E TC/٪[Jb. ҜxM\nZd[8Co)[,繛zJ[eۺi]wm =2U=ۤ|;saAJUN`zLԤ5|נރC(]LȶFޝxd#RJxM莉UAoMx"W7Jْ>[Af'|mX,B2b@ޘ((-woaI?hl +endstream +endobj +630 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 629 0 R +/Resources 4 0 R +/Annots [ 631 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +631 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 311.373057 101.433071 292.623057 ] +/BS << +/W 0 +>> +/Dest (cb107-1) +>> +endobj +632 0 obj +<< +/Filter /FlateDecode +/Length 4702 +>> +stream +x][,~_Qφu am⇁Oʹҳ0އ)+uIe䥲aOӧ+#t>} +E*K*!zG/_/Rx+oH1?۫U{% >Z6/4j^sR>x/-PIe{mrJcT0z4WyA1XN3H0䕙"^*ZϨJK`$2)+q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t20ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0rYl18.0 M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]c0* kxHs\^X:qwuqw4xW[7swjҎE$ wA!w` iq +n "?fL +q\`*X]ʣřqVʹqb2X.3p\Q5 fjNU:J ,x~p +߄.B8.]ВL c!r\#+18$=9._-3 ++zӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*x.` K,I_._~F_^/NӿV_Fy_Y[9Mg/ְ~e ;M*QwS8 6.]uo]HdK;e+4mBK}Y+kp]PނY +Ŕ6?.{#Ïzs>foC;leC2^1&s˘yi՝yN gwAUnr|{ټ:(m7P3P}է}Çf^oSdphc\g_Fg՗ܽڙt]?n9GwAKhgdt-t.ՎGl~ڴeoOMoehNJQ/PJ-Lhzz]u{E^V/rY_}ڬP2-bYOVQG[]ַp/9~};L~Q|3T#: FxƿA(CmEv9F r[Nn1?; +Wd6-K;m[w(GI.v92qwcx+!!Jmt_ӡtÿܻhRvҪȏ]h(BXںvsÅU갚bpufIbI~RzX&m]:9Xmڗ{iPu-RpGްy`Eڙl h7}P;.[﹏ΎzӔFFL+^ٿ*Jpgӡjc⿘wwqDmt 3鐲+~3߸{.Dgյϒʊ)]7V-ض#.Г=;9ZkoG=gO^|DlI[@jٲZHK.jѰqFy|7;F>_lvs:D{ȏtw97Ӆг>l嚲jܛN+˺Rc{yN}Opsqރ_W};i8@ug!wZ"I{R\3E'9}w#IM~?Ǿ#xν3ِ7|w̭hNZ m煅{KmW =s:>|~iW;qw9}gWS߫S,Ljfyzfr{>#s:}٧G"U+\]$EXQhg!9<sH~XAo͸1~xm=L\@o}b37=jFEQ2B"~wܰ6#~jFjcPz`_> +endobj +634 0 obj +<< +/Filter /FlateDecode +/Length 4899 +>> +stream +x][ʑ~_Qφ#%ˁcX0Y>L,}࿿_$Uw{(4=]KdD))K_~~/bL嗋SK.2 䣻 ze__]w]G_͔7]YdCPN`%˹)zSX2eA):1Ș("İݲ0AĂ: (% "Fi7y(K<'I"/xN>vZ{#Aă,dcxXoȃ,&+d1Nxȃ,+-\D"/b[QnrZ%|ӊ<(g W.<2BN8bfmAc<K`\e%)3uG?2h1daV`m?A9$úh'pyD~ +#(cGѪo>].}GD4wO?}Oxৗ˟M)_7TAqʹZFrV/4Y"mr;fyl׶[Q(ȝ:_~)XRfu12_aԗ A_?.3쒤yCGC^|{)=+% R88kFʼlaٺbN\,c;ǭ=inBcq!3DVm A61[~o~Hw,횵aZݝ5~tn-(2eYM<aiw_󱥬 '۲||3J}QYE2LsMS.<:Yf^6~ JkGJannW.sԬlaՂC~V-^rيʍmRnlW⼊.mt׍UwZ|%͛/ʴ~Aݷ]glm&vOGVKU׬IoYڕwVe\+;6ۜmS:oJ?0VuUDSDRkU f#0I%e5tXK?i?hlEZt/G);ދv~J6jh7PC&?:E;oC8> +٭cnrѴl;o<ˇ|yT 4O`EBu7]ZǘD|wz^^p wN̾zu0K+,蝬$yz>~^c~I2$ШXM_>>m=Ctc=#7;5c{gxΪe!~Y|oKSJ.=twoZ>䬁)͖Msuwߤ 0_<\Pwo~+[6xcI/;WI۲l}Q{0ٛlej"#go{N=z6G~M+2+Tzj2{:^!luځ5& +k36㺺|Yefy։3i_u]Y;3Oqqߺc=!? Kgtiw1tԪzͭ>?!}gVy/l93)G=f y:/</VtUFV|[J#5Zw WwQ}YW8)mA x'<Đ%Z,Y|ڏ-lpGZ#~M ޜ;D7 +iz{:q?w\{zWzǺw6?<8}vgo}*x#1b)X:b1߼rpG4:O'īE9+J &~tG/={>_SZ=0RbNJnBIyukAdoW£74n~C,V1~oyqMz +bxoTۋ#2ss!gҤ˓uf ]W{>~;ŗ!N?<쟾#<][o{a-Sw=ϟ22N߆qx8KMٌdsѽv;9b={L-VD 4EQNy6/N%iGrH7F.iQPaUnж;S`o kq9[)8hi;ȁ #gz8gN CmX*>L|ϯ+Em%G-,ϬI~p跦k~4-\֫y|m=NPk밵j'ݴCy r{ϒ.fYzf>Zj9^|x|}w%N49diєF~$ad&.Umt=[n0uZ>(qe4\ߕj|R3"jz%դ2'\* +YA˶[C#-Qu5"<|#V{ 9 #UХ]*vBJud5U; E JcV~g5>Ys&HT˥RN .b5W-jت&Jsu>>&9l&9"*v~c6QzqA(V(W\'ڮJKr6,4>U*#O-ڮZ'<7+y+ꐤMԥC>KG%gЭVNe="T5YWd=Q!]#ʯ+rթT]m}מx2 6t|OqYGlk&Zщ|lLZqo^2g3|=,}sA:nTE SuEW2xߚQutDC7+Pqc:V]5`/%uEP]=5vdS]hiok ^۴{ep|VZE?\ƳmIvM⊋%\2]E\05VbCTճԛr_EFm?eW +endstream +endobj +635 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 634 0 R +/Resources 4 0 R +/Annots [ 636 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +636 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] +/BS << +/W 0 +>> +/Dest (cb110-1) +>> +endobj +637 0 obj +<< +/Filter /FlateDecode +/Length 4913 +>> +stream +x]],}_QφI1xp1fL,=2%E*#ީ1{]P(R7%r |IM++)VEF?Hv%OvӯN_g3@*gbT^Pe)Fム +zBsT0GgVaK*I* 뢶[U&j'`> +*`6J:Fi?8=H:ɢ.BtN!:S'I`JK:[vNI:l.uŤh%]-ɂ.+:آҒ.䜨ЩVg|VI:'lZQN +QϢxGҁ') jIa1щ:؂Ηآb(#h"^88lD&%$0)O.F+р~r!G-UŻ 1հa:b؂X [XZ$.[oA …J Ƶ)8 ,(PXpwJ\`AQ ֵ> ,h׺$.]봒wENQ[` J\V(qb Ыp$.V&wMRN5SƠwGk28q&H\L%F]P=tJ\&Dӟ0VN9H\:D]tDžq /O:,qbx.3I\0 -8D̙)R#3Ct=I6㯧_`=_ n[E4TW,!#bFjFFb퇕0LGn`D# X3wirD탖mv_Iޝl[3%-R 1&h$ܙDfCx]U|:+vGAƟ?xw?}z=?o4M_wYrk:C,h^33<׆tkIGy[^Rg.#Ӿu`ŖeiL?O;2%>eDze_\X_:3(\i`x]cY9lbe4nD<(!PHZ˦ٿ*(!e y:TCrg"!p )_s5 ?R."{|a%L0!FL3뎳~뵼5C%? ˿;|#Vdm)?X|,f|ǡPsXZt{F͵6Q CD{e4y64폷M^*k ?_/j/ } r8v=yX?B:c=Oc[^/촍eW2b<φXw#|q#]-ތZv@{0ӡz9r֑Y.o=ǸFtHA<nĩ{0ӡzzuճZU zfFs:]yvuq: jBY~gm#Y[(=كy z:׸M + I7?,y__FK:^ z3[Q2و\n[G7;:l^`j|Pҳ[3s:WDZVm W|>8a ԝcX)wtx:bO7k;rϰUs;]`fS`Vw̷7~lzqkq3%WX._W9qV.e7WF]m q@1F8: tr`wSܔЖo,\ƥ^(ò m +sT# +o.P[%'p.Cۇ){? LyUxk=4rΖSs-7jk6:ةȖr!rSդ1'Mv +&:3koUU{4\]Y״&&Po^ R5,3*7)[OrߨZCg6=5:} +$N]Nb4z*TgݔuZ.l'һQ~\iJ 7f#䣐wPB -+xR:qYet5?SoRbA):_Jhl6I\8ŞK0c+)s\#j놺&& +i\Ʌ7(N߆W}+C7.5UeK(&ZIf^v@ +]ihmT[>A&͸Ne3Zq}> i~=9ϰ ?e'DLNGkly5J!C],ĶFs}d#RJxMY &Ao+XQr&a+ӜL2ʆPTZ +z /*-ȧ j\ +endstream +endobj +638 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 637 0 R +/Resources 4 0 R +/Annots [ 639 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +639 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 108.873057 101.433071 90.123057 ] +/BS << +/W 0 +>> +/Dest (cb113-1) +>> +endobj +640 0 obj +<< +/Filter /FlateDecode +/Length 4683 +>> +stream +x][8~_H|)$HaB<BH }JǗ8N{vLʗsY"!D `/H\# )/qO +:|ve:B$.c=$k #-.` "SL6D$qAp1ft-"t:H\ XK ^0:M[0T$.T4D\i'[xi-qA4ޠD234֒hjIGיQH~`WQ 4&$.@bI\X:bI\f Fbf )O₤nq蔒 ! 0.y%.HVa%0n $-.-p0nIXo$-&{^oF f` ^ D^o1\u $LzW ^+(F anC +܋*154XYF/F 0B6P_ck Qy!`Όo2aXJk|_;3&}z)?˜g ޷[h '-WR5J fSB$ں7;l_}:_Meci9AfѧN?oo\|z=}TʽKL.0\?8pvc+_ϟ~ixء/46-%-gA"X4(Z־33m=51nN  }äShwʕ_\j +F!n ӷ~cmi鳛^.ӵuTP.#ӎve|!Rl򰬯k=KFH*@]un5 M`5K@c'5/t%nBzgawf[XM7\Esw3ojҾL~k#uxMil7z,fuՕqxV2ʌ1jv9ʪٰu.ԩ:K[^bh zFν6C¥c׹~Ϭ=6YЦr:T7z +RMt%hJ֩%g=3zuX .sF;22Q'F^͵>)OZyOB+t9rO292MOp|5} j^WE + +G ʑgF 5HX㬗=p ={;u5ue2/l\uƓ.}l)G#73ѐg7|Ⱦ'ükzv1|RZX4?cmLWćFw^O>jW IE1ݗp+s ^ljw-Z>j|3n2̂O[<>䞕ܚ9nw܏}ya|g׼>gT׆;}λqG;ush&ugn tÃf炘#:Ġg,my_ep+5>)/Aq?m4s84cמ=z<ѻ7WjGxrd{+E^k1S +2Ww927wUw7<&6{8Mmv_áv#oxϪc\gb=}Hѹu<ߙhuqםύg͐=萹&.%XF4M32:z:T6fϏv|/#[ڲKVy ?UhigBoQW+=BK pl/TbEO}41]GR}yv1օ=g~GJдhy{tI_mDmR[y>t=jcanSAǗ+ +'̷ӗ>7P֏]]s4}ֳvV)$E_gF +JGh(;UG[mƫ^̙(Q릧;.k[5<ݝ>\Zue ܛ3 Gy`Xrt'0޲w~}iQUeѦ| \?ْ9+{܇i^|s8|mxXqWwYx}tvBΗlLW2cvGs4D>ٿ*sJpgájcwwiDmၨrAѽy _?wժM|ƣ |ֽؙ͓p]o˨]+oD{ 3И6ӕЋo}5e!7+˺R_Ǯ ods8{wN?~2i_{3AN}-} ֺ3ᐻ3]44qOK#}UpݝݕG~#"={g!uW,}{n}/s+z{~PLGìVm@<3s|7<8v<«ěI6 |z~I"(CL/O0WJkU޾h'WucW]}]ߥyoyyʉ+39??o^>>+Mu7^r.â~< +=\2|C:IQYҹذs<ǒj:#RQ|dbJ?t۟z*~;y~$S*e CSZ7c*󋠯w],ʉxbA^/|jГD|1l3@jkMP5Ul3tJ*,MiMhrBR>-[ר"QH]NY:J? I~rф,<0f QIr:At9\PRŚ5喯TX^m4Iڌ1&C+UlpcQUvrAH*W( +mSnGUR C34JHy +DzU+YFj徰I-)ԴMs +fQ tKb3id:UnۙϦ;|Vma 5_:ִ.4|M5ĞS h[m؈MѶiwCxZ82M6|0R +2VS)WNВi2-MZ63VR+,\4n_ڪ:ͶEgxMh &VfF?<YrIAgxK HXSK<6IIX0I#m ++ҤR8.`HX/<$ya!i ƓB*a½' 0D (HX#M)/aO +<|"OvdOpj84)ο[~ic er=pfovn,4"}n1ç>([ٮ_Em;GgLW?z?ZTgq ^-6k^JGG_-#3ZPqӴՔ_^y-&[pj 46 +_Ϳf6n%ur +ӭ1?FɆCC;X ;K޳7Xx蹝RG=G}0΢";k8xj=5tQOƺ#nn]BGmFr[{la.p5{hʖvgܑ8Vv1Z^wȲ?fٹg~Ḳf\:Ƿǯgfo.ߵY[/픾rK/өQEJF*ewF1>˽{'4_sBgx,#."[̽`R^]5rKmwmx0G2́˞8֋{ދ-J@E>L:Xd5g>CA*/!R <eɎ'qMd{ÐSY\7zBRyb3)y .)I7gW2 C]j 3C0uH?b`]j_/ڈ>)UMQ`{gmZ&~\M?'26#Nt.Ʊ&/o'k?΄%֟w͈~2(@7M9jȱxG7%6e;v/r#2N=uViuP6Cܬ5\Fz؀"l  TPl_Rz]j*:ߒ'+D(G'!)ؠ\| h68fWiպ­䧪֜ $N -T]= Sz!ar*b7a w=NWm8}.pӠbԌ2dmPC~]U WoxW' A9U>~Z>0%H^E,OyWkdцWqN%ӕ#\|ƨIJ['mE[}P{a)N'\jf~xW0ɛRzJngnUagDlk 6l; gVqwHιLo5Us ҐYD6O9V*ϣp>EC;[" +NNidl'eA!ZNB m8.`DR9-r"F=~㮇ߞI>(M)A0v%m +[B/SY,Ͼ3+mnQXx2-CmEj&o?3_TZ=[Dr~ECE2l|>J6|$ß8;%]IgN|/Iq|Xb)Ko,29rȯ7>2QۤvBfUնHם +SKZ7kgN Wz]3*l>h@DMd=g).W| e[)96UwF6T|^Uo*z: )kB7GǍ㳑*RT.҉BPR])Y8 M JQsfb,D\*&[ZsuB-[T4DincU@{tGe56ֱFlRڐ_o.] +D۵[Q5{i05 O3TJe_K5> ]ܬ䵒zC4VSjtTByZjlETC*1HUXuJf+XUkdWMuEnr:U73wWmd_':⚏uv;/Gvl4cI# +H1z(4rL.S~|&q߲3qЈ^)}2?otc9oFU0[Wޓ"ϸ/:m:YVk~ܘUW KI]TWnOtMT͗M3XoK[:W|b +}wp6|m.\2]E\ⲻajdoRUS?]ta_ƣf -+}ä<^<ȾVhמZ; +x2K>2yj[{9mjЂVvت-\S*Mp*b(2ZQKqjLѨ5QJtMYnx-ޜCj%k,kW*жwݠ&ojܦ=sg3:HV+!:dIkl@*z !>=PF\xd"RJ;a8&VIt*Jإ)@X +j06+A|W=P *_FcAi@~!O+m +endstream +endobj +643 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 642 0 R +/Resources 4 0 R +/Annots [ 644 0 R 645 0 R 646 0 R 647 0 R 648 0 R 649 0 R 650 0 R 651 0 R 652 0 R 653 0 R 654 0 R 655 0 R 656 0 R 657 0 R 658 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +644 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 416.373057 101.433071 397.623057 ] +/BS << +/W 0 +>> +/Dest (cb116-1) +>> +endobj +645 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 397.426036 99.933071 378.676036 ] +/BS << +/W 0 +>> +/Dest (cb116-2) +>> +endobj +646 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 378.479014 99.933071 359.729014 ] +/BS << +/W 0 +>> +/Dest (cb116-3) +>> +endobj +647 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 340.584971 99.933071 321.834971 ] +/BS << +/W 0 +>> +/Dest (cb116-4) +>> +endobj +648 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 321.637950 99.933071 302.887950 ] +/BS << +/W 0 +>> +/Dest (cb116-5) +>> +endobj +649 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 302.690928 99.933071 283.940928 ] +/BS << +/W 0 +>> +/Dest (cb116-6) +>> +endobj +650 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 283.743907 99.933071 264.993907 ] +/BS << +/W 0 +>> +/Dest (cb116-7) +>> +endobj +651 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 264.796885 99.933071 246.046885 ] +/BS << +/W 0 +>> +/Dest (cb116-8) +>> +endobj +652 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 226.902842 99.933071 208.152842 ] +/BS << +/W 0 +>> +/Dest (cb116-9) +>> +endobj +653 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 189.008799 99.933071 170.258799 ] +/BS << +/W 0 +>> +/Dest (cb116-10) +>> +endobj +654 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 170.061778 99.933071 151.311778 ] +/BS << +/W 0 +>> +/Dest (cb116-11) +>> +endobj +655 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 151.114756 99.933071 132.364756 ] +/BS << +/W 0 +>> +/Dest (cb116-12) +>> +endobj +656 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 132.167735 99.933071 113.417735 ] +/BS << +/W 0 +>> +/Dest (cb116-13) +>> +endobj +657 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 113.220714 99.933071 94.470714 ] +/BS << +/W 0 +>> +/Dest (cb116-14) +>> +endobj +658 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 94.273692 99.933071 75.523692 ] +/BS << +/W 0 +>> +/Dest (cb116-15) +>> +endobj +659 0 obj +<< +/Filter /FlateDecode +/Length 4421 +>> +stream +x\K$I ׯ3aKB+J4bEZ8*WeNOҎa#3˝-~qٙK|tdM +jEe)d+1OBdR > ./?mw]8듰L)٠ +X֑ +CTX,1BbϷ1䠱 {V-@ k,JH +Yἵ*Xf +31_T^%LLxCx YBNx)'! E*H%⡝2dueYlN2dfW9[Ld5s&6II1)<Y EA@k<,rVՋw%d>ʃ,| |,6E AFpIYp次pJ/p,I<4 YG AjXC1f]@Hհ 2.aASyŸ+~ -cѰ wHÂ|f kX5pb5,] AqH4,@|3tU^1aAf K4,kX `aAlJJQÂX,xHT^4$ Bd<‰5,@bm +aA򐅼װ yȂAd8djyY`.j}@2 )DcЪƋVy<4,H BӰpz F% x5,HU4,@(2#3x ְ.xiX=dA6aAUf B5[3TQ *M ʃ, ?Rl PD ְ g/fְ gװ)fҰXȂOÂb4Y8xjXP\FYԛYÂB&Jo.+e/f^UȽƻґ;~3T m֖!:Q =w}VRz +(sM~fIъ M?@{3ryG1:E>>^ ;'YGSۉmԦўyݑ8o:_ʑw9Y;&S#泻;DkC9=aL5,Gnby?m@ǡbBaܜ؀C&[bQ܇ $o{ae'.ȑ="9Ya[ơ.0<okag6M{VJדNJ?(ˉ3-MpnV,.d|Q)eoRﵾ6Kw&F"vg;KKNQR$;xb̤obW >7Wzxy5x,6R<蝇̲+-- /| ru1gId}]ɚ‹K'm#[Y!I4w`ƅ.o&c©DG?m6=[LfK/ +|ϯ-Kgy2i{`y +d)j}|%UZ>rPtWXM>dirVzǤդ6 si.9B|C9Kz| ~<tVyۃ6* Ob WO6qgX]lhIdu5֖ڿf;#7q>:R;Y\+jʒ4Qmo'l9)%r w~.<ُCzBҖ5T^eV9CjqrTK^JjݟNzy;ĢyEAo#jnVcD:Ki"iD&NdsZi5m%vJdž ,'УyHĚq;N݁U0ȑvꫭOI2gsX[z.V|߂E'wyWMYB=Qѥyr %qOdrSudumM27{Hm]GJ(}:-mup])zwC}?]۝}nk.r<=ԙY3L[Yݺ6O~+yէ6>odi~{ځ`Xe,H_|@p Wti+~ tzZok[^oӬcֈ#r7z;ƮcuNlG|6ЛPZo4~s_ƅ/}uNz `~g.}5E~*|߇㰽G;WCΩAUw6|ϻ9Y^y0FU!gZ>R߰鎆qZ/XQؒlig/ȃм Ťsoy^ݷͰcq}~>僧d$Z}]ݲٞ`H (LwMSøZze*ķ<ޭ) KݔT#gGo9rw=u#9w\vgw5&5|{m?b}Gdmy" TF\*gy/+[b׶UźG~/HV^R6kMl|[ɰpM~9ɷGBF~},vp.{ɔ-v8N $;jhj߮旉"zFwK[V|G6^.`w'yn;w [dyc{b}ViG 5E{iNIҩ}mhfvkB͐+BvhTZ()w+tJ+&>nr(n r +=q_N!) +Dl <|k6{&*S?8&%1f'o4cG48\Jfg}dQ ]cꤲJO@ǖu@XOʙhnC7 y'n2رe&N^q'oK l|MmA& 0F_*ykG'q8q/O5y +^ +8mߝr^\⸷-| ydMH YLDˣmh^n#ܙ'M +-DKfДpT> +endobj +661 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb116-16) +>> +endobj +662 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb116-17) +>> +endobj +663 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb116-18) +>> +endobj +664 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb116-19) +>> +endobj +665 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb116-20) +>> +endobj +666 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb116-21) +>> +endobj +667 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb116-22) +>> +endobj +668 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb116-23) +>> +endobj +669 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb116-24) +>> +endobj +670 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb116-25) +>> +endobj +671 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 567.702842 101.433071 548.952842 ] +/BS << +/W 0 +>> +/Dest (cb117-1) +>> +endobj +672 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 194.455821 101.433071 175.705821 ] +/BS << +/W 0 +>> +/Dest (cb120-1) +>> +endobj +673 0 obj +<< +/Filter /FlateDecode +/Length 4933 +>> +stream +x][$I~_–y"00g"g_d%*̸ٳ=/̺w$r |t|RS +>џrq:ϟH`71_Nguȓ~'41gI3|tmUfΘ$̰.jUeav +f죠 +vh!9kSӃ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb,l-*(-鲝|NΉ J1muF'kzuQ-A,`H: [$xۘ0Z nt-|L-*0&%LI$`\rIbb 'rx* X[ X [F-6; -H q8+q:E u*k ,)$. \$.`\r,qZp%.`]냑vKA ޵N+ xZu8Yk8.:A`e2)) x$$.p]18a Z xx4A+#qgQb4x9- X 0Cg(l2K$.]1 cl5锃OIGx\Cx.&*+q> 3wL-d%q"nF qI+@WI$.]ВD @'8T%.]孕 wC#`MF5a +c BҁwFK:R1K\4mJ\" LN!)$.YAOԅ ^₨ ,Q[\t Ih`5Fh` B LY#p RL6UI̔"Z%t F7a*`-5% z @K 贓 f؂"q)DN ҅Nk -%.H&a%SL$& +%.0JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@seg@F7 `&V)VJ6P_cn ߢ +CĜ"52cX8D}1+|ge6< R4zd!/'D+M װ]"QAb_rR4b͚Ƥ&~9aJ}O;0ђ&U H~DGe oT"5ʊpӪ`9+c]1ԭK eWyNaneNX(C("RL6x !.Gҫ4m +R2PB؇^rB]:=ޑ{ydRN?m$ȫm xc1y#~|om9Av_ye@ 6 9( t&gsʢѝML0\Wɳu]>T[= +k{A<_VhmiuQh7;[#: g5I4hhvNrK]Vi[O^)JӆU| {4(-W@IK}/w=i`J;lhmxD-*߮Z~jߡ~7kd{(kZTQ>EW[G tQW+朞3U_e-?y6ᵼZtZkXBiYx% 4nvLer/p<'|jUu遷c +vR2wI ԜW٥} dOڇn#W>v3+1"gz Yk+KuO8}e&i務|8WJc{$(ЅYhG'DQ+賆F4^Td贶BrxIV~JtsYD.uҏe W+aR.pZUئ:Uk%,|AJϷrT AVn3J]؛2B{烽!qU3/î[Vin&yX9tB K51b}~n~_k>`Z$kk"9Dۤ1y0@rיs\UZX +a岕lt%I `/Y[Wx3=T(>.ѵ"v5nFYVΓtkVjgٔFqc8Arys6h2M9{:XVqx(K\y շҿH |.QEYχo7|f ڒȱԻ.kh;A6~7U˞j+ֹƶ%˵4cQA ۚ/Vcmjf I7J=%.΋z:zPw%KYsX#4m7vBy4ˇG{c(ynjhyV3|'m r$Z{|0!r-kc(IiE,B5"宣Em)зFYwoI7|$x0!y?k5O%u4pYIGMV=}efN#f$.ܠIX}ÑWDWК^<Zcԟ.{6[^d$G?4@3ʣ -5j^ѓ2#[s0?\H8G2+hVB۱<:Zy~Pk~+vzPڱ({"j">;zx?>[_R׽7u&γьcHT/`t4TUHR}biu ZR)yRݗ|4(K*܍y ei?v_WteeY9t&T.\WW􊽼yMw"!.d:~m޹WP_Q<c׏ȼ{qCqyQ7o2;:p0ϣ'oЁ38VZ_䅲Vi8{sJ[KCmv?/K=gG3p<RM6(;lv{_> +1<Y_rj_agp^=vĮ]=s޴v͡}q<BΗ.Η޺jwb+\8JhGry(({ }gA5ͷN`Lt-"="fp>P=|a](^fcu9_{{B]֫)6iE;Me6U͔G7{$ < Agq7ԚroNe77V{7b^.mtS(-*Iz91YIY[7X}sOUB젦\:Ig7 +=T'Dotqعȃb֟tB]UJ'U, O[k(oINDڍj{K;B?|ĦChЃ6xzY=ۃ14FhLFJ]-*mE Tc)l-IR1Ő{^NW&-f-y8ZFK&Ax.u#mmnYwmϬnFdF6I*{(je'DJLNGkly˫J!C+:$\# 19kU^ل(m+WΖؤ l > +endobj +675 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 548.554475 101.433071 529.804475 ] +/BS << +/W 0 +>> +/Dest (cb121-1) +>> +endobj +676 0 obj +<< +/Filter /FlateDecode +/Length 4764 +>> +stream +x][,~_Qφu20?1fه6KaB[*2ϔaNӧ+#t>}2U**c +^o?\~HĿbuopW%mN% Br:Mc˟~u:j]TֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%- + C5(z(g[k{6W6ڴuuEО%Kb؃YyDiLMAIJOkbYovO?\~?}ݧ?.oQk׹r}+׺\F$B"4E*j9-eڷd/K9]TW~':Jszo+VG6Z_]~i !䞬GF^ZL {kduTi댦b_*=gd')˽Uz>n~QHym8\u}Ď%zx抗e.,w=HiObW ҬiVs;eKrCΌ0Q#+e+n}l1BBMU{xcn!w›< 1dMb!ɦl?zT>fp|K'ܭ0y!m,MV +C*vG'ͷ%jL(y{֞΋g\~8Y͝gczSiTMaP牶Ly[8gGzvF uk+Jh*Fy.oq둝{}N=5dYc7ȺomHŠ +(h_Pm'_<ِGϵ o7 *vY)M/ k*oAE_/m\wg9ݐcwm}$hf{;~rݽU޺4j,ddTLuS[<@|,>W1Lmcmv BC6TlBy:]><㹗_Ρ}Y<(庞G[;6*9Zrx3lHj+xbܳ'8M|e0G]y{>$CNw<ċgu5di_:3\_l)a!/h}; u2ӡj?x}/D^/8&wyQ^qX;:p2ӡ`鑝3{;8eq2f L+۰97a}d=? q@Hݧy `]NmPvY7[Z;@w2ӡ`=K֛Nΰs)&v驝}ӆڙCg8 KNy:_'/=zjw\c{\;I+Dhs2! ~8FG{=ϊ[M[-sDs ~xklgêa//=lgy9Eu>eq:W5a~Eҡ&^5P5˗E8 5/qXEBo~6-Be :?I*s[Ջ㩬{tۏTXPz+h(+Iv wrlis7%d> -8z:L2bkqb d70biNi\=l8^Z>-}j6:ʚ3ݖ!rzKN”+LghǴPn+Cu]mGi|6ǦSC״S՚YJZTm]- F&u5e.Y̦zN]ɶtcD ZO*|7C6S41"Mep76uBo&KdfѹBIye~+F徱Z@ͥBhKEɤ'm[C yDRC.-23-Cvu1btƞ$pcVVG2YePm%[m|Ǒmb.nֈnIKVע% 79=e%##c&=mv]w6l7TlnCVT'؏ކ*m=8b쯕lWDZXCXcdPx PcPT<>[-=RP9Y _P5}7׷S)i#u|Ž +endstream +endobj +677 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 676 0 R +/Resources 4 0 R +/Annots [ 678 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +678 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 570.123057 101.433071 551.373057 ] +/BS << +/W 0 +>> +/Dest (cb124-1) +>> +endobj +679 0 obj +<< +/Filter /FlateDecode +/Length 4781 +>> +stream +x][,~_QφI~e` /~0,}zmxJ]"QYY}g]BOBL*|_rzI)ய?^~%z%梨ZxCI`71\/o/oA/Zu;|$pn%nzE#%0;^Z {6W63uuej"-L~0W4Xax0 ͆O"V>mTZXw%3hӏ_}鿀Oo?B73=>0ggP"-U_k;7W?[=e,e4{4ikW#(;m>iMR?_?O[uOASb\/?j9BmrWw5 ^nRa9w'֭۝ff]4\B1K6+j!Iw?s 1M1$Hކ'ZbPn[wtUή# QW3XeiJT[cwZJ@_v3kqh8V' Akod,%|ȿ tb_Ni#;Z߰C|e#u +-Mu0Oo-be'_P*mB; Z76~6v%z4)e'y˩Kњ_7kL%b߯|_|ЋBHڃugtg>{pVr +Bm 쭀llNVAF~n"rwd'YUvtzF޼ziv9SpFq5T؎O2rkB̦xyJ7s)#4z@" Zes'< Gh_BVYIAw^E]6iݦ}/w76\ȱԻ.ͤc$hfc;Սi[^~}ko)NMӐ켃: qoT{ kK]tjw%[Ys[;!0X"8{=l^~9gআu3~Wzʊ6Heľug{|.ϳ!1Cs=Y~B{w +wQ[Nš=(y搴-iXxv?|cDEg%|#W+A23^&!ݔő7D7ݓy1+#,{s.d$tH˾܎k~+3j^ѓ2#9Uz▭FF݌1G@ۈ={h;īs5y~FG`!z9Xn56wZ"Kztؼ">O2T)n3we7vfyDZ/Ž{Dg'<]g#cݫG3fLT#ǐs}LGQPU"Zgύ,e< ՖZNɓ]ʢye<ʎc0J';beН8Sm{ezjzlhJDZ"!!dt#tyNy:T:O0#謗F?0tu/GdC/yRjow7wrOO=[OO79{C~i~7luډ9t#{Qoz<φT]uQ|rLxB}hVIqcI%.'G^0C=(+?fsAc:&پM"s(ɑ +u_-A1w?FeoC. 5 ++QZ_atQy[^Ϋ"x~J)ϑ5]s/ټƞ>Liî~rV.番m@kp m|Nnűz#g9 X:(t#*EgygUɴ!~)N;7#&azYN3&<~Q8^Z-[6:]ͩȖ֊!rSբNBOWBv(X[ń~/T!6٣0t:ͺ5uj,}tr+yר.̨ܥz? ׋ F:Y)05 .t"SJ#kn Ye찖Hځe׭}Í _/8~p z\hY]ːҙ`7 &3*|/uH9jTBcNYI.]:ƎY/HH˘T{C:wsq=N Fy 07k,&V< >2&x{ىD:4^z)Ӝ9j:cGYH;]\q:[έ1/Rb M؇ hui}CCǍa|Fv5ԝAur>dbӡkeɋ=Ҿzi[:Y \cJ"qEIǔ3,#.xdaL$w+,.XAvܘfyMVZ 44o~&6HکK߹7d-a{[hwxeس=Ccns1ʤid <5٦6QtL5Y/16BRZD/S _=D{%RmђpujddR7R&uʚ!aDjd⿏5ϴ j?e'Dq 4&j5e/B8 %5p㽒H+5;gFl;~-+I9@ +4v;AƲ!/#-orY +z)|'ylo +endstream +endobj +680 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 679 0 R +/Resources 4 0 R +/Annots [ 681 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +681 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 573.873057 101.433071 555.123057 ] +/BS << +/W 0 +>> +/Dest (cb127-1) +>> +endobj +682 0 obj +<< +/Filter /FlateDecode +/Length 4741 +>> +stream +x][,~_1˺_lH~0Þ=gmžqZVY]vJRUSI֨ +U"=?~8}t;&>ӿyYV{bY#B A:0,Dy@SX Mq,a +B c2[V:(˱ J.0,%!R<"5)'<9VǤ ੠91xIx]x$s)k%ǃ,,X 0ރ (Lh%8J> *&a$Tƙ~ - }w1P p9, U#5*$qXw +߄p]L1rX%aFa!#GRDabxOxtpX"ayDam>`UH x]`aܕ2$ ":Q/_Woqu\>x\?ϒO6DZR'S..4nMv*|z˨Aޚŵ\mC-ꠥ)6ίy~Oo=ف4BhD,sDz|ҮMjۨt0_c4s*UR :rP]FE A1.w1E1q KֆM'ZbEW[78t*kv-)I NoǢ_6c оYi)wdh1[ݶohRIrdi=9l_CAKOdd ,/-".2^u}#-ٳSZSuw?٦6_6gV]z~FyյA=(us;b%z*se.zLU_K^izmCܮ¬,wa-8u%oAEUoSt.Gaݞ]ݥvzD˺pV\ҡ+og=飓>~~ZKZ_ƌ5UܜOћG\3n +5~㭳3'miK7c*wI[##fQ{ZzGo;J:]g==뵝6MZ9߼P#GWm[9W)n_ֳ^7jMVku5>,u䇱jRybY|4_ocy~{tcrډEa,˧ υ`-`퍞9xMoΏa*⑗6;ڏu^_`D=Q/8&wƒyΣco02_{a +<=z-;Cfҗvp0KIiiܑ_ ;8;kb7m^;c;Cp4`=`?KWyמ]:טwҊ<69<jO ++.pp^ϳi)~,lÂA"O}r8$Wܱа=^嬦#m(coE:}+X*5w37$+U˴^WDu?@W~u~O.k붃v+7Pn#GS$ +]=@kTB|ls):=Jo6ZI#7Ա =.BQ_*J&=nK4*!Uxɪy]#U4 +:5W~^uU'[e^ Zv>,NFq>_y`3\?J:*]0B'w}[:;ɸ)s8Mg(xd1R"ͷɞGI.㸖 -ty{ A2}/D%n3`Ui]6k=eR5U;]@u2fqb d>6}^nMm AVp36LC}H!#nBq;Td+1!JI~;P]FЭ<ۇٱJ˭ 6XUci%#'۽k jF}aDmSM6|$B]C,3=ӂ5zhaW7سnVڪ:P4MVZ+1T|VՒ[Y-StOhD7ZoRukђi9ɞŒ1wڞTڶn {d*{6I"{IYL\WBT/c*mi=0W"쯕lWDZX!12(f4^g0uPT4>[lnSaNnVW˼ nM雰 #HşIDIS +endstream +endobj +683 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 682 0 R +/Resources 4 0 R +/Annots [ 684 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +684 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 558.873057 101.433071 540.123057 ] +/BS << +/W 0 +>> +/Dest (cb130-1) +>> +endobj +685 0 obj +<< +/Filter /FlateDecode +/Length 4776 +>> +stream +x][,~_QφIw g1ه>=6Ka ns):I\%` l[1[2H\`Iѷ<-> ؂HQ0yUIZEt Z0k Z" % `t$. `H\hӰAtZh` A Xez%qfh%jIGיQH~PQ 4&$.@bI\X:bI\f Fbf )؂O₤aq蔒 ! 0.y%.HVa%0n $-!-0nIXo$-&{^oF f`^ vx%0"2MD^x]@|&+#8c@seg@F7 `&VыVJ6P_cuiܢC72aXdr &_SV4_av5o=e(6} R7Q˖ɏ]6vl6*`1AR=x(NXcu`x?AZ{jJ<_Vs7FKu;ƾ^,سѶ՟C A{ +Ė`vbf+,zl +:H&o?]@ŊuϾ]#Ә(~?>'(ZF/s\rֿ#T [˫IoSH/k9mzlSB9Om~ױ}>mW<+X0Ak1׹,_R:UuRqσ +TҸ|NPǽ ];45K R!+;Pm[_l4'COw +p )w!Ny6a}c#:{tDȈ4шj rPwraf`߾G]e^LڱűmkZrѵN'Ļo>^uRxe2rn꛽;NV/C*Sc\mضrP|Sۡ6!ڦ'ueWhY,}&*6GPx |/Gv~ʾ:O_e;ToGf3m|!^b^G[3 +\Ql^A>5Ol-mm^ngƝm>ί:J_nsnGXr~Ǎ6Wn.3c;bAyiVdlw m<1۱{cc^'+OqWӻkW{fvۏZ?: +gn|9R_o󢓏m<Z5{adĒ(1DCx^BvNYaJ||6UXi8wm [˾=.X8"%{)f${v~I}&΁żtw=dm\伽!a +:6= d:u5LRgss85>'%b߯x|_ל׋jHiĵKCtP-bP (6A'')TifI|(,(_j3soo8nFga};ю'ڸ=z|ؿ6Ҟ7Hҳ_lHwbٗ89ȽP:#^=i/3RS-nhd$]9JF['` hthqy#~׆P NQfkT)n3woǍƧi7{t(<5)6L=(X5}#f >;z8>ok^=6Vf2gúAyLEU[_K|u5di_:M@\_l';n]}ɷ3l 8y6韡w?Ɏ:er$^گnܧyMDZ"s@C+#u2ӡ8x}Gg$Jܭ{'<c_`fy =~#'C'VҷNpcg~4gwPyhݹmv7~~(~ >t/DZ6u~(x'<zg}ɝR~x"9Npn=n=upnP;s>yi~qΑQ{4̝>esZwS~B<qLȤKu]wQsK-yܨqF͎EWYnŐ!/ƂI=^_d_GK7(m ci#> +endobj +687 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 555.123057 101.433071 536.373057 ] +/BS << +/W 0 +>> +/Dest (cb133-1) +>> +endobj +688 0 obj +<< +/Filter /FlateDecode +/Length 4596 +>> +stream +x\[%~?<,R1ؐ``x&vZV׹Lg9t)U*mKdTJ9:?|U?_g)*orH3\T1{\'똳U9kw"bQ{ ,UsXGtdEA9y1$p;2İѐĂ&(j- &rV$5*lȋh%s*D2HB>I<,>k#yde\MXi Z$>;@iϧϾ/ />5}z_뵭qh68|hXh^kϣMzZ@Ez.h_deuv#eЮק?;KYl΂mcB_U-*nTvr'hs3{eNwڏLkty['HsC8nw˴nL~uW;q,jXy6U_ks6zۢtZEg=`lZh&p-zBɺC&')*7m*/+ګ~+m^ήrmea6mz-83߾\ۧ˸0}w&:؂kgMw.ͪo5kfG=!Oj~FJKSSE(C^e.X9qm$fc:g~8oF c;vb"OUdy^,c.Ұ~cArxG{o6ak}t:5>f#Sj;WoY|yrs\ثN>] ?d.hmV~<&s8ʭmnz>KOF1|Aouieo/Lc'o []ɮyL[Oq{*:ynQǨ6N^O3ᔩ~T2#<~+6~ ?[lYud^ϫ|t_Tju<1/㱓?aS[=qkўo|x]ֳ\WLl6Ƨ!gT.yܟi@vw!/{m>S|CӶ\j2>zSeH295.ȸ('?Bulg%9>8:IyLJS\tO&ɘ?Gܛ6}c(s{~Vj1^djt^ta~&>c1(o ǫ;Gwy[!qwy=SD2*Sg6u)mFaV2'Z:lW\-[ BVmJ] wfnK6֭EV?wh]TaX͗b&6ݷ j>eMzH_UxuR3>YAܤ$¿].%TDŽ:g>UtZP`Fy>GW:df{qS?tuV ir˔j[[~,nv7lqy&WE\8{22l>mpJmHs߶T-&p~s?E>:LH;$O,^ád]eR*g%^+C 8}//H(y:➷+\Zvs<ː8.e>w0]u^ ZZ(FbݑbK:s7N zgXNt5B;kMmࡱcE`0[z_W*kb5`Sm~~^rY"sG:.;#}u^'ikx>ZH|V5]srq%CҾywyu|=? } J/;:o~X<[.Ǣ <>pgW7rهqGI/`V?ZxAv8g|Y܊QK43gyFI$/[v_mFHXsK/_$Qd&֯ELkGgTy-|{:w:W0V& +Tֱ@D`dViIz(|G4 7D=u7Ȗ<߷U>LoemyxBn>T~kSkiNsPS}+ BN$?խi1;b#HVN =r5-{4!put3 !9]')nk&S|Q(Vh\o&NNzˠ7LF7 *|2/K?f'4CG4`(Lgg} t؎:lc'uӱr&&d]yGr>U3r/QiRb.S#KvQ\N!NLvȹzfS8ktG#M7ZT)/̝<=>UfS;wLcj> +endobj +690 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 367.323057 101.433071 348.573057 ] +/BS << +/W 0 +>> +/Dest (cb136-1) +>> +endobj +691 0 obj +<< +/Filter /FlateDecode +/Length 3514 +>> +stream +x\K$ I $``#0rxl9瓪jcf.zD#w$Τc-FeOGg%rH8=p|9]srÿcܑL΁?ca b^aec彉|PXb b($1$' % Kt|1\Qa9 9Y aRxΛM )SVy<I1y !l; p/@lUdYEB؝du%YlNe6>')sYo|b9aQPR + K><ْc"x 1%[x7[vC(*@P,6 AL%6$i(@)5썄5`#[%hHqoƅ5,]*ְwI`AD% îj@&EK๨aAbLkX7%]ҰbDÂ! \E"sItsNÂD٠`5,@F-xbK4,HLI5,R<а)ŶװM9* RRn& R,dIf7Bd|dLI5,g%ԛ$/K4,lQoS6s(f԰ dHQTdAҔ&:iY(9Ro& fDF RoF3Iw @V-Gg:33'[# EꙁI=4,SPO VtV=6_cr |D`13rn!{1n/?xB=g8$ P=og⩊^չ,c"^w< +Qr_7#nu d<PIW(_pG02dV6~wiR,9W}8|_}0wχ`aK_~w~{oTp |<>Oum'뵜V#^A﷙kקe]nFu+4W7.ѺYF1#N*SWQU3ƅJ&W6ܰ;JLƱnY}cβ盛/L[li-\?絏s}t4i[t6I{'hfc#dK彝[vߘ~{}޸ǣٲ4n}$zlw\ vzh+fz>ĥ=6r,?{EU)eH$DVQtPփذBQXu{7@eV+lT啍*)p]n˯RTSZ<)j]e|I׵'y~˽>B}էmSyĔ蘏dY\SF֗>^{{<_\^kU.)_\nyVrCyJ \sk;&{7v}rY}V}:q}kYX!bdpr͕\SKVdqL(s1x 89N 2IǕօA[&'u^#XZގiS%i< ;շ]!NmS 3 15C/~ +tP{14 S7^=Zx;v%k&3{ |Tz7ӛ<{Ԓ/WpF+OhZ^8&UHNnLuD'qmv/ҿnwlCl+ cKv:@X۟36! n/wWły9t|ɱkܕG滼}TS[dh7C0 }odZ=~>0G)"+oY;}9~9^8َԱuC#Yy_8I.7bwH2 4f =Mx-czsg{8.9v_!vOKa.7Иo4xYȡy@vhԗoP;TͰm:c\<$gH-dӘmt1lE6@4h}d +밶-K~JD?k%-׳% 9g%B Nѓ|mٮݢq 1̟|w1SW'!.tE&wŦ!R^W~Vr~"J敠#6tt^ȷTòUoupmsF9 B ތT,1Kқʋ:h>6'أ. +endstream +endobj +692 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 691 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +693 0 obj +<< +/Filter /FlateDecode +/Length 4509 +>> +stream +x][d7~_H1o$@(BNf|sl9]}&2v*_WUn-~r3Ԝxt|&GZCc 9l'&lr>e÷8k[5yYL.9ۨ*XǤ3b bLYbP-QcA (1eYbHcA WcVXBUy\4 JO;JUe\/24^5)X4AXxDGd5dPK%`Ud%!v+UTd:W +-&sDfPyXQ,ƪ K kY?8C.EYWwiYϤ &_C I øaP/P/PA_T:Ӏ X)iHd!\YB% ,(aASа m ֢aAܒNÂ%뒆 1J"  T5,԰ tܳbn4,@jX@PSA@G\ p785, .װj`I؊X % 3\k0hX@]1sw}^zIX5B@a3a*ܟVƕ4,]W0}*qeBƥT5,]8aA>x5,]5pj5,] Qq4,3tU^5aA 4,8TÂ܅{$஍!hX<װq xXʚFjRhә3΢X@ooU ,*{9i1Y鬺m` 'E`>ddŲ D#…bؿ~{8sS6"/R4fWqm' "9{YkۮE#(btduEwZZ&'1A~: Y@F#8$1v'yIPgWS;~Oo1џeS Um<Ωvp.%JTcy IֺjJfbY7, p[2gϽ,ޝ7&4[t?XFwݦbBV7!+LӴѝ$JJ jjGm$ #uxFY9OȤޤ-XX(bkom- 9/,ȷ~f I q7[ӒF:j|򼡼fϩs=u=/uSA~Ck}HyqY)Z :?8t_~ͯ᯿BP2"Ŀ[ z׏s_Qq&(  +wﭽҫ/_n}Mkǥw. 3t zog,h1,mD+~ON_zky`W t~[U&G2Hz߭N]g4[/OBZc|TS{Z{Kk7I+:1M{w!1v6S59$ci3dzyTZ娴XlskYӪn9Nz;i{Y럄%&} ZNf~Zm߯r)1ʭU׽^8!s<￭;tHڅwiR/yr&1>nE/?$gj+ay>]B. b|"Md^ck}]sabL12_'4I o|γ|/:5bi'^ՌG␷>67߼p<qSw^ =ĖIaMV>"Ñk&2 __o#m Yi1~Uv'RRUgej7W[4njȷS!~*ЮVZ w?dm=vj$8Mқ糓P]8oyr +U^XYdTL"مctЄKAyg+uVУvȸ.>8];|K`}}w7#e`7Z[\ZNf}òEV . Lm,/"X1>_;6˃ZY^G+ M>{&~eeSǰU|f>EFMoD /{o JvgΫP_(9q,y`nLi's8ǽi,!݊,zlg'(2`"tXL{;n_JXJ=wZ޷'[ᕻ𗤧r>{~g_s=R"7#-rVo ‰Y}$s>Hg_v=GNEϿ\k<0Ѿ8rg`݇`Ɛ#.[t; Y\p3ha P|sz'~G*U!sxx׮tOZ̈vz#~ESll]s -}>vkT|-1'#Sl ק5źㅚ2ϣz+[&q2.J0۸'?.RRD3Af֎ȍNp]I8y{"h ׏/iPh,+DḶGp>b(8$Yv68+$`1n=uy5T&q.U>F<mST*"ٛvЂj%DŽИ'ߊ;#~e{ӄ|1k|B,ݐhB:rkkqTʬZ(CWh'[gZ-ӿ1׶g+7!Klj6vӓ bLj.]UX7 TAeio o$iipgY.Y/WRAwP=.- dhn0 yRvt08ڝ4IqW yG;lw2o7;)@a'>5r_v.2847C%y}Hw/<+vغ!KOj;|v'e#O+l0iV{I7 $ƩCAt B3 +d~L<>8N8R.pX&/L|M≋N.yQQ<l#&d'9"0y4ݬl(DA>ȆNFEg/<ȩh'Ic<c>mrҘm +jQvJ;N-.SZuUKy(ge(1YIgeFF99:;KX($k*͒m0h +fdjgxVY~+]+N+2K8jr9>-)CTu\KQ0͎Ҍ.6C4 +^ZuH)@ +0wvkj}6cToϕg{Nf_̀ +endstream +endobj +694 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 693 0 R +/Resources 4 0 R +/Annots [ 695 0 R 696 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +695 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 563.554475 101.433071 544.804475 ] +/BS << +/W 0 +>> +/Dest (cb139-1) +>> +endobj +696 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 100.307453 101.433071 81.557453 ] +/BS << +/W 0 +>> +/Dest (cb142-1) +>> +endobj +697 0 obj +<< +/Filter /FlateDecode +/Length 3420 +>> +stream +x՜[\S̳A IL&rsN_f+l4UuU"Rsλ=-%.^T)N.⏻Nؓ5Q>J咳B]JkT0#f!9We!DK33XrsUX*j̆*x{SC % zt\*ЅL٥,!KW]J)K'%V,]-1xK[Kt pbo` ̖.TCW` : +/G t!dSIJlI>VS["{t [/KNDΥtu`"l!b` &"%sK(g'ĂvRXRF'ft,-QEErMl* ` +X,`-$lA[X,`V|  paX .$ ȅ+U 2i],lA],0RwYX .3j:X::-gb̪&GxRb@].;AX .E܂],KBbŁ?] $l`- CGl9BZb "krd `L]u!cčuQv!j Tl gX;DTXԖ Tł"o . X悇뚺|-bAw%X(|IL]vp`0vył"W bAw 1u Y,@^:O w} [:p\-$pWæłU@b tȂbA*jbA:|.9\GC,S[$$֮r- 2&X eXՀ?؂LbHJXc~ jkSW bA\X;M, X,`X,@(r[[d[,@ ] +d +2X$҉}fXP$9M-`` R:LX,f;Z,MlsLl( J!ndlz؂bAil{57I,`]~X,X7ł*%"E1uIS5-&dl* jJ, f`<(q+d]db.Dfk=33[YtYFVV<3CeI*E>&gLXO#wȈ%MV, Av_(w_{f9)ka)-g,;9!ӸRa3 ~onw0{jzW4|ؿ_ֳͤmck8@ Ooo/bd}5cҳ:NZ0I݄ͮk?]ƌfdIi㱃-xb/mq HbpB+wlܥuE s`BNqz4w#T +w_x/k9ֿl2)[ߋlF9LZKlaZݥ[֠mol={8l?JW۰9o>_~zm;.r( _QL^!%3zXs!0F$'^ҦݹЙ !bW"YWN:̇rχ[ejl;WeJw. 9bh:SR5 9y!3FxsnHQ > O`sB3m44OYudg#zFzozU{_*,\q:~*{Zٖm>WS9mm+w)wc Gm|rg%d|_*_LK=3d҉|ν':^hR'L~Wچ1mu%#zuJ\6X|p:pZ*'>5tNi[Cm=>;j?n}OvP!{8ϻ<kIzS{}\xЦ),j.ߊKm_>7~b^&.Tq:@ׇ"..q!qtX[ے +vaӒΡd}}Kݍ֏>l cC) XPoWSѠeGMq`? O 1I'd}v &<-JM>ܚjKx2vil%H'CtW5-̮fMZ9r3DYnk-ʽTUkapu.} 2F475L<3ڗoLxE+qw1`f!Ovq_6TXMK<˛ ݥq5:ѵǃ4SX#$p7+t{>bGi&y.Z;{WXdV=~-a8RśA/dc{k;-HRkj$$T4}I R2<vV2ps6z[15;Z-=m.>^n?|gu9F\e֭~E5-ͺrt|@ +endstream +endobj +698 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 697 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +699 0 obj +<< +/Filter /FlateDecode +/Length 4776 +>> +stream +x]K$ׯaz^`v6`tc/))233[x{#RfڣWeS%E:>>̔ZbuQo +Gk(M#|R .m.ew:k]TJt6Y䧔S2Aa ++)%ŠvKX#$rg%A%1ȹ2߳ +pɒƂ !N0E(=j +Ӱ wJaA"n&@o50]W&Srְ wKN“@&հ`<ġD.aAཆkaʃ,>; ׀U|dBw k<1hXljX\ְN1TRbCȧaA2 @ʃ,HS%kXdiXdAȠa"XDjzY`.j~@@)" RǠUݔZelҰ %[ KMNa~pI% R,p M!2x ְ.xjXdA4aAvYf4`F. Uk<2gf 2ʼnCE &4*&4,p4,@diʃ,>9;N79CgM7@D|'5,gf䛎4,_r5,( DmͤaA!<Ȃ(~ LB txB9 @^Ȝo&u +IwF p|oHtf3;[؋*{9i1Y`Yu'Ea kfN< D=bؿq{,S~6;)` +f +Az6 + ӭ,5nuעOAFZ +tl/k:\;ĵMPOb$r@tCaI"vyEPǠGWC;~O0џdCeYSUx.Ssm,{(hsɖS$fYEQWh]Ɋ1&݆l(1­ɜ>#lh6$鈚,+ e݆[rlN EՆ:u zt5?r +ʮQwȳNқ9/"K;O +,F,7{s7T'/]l/x#uկ*Wi!KQ%>cawYJ_Pշz  MD~Jo}<c c\6k(74 nߏp>f]  N\}.AsiɵƥpB"4p>7)l+Ѻ6Й7.==s*LoKYV.r-246>,mMfƖVuZV[Fj۞˚pDuMeD Cb4I3Uceq?Cn>4퐵Yg};7|@hߎY5Yب*wfel|P,V+m7nz/-WXAZp(ꤥEꖶlK/뙶h2~M+:*Q5\ѣZ{q9)χGeb;2Vn}.1n} +^V(d^Zt{n ӅD6޿*TcpdF[׶jH{HhԐl]! {*\ 9 *6zU/]^Nw~7߼ԖN-ha8‡66S,y<}EXF\$|6z/FUkQUi/i{_՞tH9v NR F#;|hYUmz]^M2gOM^ y[ e>=a1MjQs +mi7VM9> 0"Ez?.ay/͜h).oP۬H :nnjۧՐ~Ilb+?l8IJ!K~m>`r/Tft'h*%pVO hͦCᡋ>qcGȧeT˟0 /[~[/-I6ֵbJq'.7r[YZmuĪ/YU`G̥5D]C76K7'k9hvaX®㚶+}cl[Y~ӧZ\XpGS#+|[*\|Hk[rš=&.$$Bc庼g3:g"ʕkgYMeUc]\^[n}!Cͨ|XV\b*/qy5Gg/,:f}rWۜγz .~D|3YmcRv(DYĝMd3ly8k49_V +V~!˿w|h/šYFLIX\t,V$ڢѦe2v"C0:|?wC0#|hcq]-rŔk3i>&>,$~z>?.Ë֨.䓪r+[V&FzSH|XX[n7Bz,!&%3ǰOXj "y(G~h6l&[kgjl|꥖7o~7?u~-X` MzWn}JzhfC~9[H![{|4-NF;i >Lf8n'CGh~hdZ!_8wQ3=Go&MyU L8$Yv48*^%[o1Ft7ȎO +ױ#~eZӄ|1k!Q/WZ9t:BKQ4QNį>b|&}Mvv)-a` $ыv;9a/'HOpFg3TNe,u$ f'$鱣iFY.RY/D Jy^klE*t/7;xɶ[]'35tDӄ@w)C]5YCowcIN}-?6߈і̦['L_Fg8( їJnщ_>'VC]N;deE?:=[h^ǝh:r%7Fn#ͣlhq^Өn#\I C:fi|܌{mp|5?nI 9\cI>&qEǒ.9QQ\ːl%&줫'9"K?x4YtQ" <ЯvϞE<;EROzח}CC-/| g-hu!mTPSjUmpibj2ťZSKqVzL1?HM9+]AJܕvۊף% 9љQǒYEYSi}(AC8"S3]Wk|G}VԝcPMDc&xu.Ȼ 1&Y~. :C4ޏW+F} +PgKcꗉSE~7󫚒9ظINlk +endstream +endobj +700 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 699 0 R +/Resources 4 0 R +/Annots [ 701 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +701 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 512.554475 101.433071 493.804475 ] +/BS << +/W 0 +>> +/Dest (cb145-1) +>> +endobj +702 0 obj +<< +/Filter /FlateDecode +/Length 4689 +>> +stream +x]ێ}gy)ހ$Fag6 ϡZ*ݳkNJaUjϗ +R"x/-PIe{mrJcT0zҴVyA1XN3H0Y"^*ZϨJK`$2)+:q: QGVS^s:ctQ8lt[lYbtLduEo8-]-@W`uE:8]4@"t2ii HNauQ$-N`5Rs:[?GA"{AQG:A:DAt\ӊ##a%1Q0sYl18.0M%%|KR9 fJ GP.9.0\t1=kЮ8.0]CJr\@]cP0* kxHs\QX:qwuqw4xW[\rwjҎE$ wA!w` iqn "?fN +q\`*`X]ʣǙy^ʹqb2X.3p\XQ5 VjNU:J ,x~p +X߄.B8.]ВL c!r\X#+18$=9._-3 ++FӁwM&'@/Xs\E \>V-^B`AY' Xhbkbkx"*xlx[6> O0o1*sZfu:9.bqb)09..q\3SqS,E"hxN8ӅN) -9.: tЈ%՜d3H"&4&8.`r\&V[% B) [)D [q\M4Doj2śh$Mx̼ƥxs\ X(i̼'!;q:[t$ s) @ M oz6]޵L8@ ϖ%zg23 X[ٔbl@|S& `&"جU(d Vp>)*8x(vɏWS,(8Sii#V|0JLB,IFXT9閌ӛrUr4NV[2&NJI¿}wPg+.9rؘ0i{~~w޽̑')IJiW*W!Pee@Er;R TڋMe&^Η>??m濓te>gֵ<_-0y 4Fvƪ<W S,/%uaZ~zX;snz2>uelX^Cn\z nrnm۴K.Pݶ{ )˞A G&JDfǃudD:א܏ZݾE[2Q9h*Ws7Z5t +>Xp<F&tk?GuOuR_y|y$ABu9Z;#k f u\#h$=ͬ[̄д延چcH}skSЊa;~i?=4#Vz_W4zsAO]]sKvo +hcVgx4 wnMu&}7\qݓC>]I![Z\H=he™CScOnC { URj^i8/XG~h7[ff" }Gpᐹum;dcֿ+3q,̣?z96g=׉W|nNW=lAֵ~pv}h ǻua-jUL[=\֬|Zאn6-.5oS:GC50mԜVt2sw٨+|ǽlco3Xph3 F=E9E.Kt[0V|Du`!v}4%V.}:{ ]*nX=e?ؾ;po5(vo93xPvtݒ\ksLm>YFm;ډ{`_>`!s>MX+o ~u{{dO}~/n-_UQ/Q]9r|͂)v;.k5wbu;ϷtXۛbpme8dxJqOWgPڲ#_|umn_u/%;oo5#gJ;ll)ߑMs8D]n*ٔ17Puǝ:Cn_wn7yF]zuUNJ6Fܓ%WK*WS{ڰm /|}R;fR}!ֽ#>-;C |Bh.:CoMy/k;Ts8D~'HΤO2g5#7Xp~I፟ڴig< +y1b:GCo|OZ@y:Czԇ\~wd&.c $`!,}jv}aoW}?e8\`!'SFQbg M3e9N}gn3IM6kG bP2vl^Q[dFW/O77酭&`R' ^7<ѼQ_)YKOr-[wFhBٜ5e{TzSX:WT3p^>pZK_Yizdn*Efb\ qbD'FMQKoCr1cD'ܚ-#KPՔ +uJ3fOn4R䱖^ OLדLi[B Vhv8Ȋ*M[.05,( +[y +{Q=IEV +|-t`/$S>n)]zl!mK$Uc)VuE(,OV(8]ׅiTɜjnKU +wb_F\{K yZب'|*ֲvdRJ8Nӷ$V?N2Q靪Ao/ZЅ[v%KoF,,ӦjjhUemFCYǵnjuY=TAUѶB[]L3<:6u|q8IVᠽ3uI>7M(K:8hasX-[ٞt}ڡ0\AFCSuTٶ,)شmäړƅ=wO}6ڋ KBxLnyXsNy*mfԩQ] ZmV e慢d2J>j[+l/ST?ڞNUn^dd[8zu,d`d]TK,[Ϋ ZͮJ̝K.?S&DK,ԤPzФFns=WΈ\I{& cWۆ P}EPZ%L*Ҝ\e0srJCBEWGҫӽTljh~>~ } +endstream +endobj +703 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 702 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +704 0 obj +<< +/Filter /FlateDecode +/Length 5035 +>> +stream +x]]$}_QφM#5\l`c5nK}LIȬ욞J>"PJ_~/bL始SWr. 䣻lBr& I\0TV}F ,wd]mw78 Im +eiR)F xd$.T0HZJ\0IUZ OQ0yЫ̛)е( qA4k "& )K@ 4I\tTh$Nt!Zh A Xez%q,4֒jIF*3]E 0MS2N,~2GAHM^nF b.F ͼ $]I\,qh2$.H:biH˼ތ$O $..(.p0oIXo$.&ތzypx%0$3Mx^x]& c^qF1b@U (p/Uc +Hbjbe5YP+1lh s􉇨<`3c70-}[slv'. {?/(  +$ qgǿޕ97RWK0[V /n?tYYJapO Ɗd+u}w*>hYGI.慨sp1Jۍ`mX4s@VlVڶ N,_8AM?SE>Pa<|: hӏ_O?@_K)sٙo\/XL ~toX?5y 2NJSC{C=99D%ooi^2Uלn[dZn@鷗aY=| n\S:ű%>yI+_y:@z5~v δUְ"mӾ T0w*0$Mv@|̳YCm$r4ue4LX7C +⨏p6 +eoMki"ǰFSj{??wgϤ'<Ky.'CȕMf\";9<8HC;9=׳q~>{QKl604?bC\COa-ֆ^:Ϭ8^|}.3-΀m(5<ғe WERr€ւLʕ~/޴;D\x+iGU4MRϕy:_knmf( nGu76ܯ>'<Z}6rk5!Uad! 7Uu]~5%[3+efy`O }6Ȟ,t>_G#JhgH=?CHDFGQq!5;-^[ 0kg'UFUe ǵzv!#;lqakRK,ϸ)G =?ah{Xڴ۲+1@d(`M/ֹQX7uffrlh67sgԅ띶 ^5 -ϗ?T:hQ}} {NlW犯Gfk$ZW9Vo:`oXIRá1S.twKXзe?1ewb^ϗޫ/-=QqΓӍY99{IY q^^Fne EWOy6Dѱֱn{VwF.Gq-2һY}AV#pcd? $ٸk=6Ѣo~Ow,nkCq{!~cu%{ 'h?7Um.S;֮N+ܗ&}cqroјeqn G[m%mֽ~SmyGei}3ýVs~~iޯ asVb-u< fCWZg绗ӿv샆tj>˓IWv}oc?1 ^:F%ly'\a6N[NytX\פ):! 1Pma'C^V>5Xqދ+L*}cػg ^Xܹ#daDMG[&)ƺ7)̪H0uXtKX븍E9(bSXB/krH잓5-=GrqU'2>7uiq灮lPq}28]~ӡg<҈9K/rxY<[ձ_YGP2AjB25.p.˖F*w@Fi[/@y7([Pe"HZ'06?["iYOjy_F, edy`ô@c^V6xʹR|\aCYm*^6ŗ3?u9Yyx;&1ӔʒäKNu?\7l|v>p #XTNjN4/4|U).HH&[wsQ!V SsZ7cΡc˧Tl9qnXHDIդq˕o +$W MVDMTl ĭ|Ollk^"ͩ1MLתj,S*TWs6NB"$~jՄlr6j491V Q˗j>!v-6R劽h=UPuvc|9l([? mUd1Q=ₐuPB'ZVoK㥧u ST3U| CW<7[xoCRh +=/.B,/,t[cTe,=^&FdPג3i\UUdנJz6UjyZ=7|ɡ·[7}[ 5V 6ғj֮7b i$ة|L/L~Z[{Y/-~BÁg;nTc Ӹu-Yfx29OMlӆ%bߓuy]EC0^\ub9ucPݤ<>dɦAhz$ކ^l׎M77JWpol7WV%rn!% +WK`ꚭ̀䍴 +b̍ȗ˨Y^uM+wWL7VJ?)?0 +endstream +endobj +705 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 704 0 R +/Resources 4 0 R +/Annots [ 706 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +706 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 307.623057 101.433071 288.873057 ] +/BS << +/W 0 +>> +/Dest (cb148-1) +>> +endobj +707 0 obj +<< +/Filter /FlateDecode +/Length 4670 +>> +stream +x]M丑ȳf6|*gʃEQ)R!*RfV7wR$"#BRҜ5~1/Q)|I5 %f{F6&?*foc8_wȋu٪5)FUJ'W1ZU0 +>* K*A&A`hRa$0GAe40VkQC4xAYB6V9B$㍤*#6o-Rtന-6E'"l,l-:h#S>'"Q)j|rNK:c6Ì (,l gQ[V9Bt bJlev;팤H`%$ + R$1*ʖ$)J$)+I4`Wrxi58 [< -+`$q$.pXr8--8-l$.p[&H\@0SK\.r,q:p%.p`]烕v q:2Z:3I\@]gtFV)i k& k#Q栓kxג ( +Eo +;[@`: ИpK$.] slLA5 '2=.[2!d ?DIhP* 4Us[b$1i3Y f Bi6_ckfX.2cZsLJk~;owz͐)?P_a، . Q a#u1OFt+Fb+3a];}*>B!"P8ZO_ *hFp6˶ RӬwNh5X/ O?~?>ZS7}p[2tː:7B;W?׿\8EhΩo_YEVO㵬z?6x)Q g*`s@!-( n+H js]Y_P3Nw|- +8;+kMs4"Z7jjאmnK+k:b$$;GTLjzD=n=ۍ("6bq>I>V@raxvڌݵ]Xۗe~6{'Ѧlu G>\n;Y^u|3Z%_׸@ܒC},֡G+henA-ams8U=f+{WCς^x?ɈOI+YȝuH~!Cތ _}O>u~b?O*ݚ3t(^]̯XbB4m"9"7|;/#~쏝|:ViO!mew9Ok_W=Yht +ʆd.Lm~qlz\u_Z#aWMms9}Yk76lQ L}WPϷPv5lݺ+O4δȸ"ɍ҈*Q7t+SWQoTnAV;{VC2ƭLk(#m~_Y&H\AWb+Zu{QrKۻzs4҆xۿ 9e?> ¹nzgáu>յ[fx&h6$.ͪ[f>~6˶qBb>&e %-s8m=y7;zڟcqp]{W4Do:"#ZAŤYph.ü]>]Ikz"}vy3ⱵX{jk> \㟛 s44 Q}"9mZ'w[<uf =0;;Qy"F髽ɩ;)/]F j>p|g!v}6'>L:GC\ܸ_ݭ 17xgȗ@X.mqQٴ6Xg"s8n<+Gf[#mK wU;[fv9 +|Tݙ{ ~VPʞs8n:fFm_CkU.]yQC:l>3蟙j}U>:GCnQn_o8Z'šֽϳ4Jkx!Vons3 w={+|=3KB!ow_áwQg>Z.V:mػUҺxˤcپ's8DmHO>Ϯ $}>3^ +ou t[χo%|sLi=IkH; y}1+x߇C?ᚯ'єm: q|͆-^>O|'D~Yp=~K\57x2xn/96G#!xutv]>;;v1=DRAe FE6Pȡnp.?=,ˆeHMT]:%˾#~_d7mcVSbn-.Cݕ!PӲ]CZ@-ewhk +Wqc6q^&iy S>D+U&-3|0 UNX0L  ҭfReLs5T#45q?+PW#pIgNߦ*^O oNиcqS6kv2,lԋ S=$vɘp2 0'}u6v|8M2iŽ~: ˜uf|Δ}Ne2um:슝v.Uئ Zb?M[z"Z45M˅~C& 83bsdizq8+[Up/iҹiI>&qTNK:dYEFqN'ff@򓴮/ +WQݤiMWp\`xdI臧> (FMՊ,ua5ǝAS{99Ԙ\ p2i> +endobj +709 0 obj +<< +/Filter /FlateDecode +/Length 5052 +>> +stream +x][ȑ~_Qφye`  g1ه56Ka2 B%uԘ=M.E%嗑! +?hIO1zEM)+%VE'wՊt] v!/v._W3vUdCPNP%ʹ)㼠z)$` dh +0Rt +f1QPEa)hU%a&I3trAPi;QJEdnptFO>&D]N#鬝| KEIG%%-N)I[ I&L Bt)6˯?b_LYJiB|i`!8}˂ʿb! |N6"n-.Il$gQ"sXJM1&w949 BHA˶vW~$[]sj۰\t uqv@;|F (l:xdTFhU7. Ŋ9C4ݸ/㟿O^/, _nb&7:laAͺk,e M kz~ K;~@)Qy +aAuʧ`K@ +[;jCˆ]Cg8 :C;?|f@etUa4BC)wqrγ;HuphrcagYqaI5J_F֭6tՆ.S`o?x9V;?vhNsvb׵OfQCT49ĽsutzE6u6djA/?>Ժ +;LR9sĹ2GVίk~C NF}tHqMmG1NˏH3m8̄9?."{xp?WyF-mePG 5g`޿_>Ylbρjb};qhDNюdCAz8?¿B3k>i:?h=th_4?㞬th~n_9U*L}u">c5w[ރwŏa&|,ȳl裃8ߑޓNܹr;H1:OO˹"9rv6q^r0΢A/O^=Y{pc8ZîEegCQamf"wq#ڴTAt(=`q5S=2R$UdAs+Ũ&C:\gChlukm]SlrA9ؓuc6rkjW+N կr1#Tu :ԔNn,UsgmΓGBfWP#oedu1&yGweGٞ~YWDiƅlvH{}-3|n̯ua=Q;Hp:O1kBO95=.m \jٕu9b}!Fm~ߕ3Kv[w4"Yޓu 7؝~ <Ψz0-qs%7{ג"]sx\ [xFt+:*X%(=Y{`;]Vxl:~3Dl7 +r)İ_a߸\5nɻ \ϻl{dCAΖ{eҽZo+c!7fϹ̩Ml(\ «ڭn7 ՓuQw:v\31jw=Fd)ٖƽ'vX=ϴQZ.xN_+G +idgCe{OzQ[A=ݏVD9jsӗqޛצvc8s.;Yw 1{aRU +߉|#f, $ٸk;6٢;ח96OSS~;dO +ȵewCͽ>ȻۗF>6< s|8>sƥ_aw6ns-׎8Gݞ=w3w{/[D٢қ_]~_ڷ˨soC"ȷ3^Sqυn='5:ꨒ_|SHoRV4{mn}J]5ۯF?<ՙ^ +}8v[}W|%4Lg# 8w/Q8W>5k8tz5s~o< ~0K|y7FEޢT0o6NDE'<ܱ`0GCoي8nO*姇=V" +PIY|{Ic<Ԥ{=N6GkcOǍoGm&v\\ZnGҥ'L*vT43OA*Nlⵓ7!B/ܥChQ 3c+)sT$c- uM)q%jbנw;]Nμfpw.;߸8M.|F8C?NبΘRNoE\gkc8cdҊ{R9D&oɼQ<`^Ǎjla|%˯'Uئ b:0^]ub%ucPݴ\4mgmb d>ul=zryqQ?Ʈ}I&q%Z2"x8dn HIs}P;`aD>]G}MWY9 V!aҼӴG0㾘 FMƥIJ,ЯۚcN֖es϶ OZcIcpSUuhtb6ZuK9(z)K=4':>*~S6[W-9N-MJmߴWv =2U۔|;s! ?%cj[^׬o YjuJ+=a8&V_-E:VKjI>Nsj *o^-WKBU/Z9AiiaϮ'_P +endstream +endobj +710 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 709 0 R +/Resources 4 0 R +/Annots [ 711 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +711 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 101.373057 101.433071 82.623057 ] +/BS << +/W 0 +>> +/Dest (cb151-1) +>> +endobj +712 0 obj +<< +/Filter /FlateDecode +/Length 4651 +>> +stream +x]Y$9~_QHk|/iHaA!k^>3G:#rvVMUF?pVW D;~x[CoJVE$0^hw 䯗?yu"F뻤"#|^ZF0*k:F)ȩ`i0b +fցQa+TE"N3TQ) ;Id4SV84tZ CtIYp(*"` 9-`p:[4Z'2[`tRqhEda +N)aM0I3: [kt8x3ZuF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一 '-0`GaT0x(9. .*Cq"t j)y1h8. 8nj+5դHB,,ӆ&4 ,xWEL̘[ wU@(G3,s De8.]g/0j ,xWԜtX.q  0 %]V!p\`%qfa!y ) @Bw1G xWZc8.p]Ip{Xl1As\: [fLYR)8xW*0J#M O8.^{q:| [ Xl!Oqװhqװ.DT.l|@"`2":chUNtts\= LŊR"`s\]f@a +D9-p9. R [ r\t@$K9g 9\E 0Li)YlMp\IM9KS8.h9.6S9. J'qh:)9.* qe7HěqK lpQXlq NB vtHDR8.x=$R`&Nޅg8.Mx\l/A?!E]1^]2^V]3 #0epU(d $-8a\}j1gN2bXsdf%ٸ>/|{ߗ_ +eOARa#V8}`{ҦJ}F)Ȗt]?foSLz4;l__ƵMFhr[F~/׿pׯ }KM.0}Zxl._R_m:19:S573=0Ĵ@h MVwfyK[OMSCc$$-ڝrcSCel:Dе Fr+ujOzNi^&S9!r3Tf-jeFbDcGY5xve6xbjiЄSD 篫pkL7b:nC({8Y|%Vtag,{k=Moj͘ps&] ;!mb{iaԋ9 ٰpUlfk0odVɜ7hws;g;[(}@fک=G51]G^^+օt;cyN`zO2Y9qBVw)9ttZs?:9:&3Yr~3cdjc}ƿ!9h2 MfWL3Si >Sۚ4y2gY2G7%'7\{lHm_uL3[|c&FBs\顊giVƕO#yN_>Xw(dƳEWgY%TZDtf۾{kp;!ԣ ++7Y}/&ly,ㇾAcGA| Ӗ߯ҿeMyΆ4YӜCꌥ~g5tO:imy,;މWlsj!-yNYO+׸ǃyNծCEv(3pn(0v[X'xun֔V!3M=7eQ-+٦}MtVu y(IwQ˧G{;l(s>ߡmz3t_tL}ݵTQos]=h9[{}},л#nxw!<;D8[kh`\>0>bYWROLO Դӭ +:>iȮf+?}eǔtڃyNfp뉀%;u,Krh&y4=tֿ3SkM[Oy/ ]3&EV;e\Kǻ_s-,U/b!_f1*皷ڏ;?wK0ZaPc;kw;gG jzOxylŻkk6z7F3;>[z +wuQsٮFm~W:%b\y먔_:lUrvɰl"K/$%K'+-z*3d$;P[<*߻"ӆ&\5}z?m7ݓF UkUWu~8r`$7 w^Ûݘ>i8ua֍ +o72t9|Vnl>Exqj?H&oD Dkگ"HC*wV]Wr2XRM;5ʴySڸcƱ98tIO~UM5wv#FL$AqN?e)TNXd7OiX +OIj&9[dNd3Btj)Ng/ig t)e!RX3.5e{Tɦ4bztV; 5rQu,2攥C#]W2M̢oz-*3 +Ct1cD n*͖%UYcnjJ FԧV1C~h.@봙uVb*~XϤ+k)x104,ɑibᇢN=YFj宰q-״Ms) fRA2ԥfҦټDRHBEJˉ%i!<^jC7?,s#ʃP)4c'Zh# 5۔R*E d}Mr gVŧҿ-m^)h^q<oȶpdMY|\H4YuڜUC\Lef)G* +!*m0QFkLNpBiTOY;ZrE$5;#VLx"+^lQt_0KA; fkÂP9)TqTT*=h|2#y +endstream +endobj +713 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 712 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +714 0 obj +<< +/Filter /FlateDecode +/Length 4919 +>> +stream +x][,~_QφI~cb56gaEVJTF^8]"OBʒ*|_rzH)ஷ/?]¿1bTZ8xCI`71\..y 9o?!T*~ p9K*3n0%p$A`uQۥ* T0CgVCD QY#=H:ɢ.Bt!:C'I`JK:[vNI:l.uŤh%]-]-@WuE%]9QS)(?dtZش# +3%(ElVIgaÏOxSFmՒcu/1 E QF@$qqp8LK.I,`R\VBX3Z"`wAbauf'q5 $.g%.`[H\`ANe-q: 3kSpXP.%.\ t1ܣk}0XЮu)H\`i%qZwVQ02W0H\ &%%qk"QA+q[fnH\ƙ q2 wA!^v` V+q +  3wL-d%qo qA+@WA$.]ВD@?T%.]孕 w#`MF5a +c BҁwFK:R1K\4mJ\" L!!$.YAOԅ^₨ ,Q[\tIh`5Fh` \  YpSL6Ъ.!EеK(qAnT%.ZjHr$.i'qA̰CELEC2%-p%. $[ J\L*3( 0Cc-tN:3I\\U+M0- ?`&9X$.Hr3I\l1H\lz3J\l'qAVa 7Y8tJI\uz8 0.i$.Va%0n ތd[<\Q[4ea܂;I[Lvh$.&Va8r,hm@  RY|hdcb嗿÷~o叿R@֯7z5]ߦ0[f h=}j9p .uLZ~g1Yf^ cXySYQä8-rҼME;K_鷗4އ%LLcYރ/Q,m wC-VVwa~ ]ob;A䯶=ס½ZO6t_Oҽܯ%)믢ߦr_X>u2X<{`ɖ 'pGu,%=Ǭpq|f6az\ʌes6DmPLRkfٿ*iPu,Pyy0FκWW);+Wb+.YWt׽1x'.;qgIub +smE=W*h +Z/͐U2qdE!эG"sݓ:D,}V3Y$MFk>/B&R9RN#⌏n%5[AdʬHT8:gm_ewOD9m{WP}=Ͱ][WPz9,;> ݵ(?w8tclgGhN{3~зSfss:>Zr&=)>?/qPgtS/w$/Pv¼ԕK,> +syN_;Vhٞ{~zNsZoSjϮ<[1Ԛ +FeW2b>ֳgB:.⹜cu|_hCWbc4ueȘ~"{00}/W¨;}]/]bŻ,y~&W51hj^S3ߟuvNlWיִ7;] +Voڿs}µXcحc7."`FOq<RP؎ +$;H]QʸO0a0q]p\t& AƯݗn#B̉ +QqPw5H26gJcY籜T*S}5O!xS̞ {XtO0TH6t5"1_ӥذs_Nq$7!rݫAOb:7 v +O +lw*&Kb5qM'զ MXMMY&.7QJ烖JUeԗC\'AtoT)ڡ3v$WN.b4_{*Teͥ) 6ՆdcMHG1l8*1ܘv&~(+/Bʭ^L C*NJyUH9sUBc塲Z@Ҳ1V +LHO[SIY1y<"Jsb>+P#P] +巙PKeA3Znʝo\kk:4[e/8^LO&6v2&l(.-6Ȥve&C^?ˡkyܨrLg2:1= EX huji}ACǍa|ZvՈԕAuromĦBhZoo]+VG}&-7j,W\mJ"qEI۔3,#.xdfL$6=xWX]07.mӹ6l .`yyf`> i*}zc$'KxuαW(P-˲gӆFs-cIS6%RWdJDQ2UdXl +S,'b)/=ڈJXrˌW%[ ݩIJ]KilY]f+ 3U-_|;<]AJU~HNRLNGk5B8:<> +endobj +716 0 obj +<< +/Filter /FlateDecode +/Length 4726 +>> +stream +x]Yȍ~_Fqƀw/`؇.F>ߏ$1%eхJq0dHW4Stt~jEar:?1)$g]r,v/.YW3v׿~b)X ,rn +8/0Ĕ$p mYbPNbA 2& +1,m1L$ N., 6J<xMJd `$xi޻(si"% $,[% JY ^,( JKd'"Kg\VI<'۴"+ +3+DdqVg! G' 1 +j 1DdK` SJ‚#MC`]r%,HV!D'd=A‚D!DyAS-0 &IybIX|3JX0&"zqK rK@&Ed%,MDRn. >3((@o *{ +9i1YF/mh ӸEa>3d² D-b_xG8SV4ߒ.oՔ#d ;  RR˦ W w^ Yf`&"UИ+EYeE۲_Yȃ‡Yw~8~{'pʼnž>\v뗃"yGM~~zÿiH('4__VS\ƯeC7zC/eEEim1|溙D76rE. +'ToRoNi1ZC,+U: ]yMQy+*.Yױ嗕cJ:(^04zjY>+V8t{M\nǬ>n8x8Bc: +XK45 x' gHT6!^gմKm]X$"X?|!b,qjlUbyv4Q%C]uXUy~Ec2D\EzTi9r^稶Sr3ƲcCYG +iJ58 5;|Tѡ6-.MwhMFcݷ&E!BRnz18t ZA!ߔM|ci=K#h&Ƽr|N +5-m .}9հV +*^Uqͮԩa}_ilKg=wtw}gqzwZNzuzbĝh!"?k9p 뛩kM'Qz6|IpHW>2*KNΊ;57 J/EP|N2q(E'X|vI L,Ukt;n0uI$(|T Gh`ARG DzKѫI2 @lM>ԡ{4 dm@t[dCU͇6Nlײ& ӹG]Э]SD*=^5 TjTWK 6Ovߩ4a25>u&jHʥZN .bҚk3Zث.J7um8- kDqIS\8؍oGm%vX\5hv9n/o͟4+gpȓ?hj&G F^*i:$i@Seu͎Q t[馱uP@ cI!aHTUtɮۂtm::z0wd߰m$6#iv[vl&I'ռ]l v +a-jm߱R?E&yOuOlVc2/tm=uF50 [ѓēdrJlf `ue]ǍzuՁ AuDu8M3]CϝK['PIU*\e<]uhW\tp q16ˡ%[9vT8.0/mQwcӕG1AlNjaci! g{6RO|闗|S]]C-;=ۂ4zhAFjJ7vJ:Jk-*/ժZ򈣨bNӨi7JSgorhɶȍT/b(XQ훖}Wo{A]#SիMw{֎xȳT pԤ56C$PFW{%cOUA"CS jICzLVPcjSE::Aoo Jˇr_l 3 A +endstream +endobj +717 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 716 0 R +/Resources 4 0 R +/Annots [ 718 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +718 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 612.273057 101.433071 593.523057 ] +/BS << +/W 0 +>> +/Dest (cb154-1) +>> +endobj +719 0 obj +<< +/Filter /FlateDecode +/Length 4676 +>> +stream +x]ێ}gyH8 LF0`~%"$ggӪ"yxXU^ }pV/NO9o(1;?י1#) +c.ú/NgBRo?GVy!T*.29'%TV0b +f^J3Pyj +0C:)8B%8sRCJ:aE[J'>@tIJN #(]`Z)-&pA l1BkN`VQ: [U面tHN t]ntA1֤.@ǽKtB0l*RNIb %SEҁ'rUѭ)&uO1;KQFDqt 5E+ HvNQ4 aG:)("Pm)&Ph\R[T( [P`Ԋ@  +ty(R\@0S\[MqJUN HQ\XIq*- +hRI` Lqؑ)wh.ʀCKq¤ ޕk 4xW:L1AEqJ[fn4\R\RKKq?CKq{褢'cn +?bLR\`£H]`¡ʼnqVf@qbR.S\gQ%+fjJ2p x~p`ߘ. ).0]В0LB cR\`ˍRX.p{HlQ^R\: [bLYe\)(x 0rM ). ^z͂s8tpHe868e:آ5 *x -JJ -p(.GMp! [)R\&c>hMq3ZYɼ]:p8bAqb)1)..Q\3` +)-p). x [ R\Gi9K)1xmYt).0A $u4Aq'ۆ?6:آ{MOqErIqMGqA[d @qNqA`\xS\GAo: -. +-p1nI7N4oz f ބGO|7.ft]x ބgKk3ZcɌ̭dʀ{1[92gA1F"0d*i?0fLM >Z)6~&/9=}1dҏ00 d@wx,:ZA a-u.#hqJE#1凙0*_>`/!4+f[2*NJgpP'+h>|`XKs?~͇FN?scR_cQ.LbT.k>W۩\s kWϛΓykOu׍Ǥ.~V)q;e4H}N05 9Y*`5tJ)ߏ߰lFe + 4$xfCXf05[عOshQnxʞtŎ _UA,5;Kpf1;@Yଳрe i E%/JO^\oǍ6A猒k  +ROI:2ordLg&>^62zuۦA1˼^JH#FN"yfaʳձj>˩NX%#][`jJY[`睍4WX9lhs84n;wỗ@(hk]ڨ|\:[HmG7v{\Z z5z`Qf9!C=*ޓ3LȺT\n~*\oux1:gvY6&nuFsӫOML|(sZ.4GCc{-c]Ac3 +2Wph3_ F2".5uq2XջV[*"Dv9bw|{ckb۷+FŬdB ++R86$DwB׃X/.Mu9Զ1QgRG.1"38(l9׾=b\AiPgáwG~w7A4dwPw=|{?;:s8:n{W ;֟K\ڠ gn>ѹȦ=fhjGs45Oz,!ZO<Ҷ~BF UG=z-#Qse;]We+ to⣵.ذ޾:Cﶏk2Ƕ9Z.gO ػUԼGCf\oz]S=5u<-@һ)VP\;;h[Ξ97ﱌ# +;o#O_QvQγvMwï_ѐi_U]WEІw<6\5ME|]U(vWp53Rm YE_i|:k[|@MQ7)[fɎ񔌺:)JztǪ.kP5bk'[':~C<A⫯%U_]vEhhӋTaO!1+ǭgBƍgVυssE&148KM;_i޷::IbGwtPϧ۪&Z3)#"̲ 8ױЖTc'W&}&MoR 橐/LQӊ8=gbk=SӑͦlPe K]PW+b="pa6n:Qu*+]՝[ U}2өRJe2*dI%sOr"_tjnc' \.rr"Mg3\.KՐZR|nxB6$uq jp>6@k+ȅr2:"~>G6+IЫ:o{^Rq C3^M*LF>![+G"qlfjͬڕUs 2f#ҹfҪ* ɼHROE}00uwO&44S{>|cQ  B\{*;9ehBjVR_ML}Qd"d<]NR wVr٧(_6uF4uEx4eoIepvx)}IOl];Ku)lym=vmmb-)/̢Mw4YT2!—:1QkTo-8DMUj:۹eF$J+;V; EWTzv:Nu @ +E&H154P>t1T4a{|w\]4'S +endstream +endobj +720 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 719 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +721 0 obj +<< +/Filter /FlateDecode +/Length 4972 +>> +stream +x]ێ$q}g ۀ =C0?lKz fdF^w]fݕA&3K+9=cpOoj^_I(?'V.N^'8M ~ :㶪3\N^R gLT fXݪ20Q;I3tQPi;QJ5N)Ӄ3z +),"t:Ig^K<|tk甤-Φ(l*Q[LVEb;Y%t%Q[TPZe;u:bO*IM+00H! +:[Yot8t ocJl54ZybLt`%0$ + $01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM uq8h+#qgQb4x9- X 3V6%xpœ[M: quy=.[Cx.wAIpj$.]m%xW$.] ^a$.tE]TNI- '$.Nd<)ġ.{ wVUa-6 @i+i2` +IU#,J,qA۔ D$q  BrS1H\! QAAY$.@`=ek  "F-.` "lA(qlJ9 XW%]0SkQQW%.ZjJ' +$.i'qA̰SE)DN ҅Nk -%.H&aXK%SL$& +%.4JL)` hB-X`e-; R2L[2ތd[I\U(L4Rd4NKZo& UXob'l7EMY$7N.9Zo& f`^Hތvxg0"2 MD^x}D|&+8c@U2P^x((/Me +*Z +xm8a}[Tp)R#3Ct=I6/~o/);eFPR;W&c=o[آL1 )1Us7Km62 ݷVT2 +bpO)a!/m}sS#b|ol+#Vo$7p[rcbzAg?v{&`dث>hF4 MDai\?3Y>`<"€46E}[%ݧtbާo|tnß~ӿ^n'Y58w>]\>r]Ҿ,2<˽]:AL2N$qkک_!kL=}?ϟ++aZo/ќ 75 "s0P-=ڮmYjc([bӍI*+8X伾u:ZiB9'Ô,UafKΝbg*VGHm#v~mmf(tˬ\!+}$'l9ch'Um;EҶ ־8Fʈ޿NRC+i3 izϖ^#Ua1'tsev1Oiҋ_K.m9 wC#;RڳC03 ^P^Q]{vJbc^RvMPouwHq᫷Cj샆lk> ul붍 +ft.q)X%;>޴A~3cRoQ|_pd[pmf)΍1A?[CU&i陯KyuCiycyӀ`7neŅ[Aح0Iez`fR ʦ%'SQ(ѿv<_hYn1fR+s |iYzz r-'KJ-:MK wChM fUrp{Xqc)r~- eApl:=Yғ;$& ?$ydֹ.#SZxgHi-y~V}z!1a?̌6q-lhu{5=&%==WQ&]6Mπy)˓Ҏqy>.Vd#5KHy +aX}zbm~1ϓzcѨ_M:v +\o 4nwqg2T-LC[< >xdc:f΃ԛ6~_;6\L.'ŋOj9޶i7*'P9Prƛy-ӡ3t,M<">xz+qAhx|r@h.~t 3\;(Ի_t;[x_lX8\=ufBթź`{rp''^X@t~s]9 i,w,z׶/2($'7eUX{](pޱ"0rg2/6+/nXeBXMػ[1CNl~?(vR[T)v૕_j1{V)m ϷP-UH6&z2;2)t&]:VwrmZA˝ŞeŒ2?4Ulߺl u b1 ņdfI-U74ކTMd!rSդ1}sAr)t8 {bmPظj7ݶ ]L]״XɚK Q*J}鵨ڻF5eF&5eI=n;Uv̦gFoɵtDn)ͷ-UYsnJMكU,l([?tJ 7f#|ܼk3_o> +} ++вr8.{'L*wv*|5H{wUf;Cc'veݥclԭVReLs5HZꚘ(OJ.TTžAu%v6Uj[]wrql#%V.|>csj%]lTv2&솁kة=d'qފ3:yQ?Khg?nTc Ӹu%枌A&]7Ta6Lh.֩ ͏{MBMі?>^l̷Mw󥭍j.xspv|gE⊒v3,#.xdnL$u=PX]0.m׹fyUVZ 44~q_LuQ{rikIR[.[%{eܳ-Snu1ʤg[x^UQ4LUY+1V’vKiq{)K{QiMZ*z-y[zK&Ax&u=mn]ww =2U=ߤ|gy])U_vBtmv:Zc78їDțlwD^ 19kU Ps+~ߢ-+Ioa+Ӝ/*{eC]FZ*wY +z}OTZ~j_f7e +endstream +endobj +722 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 721 0 R +/Resources 4 0 R +/Annots [ 723 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +723 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 401.373057 101.433071 382.623057 ] +/BS << +/W 0 +>> +/Dest (cb157-1) +>> +endobj +724 0 obj +<< +/Filter /FlateDecode +/Length 4691 +>> +stream +x]ێ}gy)ހ $Aagc# `!CxUj]ffwۭ**J}_ %B嗋JJL6x{U*`x]/l?_:EN+{Ǥ"#|^ZF0*k:F!ȩ`i0b +fցQa+3WE"N3TQ) ;Id4SV8ttZ CtIYp(*"` 9-`p:[4z'2[`tRqhEda +N)aM00H3: [kt8x3[uF,l-|-;0D%&t0t7 h90RAGFKc` a:b"q\`4lA - lK@ tK2* r.̔0 8.0\@)r\`qb{ XX9.0]Cq\`一Ơ&-0`GaT0x(9. .*Cq"t j4xW[Jqw5iq"?ˇq=tp\ƄFXqiP!: ,xW By83oB99.]8*q>x9.]e9xW(9.] A( %]V!p\`%qL c!r\pޕ xWV[L ӖV` +Nޕ +#Rq&qI0P +@"z8.pQB9mqXP-"8.9. d +7 RL&B$[| Y]Ny 'W8.@.%&= x% `t8.`p\W$FdlAq"] h؂h゠L'9.F.t$S8.D +9.4A du4q'%ۖ$?H6:b,q\Nf آL J؂(Ha2q |S) D#o"cm4.回H"DauASd-8 &؉9آ#q\KfaMD@Hg 68x7rZWqv@z-|+d V]3 ߔ#0ep*Jxfp[}j3O1-}9j1P>O^a,)CiB|i#"V8|0J B,G$#|F*薌KaM}iamxgW48֡: RҤ.hm l6_"&m>^o|ѻ? T߾-hێߣm7n DSYPӴ=仒ʷS r4n8}lKhWPlMRG5(T\w|ajK}?ﾻCTz O +fUy fHq@u}wg0d{߾'CJ"TvN?ǴJ?FLa ȔѧA=Zd|NPQ!oB񆆽i۷r>?f*S<0έyuN4}i^lavߙt(^tWw}5_5Dns:D; qf6t2 QXXt3<]^7Qm! Lm1vkzо\q>ڷy_rkxoXl5+1hrCJBso R9:CXswcIJѯx?qY07nq5_g5oK4?^hSЊ¶9VҞu7]uY=Hֻ!\jʆh6M^nȆԬ !9dž0{rSLqҹނ<1w^G^sv%}iλ'C[m;>.k'~Ҿ3acf QǤC JD>^n40cuZ_JM2-fc,0/*HVF9U|Io$FL$Fq?eiT.XdW/b_X!ǟ4nlm>Tjm)$s!3/cFNP843nbufkԖ ֊bed#slvWŚ=* tbzu\Vf8 /حϬ4O17{W"3QHm.Y81 #R YͨR݄!J1 [nl͖TUcjJ GԧW57sDs*viXFτKe&Vz\!m^+4MEdKd S3;}7Eg@*n՝YNj宰q=ײMw) fBĔO[JH.k>fIUA]' +SlvWŶ@y"v2U3nϭؗW%kn,|wRZoWwa *4vXMuطM1f*lPuk$Rҡ%TF(6jv'Ij60"mfۦl8B`n jw'0F^/dg@j/VZ,I R3lf96=T23%ȩS4h1HC6N)&;͎d2J>j[#l/STmOvTJ'vTܬlj7{-ξ%K,kk)Ւ&龳6AW#SYYCwdt\7P_GMm1;9p-{ +:J+"yC1+mg(⺢iy|#&_-JuTiNV0 T6}Jm^,CHRKC:nd ;\ +endstream +endobj +725 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 724 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +726 0 obj +<< +/Filter /FlateDecode +/Length 4926 +>> +stream +x]],}_QφI1xp}]3mO(SR22nߙ[ "U)~tQS +JEQ _rq:?)fob]pɋ]uL9?)T*~ p9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6Ì ( l gQ[UFY#Ɣjhv[eŘDlK `lQ1H4/I`b\6N"K 'hd?Vi茖*]j0sElI\` lA -Y ,-XЭSYK\`N qL%q (e ,8ׂ;%. ]L(qZk] +XuZI\֢-`d%.p]Uw1 8 +III\&)'q%@ sJ\k28q&H\L%F]P=tJ\&D˟0VN9H\:aD]tDžy /O:,qbx.3I\ m6eʦ0S4A;U>`1B26Z7T(*ObŜo|KO?^~?ݧ`~z_r?|ƫOk~]_82 CPVzn}ㆲKR*y+{lvhzګpg~ +ێyR&!Z\/׀cwXٮ!26^ͯآ8HayKm*iP=YWGZރZcחBpsfs!|Q){ö<\CϿ!==! =?<Y5ɣD\SߏHFWp٭'ٯcwBR읳Jr6{!~e1/и.A~x{\/Za}ٔ9\cQBhuγ!ל_+4UFAnc$ifDX#׭אNX CMwNy:Īرz2N|9J\-v9a׊5bp`+ׅ{{;>Ϟt=g}y$èeĸ'<Ǹ_*QMGۈ]·q0 k*kyuŏq&|,>g=YgF{O:7;sA= Ǥ'w\'<,DG +5@l賗͆qzY|zy:O1f]KC_N}6Tyfamf"v= 8k|dC +W33\c p(͸JAf2pe~m<Ο zArzy:$ߏq<zʑqamkR˞n9ևbTцfcn뮘FĴ {γadyȰʨc?I.1q{;-] [xFt+:*X%(>e>=Y{,vmt;Xg1'b2Mj7v+K;%z'ykwmywz:Oʃ-ej\^QNs{*s*:f4[_45J6†j6ƾvknfȯt:yͮcsw5F_.<ֈ,%Ҹ!Fr^dŻTgYi_ %&}w\۱y`xAI:S5Ie_ݿ;j,njsog+;hwRycȇYFw>L!r +{;m];fs(8KPCgv۫+6@1?y]8yŇGm'X:ܶSP}ّҞ I?3`@I! mxm}]ԅŗ=Q:0lƼv-ʰn}Dqu}Cd&5aE3zRf]W`6:?߫]Cnpgl_wd6~:Fpk ÎQ=j}_ 2K|n9$)rHj6^ +rC|` y tJr?&8X΃ata;Wohl|EZG]*GΆ sTۇ){TLzҁÞ)wdS,-ѡ7-+=M*&cM fUrXz藰~c*rPvh1XmLUdmPArg:vxrrԍr<8YI6뒿u3_c.~z0DՐs]By 9mKV,IZ!A%<{A"hdAL-OUyd} {;=ږ}jS'8*\3# 0*ґ"/kkm+/e‚y?oN*eS$L2 , =-Z|Cگ4gLOoaQB"'1_᤬utq,߲S+EC,~: #XTNjD;I*b,~]KR v$\ު֖-CQe7@X\=A z7TjtxS-Ƿ B z+W^E3iUhP؄A{C VXw]l\Gu u -k"{Q&J-jSջF5eF&dI.Uv̦gFTZ\ E,HV*zҡnSs T_obsDv-LUknFxxfb]|JWqe6qR/]SufLIy~;k'qyh$h{Y.c,NJ(OJ7eLs5HZꚘ(q%jbߠw;}^΂fp.;߸8t}0_QLO.6v3&솁[ةaLZqo]2MP…GY(]X q[ƭ+1_ I1}XiÄ1bzY_qc_^]ub%ucPݴ\4mgmb dtl=_zsUසu/W$h_ҡuUo-[I4ד #v,o]"- ;;+{^_<ɡ6jo7.m7FFxԖ˰lk- :yZ[=ۂ>5zhVLz睺*[uZF*k-jSXU;Nb)oӞJs6eݺhɶs8~wlddnRK*}nuCBLU7%G\g:HOɄԿe [8U!*R#s?W͈\ 19kU oPck~=\-+!iNm2A;K$e"}婥77EwЧ?'C-d +endstream +endobj +727 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 726 0 R +/Resources 4 0 R +/Annots [ 728 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +728 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 176.373057 101.433071 157.623057 ] +/BS << +/W 0 +>> +/Dest (cb160-1) +>> +endobj +729 0 obj +<< +/Filter /FlateDecode +/Length 4690 +>> +stream +x]ێ丑}ϯgC16腱0PU=ecQxP/Bz]N)yxAIIuN@JOoRx+oH1;?]Iª肽 vi_{Gݵie1QE2ZὶQ9%p1r*a=iZ<̠,u`Tf,UfhS gTJdu0D8V…#)91yRVq(s6p:-6J,lHr:B&xN`qF:آ7։.+:"T.ac bu:|X괴c$SJX`Ӱ:(tN'mdu9-?NƇVFFq: [` :c` x#@c G:ZA.zTiŒ(BH [c`&qqݒ% 3%k# (Ppwr\`@5i hPp!%9. 1` qQ 5Jz a9.@ +q\一:H⸀c +`u^`  -.Jqw5iq"?˻q{  U3VB8.]}. +̸E+ \w1Q ,x8. ̨ U35*% r\8oBI@E!cX.hIs\YX&au^HC9.p]Lޕ xWV[LÖpV` +Nޕ +=Rqi@ `9.pDq\ࢄ.s/!,V[pE41p\5l1Zs\5lq<o6<- lqLHqZ9-]xOSEr8.)G؂q"4V_qHUa6hdԼ>:q)`I6\TN؝OOQM=.''~eEF}|'֓>>O4SSN?:ht:tw4}6i|2QH[1:#Ĥ^@u0EPUm*`EN rO D[7~Q:;SNgD7еS{jc:e&oo?^+qӇwn\!^$vxk@hO~fy ZDsS&+3=sƏ]KW$FM_`ˡiWL3Si >Sۚ4y2gY2G7%'7\Z^D=ts9twDG1Vp6=td`ˡq.yBp塚|A6V`mms5Ԛ55Ԯ!KܖVrnc1uy #Fӕ|A3+JVGtt0зҼՇ_˥ջ18d%6vWJdbAh=rhU-\_f'+?ggK.@d)09cyHC?_` Cތ㈆Y$}>N?rHiҡxuRG͚dz\Ѵ{7r>W; +79{9g [ͶF˼}" rM)i;q7GA\;J݌csѿwGY;6]E:r(<>#: >G;r(Y|؝fd7{\ z\k;y~r^6`!W'5$pQ3=Vk7/lo]ɷwTђQiKy-%xRZaڎ[UfFfw$;]0՞pP{ +ȴ w $Fozߠ T=ǩca 7O[$HrҺ35LS}Orܺ ~ʷSݍ=4mPkXt77l9mǤCӾwG"=ms!I +9\. ^e-3tc{2yn*Hb܌Q'p;-mIH$e)TNXd/Oia,-Cmդ6gK̰̉MX1#DNtRI64 Lgb]Z ik5XR(XSG Jӹ*,MiosKrCҴb.*Efbڜt~bD/7FE:^KQD%]ˍM7fKO*Ԭ1|5B݄lhI&.@kf*~YϤ+k)xҴ2ahfY'?R-<ÁW=YFj宰q-6VP )`m/$>nI]Zl&mK$Uc.VuE(,OV(mL\e2RnoؗWiobo)| +b-lW+k0BW}yvJE:ȸ0icuā3*mzYHG|F?彩y\pLdicpP62lXf4y<>d)ĞS h[m؈uVi!|Z82:a&_1iWlNi:S{S$R:CKɈP6jȶ~j¤ƍHNmY6\E.iOڂIƙ=wd# I [+-xN9fA> +endobj +731 0 obj +<< +/Filter /FlateDecode +/Length 4759 +>> +stream +x]]q}_VG  $?,p#0pwF0`J"YJ-uZ7̝V?JaHU;"!<]o?_~!8cŨ]08|tן!$g]_wɓ].RF~*C!('TJ[Aq^Py=ST02VA):I3Ș("̰]0A: (%`"Fi7x4tF>&D]N#| KEIG%%-N)I[ 'R3R[6_w]XXY|@pɃ"f@Gm=d2;r+-@ba2oї˟_}q61,3sܩ>44mrŴ\9O͎RwKOe2tL|=׽/Wlw~?~Yd'XgG +U总:= 8azN7]i0v[hp+ˮMCl;~ꆈɱ{)׬ +?H]i=] }/ck4E s6ctK$jƵŽ8ַDdt-rS|Yok~}auig,TG^-rlKᄜ'NR~}29yΆ/%=Ǭc?"s|f6cz\ʌeu0u߻ɨxg}oBPu,Pu{ýa|3u9RvW,i+.YWt׽1x'(q9'vίM&v ({wލh̗fH*5t (g? }ueG6B qykBV龲tkm>93(G>>R9RwVgQ8^lͿs<\ 7s:D#QG␿ھɸs: <aش3l>|Ƴ \F/5?4-'RmoM~0K;}BwK-J6:ݓh;s:4t4 b;$zW:sYwX cI>_oߍԧ'bI +r_&=st#P1)^ޑ#I,oxIsH$K]ĪpOss6_;Vhř)'9ַ:)7]ٵn܋ִ|^ظ|OB@;=}dv1 SGZENg?9i#y}OY9vknkLUe_=E $YK;VѢ;K~O;3֊o߀b +$;H]w2kg +̯г +Q +[3퟾?K4i6K*DqYXȪU&$ibsN߱XN,K ?ä_溙=c݃+_.~|[ߘ|ɯԻzr k~CCTt&=6n_DKM5PWUL/.ds_ 3iLS8ro9ĄAqU-tIXe7poRҺ=:­++w-?Ȏp?U,8߽,⋃|5b3@i[-X[ńn-T&6T-|Vyi% ; oTk{(o+E5,3*U+)kP'AtT)ЙUz-Ge$RI'n1\=jز͔uk fi/ecDq)J_pcVQMvqAHW(WDž[Q54i2fP'pUgB*I]Jجe#qCR h +--k.B,o/tkb )k2&IR+8SXiʕ\]Btu2]-}7.u~-P0_qb^K%MlTZeL )4qѷQ\FkeumI38Lou~ ]X^2FU0[b>wƃ"Æ 1ob[ZWPqc_Sˮ2Z.t TmY˸;[׊Ցyoߴ {P/)V.c6%_YI۔-P\ +Slaf$6}xW\`nDMGmEx, \`/xyia`>JUƥƲ,_^9^EjY=[64kA Q&-ۜJdjlY;b+S4_yK;+J-3^lushwZKFAy*ٺnZ]f+ j晪ͭR>ό)OuR1c{&j;[^E!_(yJ+5;V mEWwْoBA*4&z mzR1f7иKz[OƟv"O +endstream +endobj +732 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 731 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +733 0 obj +<< +/Filter /FlateDecode +/Length 4737 +>> +stream +x]ێ$q}gK+6 C ݵ^+?}dfTfV̪$y=]Kd0U2W KdTJ9~|*z⢨FST'b6.?:jUgVS1ŨPi*F냠 +FsT0GUEA9yI3$p۪2̰ѐ&(j-`&rV$5*lЙh%s*D2HB>I:->k#:❶OxSf3k#:؂آc(3H1/I`cT-I$`S(I,`SVhf((:k$"px +8[3WIga +H\l$.p`[Z$.p[H\Mpaq] +$qJYuN H=J\+q:JAudu5El%.;*g(qw1U eSx&MxF,.*A'qw-H+7xzm%. %$.PGxp`%.zu1eH\&c4JkOee"<.[xYI\$q8^aExqX%xج%.] ^A`}SF.+SwAKVJ'0 +@2F*qAbyI\:⒕q tœFSH:6aI:f xM BdM@(J\c d B>QQCAYP$ Xr Z⬕ Z؂AD*Dbz[1? ؂HQ0JH1xUR]H +KJK I\3lTKJ3At3Fda A M2+4rIZґ<3I\((%.4A u4!qƇm/q$HsDlq$.Hr$.H Xm%.69ߌd [I\uP&K\Nk I7-I\yf ;|)0o oF 2EMY$`'I`$qA$q 䛈-f >$xi7JLV&8cAkeXgA#0e +U( 4m8a}f71-}9z1wش??]~; +Xs.o*2Lۖ ~s7ҀM76K1|m/dX63h/RrA:_VqޖF>Ł`8_xƞ7.nHf~?a>]O~wbDA8iy3 *ZS^'9|SYί~𚺼c.momC 6&6,l 籭鷧Goqnzu{3R6%)7o}yPoS{m;qS6'̓Y +vx (A!A8Jhms'w|4og3x/+a^F@wIGq?_!W'n>8P'ŕWfVSKarn˻q"Mu׏6|k_c?kaǟk,2o?~?i\q܌o.뇹_˭}6vf7~kfSX0ݗ sdĕ:JK*Ggy?w}]cs?*P ޫFn=Vch}sD,~˖O:'M0jkڥq!gS~~C051 {7 μ.)ehklY~edYB6R[޶A稶*{T{cR9u{7őF{kmŹYuܑGxtlL|IE7 BǢϳgwaAx; <L2.u ª;$ 9 u$ &\h˸$dLK˙6-W5/d~yҲi9]Aܩωby\{l5\fmm}f&_Fb@pċO*yiRf`WNh̓|${h嚽wiY鐼5^'wbl]~,uN=de& 91;=QҐ* θ+db26gJ'<A,JKѿ3w*YZn:)z]8ĝƪGzӡu?VxpsC|X_Jt|Y0 wcJ"?9y! W;W[xh?c]/ӌx!sp{@ }+9}-vlC-:) +\۷>t(ۏN0Jn]R3OtT?vWOʨ;YP6rn9j +쨝SY2նÙ'>n[k:+;|L8/`dCX ?c}gϴ\Oy:Ĉ;C"=+d8{{ Z9:OփOlwx$'jYLE,(w;?l۲_`5rӤDt cFk + + +(8'vM{Ҳ݇"t-ļ QȢqI~n@tX29XW:kn"pl>0gavs`o<ĤC:>/6$/f_)\i׃A{M/9iʱ:$e,/5M|eҎL&SkwjosA|gb.s.&ba캈%+'ALO:p~[[d!YUv F%Wz~O׻VC`zŘ:VwI*4Sp& X7+Ӄoz讋-U{ \> _8 vAn-}|zmz&sQI}-8 E~kӄla0I*˵ ]rskTlR).5 p\ohvR'ioOm&vG\}(tCMtKӕ+L*<*|28~;K'X$.c/PIn[H yLR5zhA4js?vJU.. UZզ0Wn)wD/StGOqT8*aSۭ+^\ N-L,zIWe۾iw]mmP7$Tj~SC#X-?e'Ĥ~;j2YWO!߱) [#+Խ' "t4U PcTFZ-=a+x][elȩ"77EmƩտB)?O4 +endstream +endobj +734 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 733 0 R +/Resources 4 0 R +/Annots [ 735 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +735 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 627.273057 101.433071 608.523057 ] +/BS << +/W 0 +>> +/Dest (cb163-1) +>> +endobj +736 0 obj +<< +/Filter /FlateDecode +/Length 4668 +>> +stream +x]ێ}gyH8 lF0C~?j,QKwώfUE%DYKU"=_>~9IĿ`PJ J>,0Ati߾8{ZGHkοUֈCQ%29vQy%p)q*v +0æ8̰ZGFaA* T0C%Ci)Y 9VǤ Щ91tIx]t$s)k%-4oH4<&cD:7VyE%#eLҙ9N +V\s7 +{>03~Sv?~BY@:12iY7ui.msMW yiyUx\S١s۶Ğ8m]J~N|7Q^ +mm_G)`tfB/0! ^A +5Ŝ"\Rݴ):9S2.˜iAr=YhDn]btQ*(Ē8tKc}c@J]GEťzԭ`jYk2hhWphjP-4s84n?gu7:#jVnį4!6-_tg!v}4%} aVL[";L|KĐ?[Wp^Gg% Zo}{=U>˷pKtqq>g:WĬ\:G̛g6;@γ }۾?bkv9zͺƱ%xrvӥ?rL#ڦH;~k7|Y@iwGG;䑙+sK;,֝~l>3րs8nz7q/e +#}dtС߲1cDoEcuimHFWU߱]7vXɧ s4uSo߳8KXF^uw?uΆ͌K+5:CԆ^~ki<-]AgS>5-Ҋ!ڊv97%o9Gsa:b(~{Z7f<}fYFm-#s8d?F|/:GЇ6\5]U~Pѐ)6hez_lg/:|M16)VκcNM/yߓzէm qr^h٧k9`-rxC<fk_kKwX4̹6{?ǐѣmCĻXwdv9ֽ{F6g>gy~U;; U~co;786~.u+~aaz/jO^{轤qBٓԂm;7W*lZw9ZR}!ֽ{2s7}}'93dJqZHg}zzdg!uoMy/k#2:GCdx'Hn3y6w;{;v=oRxgm3 %O1Gs8no[!xGqgáq?] ={5QCroj;G2u>]";Yhȍ~߳vq^_W}?e\:CmOF . H3g'9}gnOw$RO#. ;;^$Vأwص\V_g-z˷kbgw9b7ٍ=F^ tМvW.ѭUx(=w[WF:~ܳ#ݑgYp{{>K%SoX}*$:Cc9ɯ+ >֌ @}61dz:C~gU *zB(sފ-oq4TyU0"8 SfxE68Fy9P#<_`kM!%C?|U6C~dp=#9+Tuy[м JCppX†ycT'wcĞ\+0_N~xWW'}Jڞy?jH~(UeбPsx /f`__u}m092 ǓJVϤp}Q&~9巸ZFl;Y8~\VUv 9~Lƕڕ]߮ce)d\f\^ +5p0㑯8_lҲ턭XIn.&ֶأj&ӮSdKYp /'4kz +,*ebTRWJuYd[̮XdkT1ˉ-7Ց +TlUSfJG4W{9"M8<ee$3lMrr)WHWGlxiXfw@T43A +vsD徲z@ʒR!TRQ23ҵ&ReDR1/T%XUUq?+P#\ +嗉TKc^z&;_8W|z^" 4Zծ5F0B7}eVv}&^N?eN>x;fE=_^jv]ǵl+Nt%o$; EX jKhUle]AC]ǵ&|m[uوTAURk}HĺBW+Czƭ/]/VGѱi ДC3&Xz98Mgڒ|&Q.ږth&q@OC`jM̀Ԯ[:&EMٶSp\`C艭=wO}4ٗګJei%<^jC?=k92y[s2LurhPil6jlhY(*]@&1XtpőP}&R;Qeūޒpd+Y}<]4E6oN.\mVJ̝k.*?C&DP,V9ew'zFzd)CXcdPۂ /Pm9UZ%L*ќe0crHÐCEWiTlj]NR( +endstream +endobj +737 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 736 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +738 0 obj +<< +/Filter /FlateDecode +/Length 3543 +>> +stream +x͜ߋ$篘geIU`Cpa &[8!~-{3]RS%MϺϗev&"/ON֤`o)X?7Lp%p(J&S!dIc> `w=bf.t DcAw]AS4he\.QcAw]b\ˆ+l\EcAwHcAwϬ7^cAw!Rk:pb5pyCXw0 7,\WcK  ,yfD%Gr ccj,.{X]4Dp2U[({kòU4Uc=H]0Úܵ6ܕ &d^cAlJJQcA,:|.\B,U[8$֦P -Ƃa RLqȾl-5d&f)D0.zp2t.i,H BXX x#c,E&{d$ BƂa Ag2X$Zӱ}fX9I5`` R:Lh,f;h,MlsTl r r-zMo&d| Fd8tj,(.cYc֥7ƂBMlu[(~3i,( [RU[4e݂IoN._XcAQYc 7ѫGYI=.wC44j,lxCB~+8zb`ހتX*g=zh3Q=5@XYi"$曇qO?Z~KW~`k?}8n2y{;V,fkK۵^-QLmoeޡ߸! >L]6b}n6>}9zN~;ߒ·;}U~n 7\i\}ߖk2jmIKilcOڷY0Η~uWx}@&羚Y9+L73<0\;~b +K7Ͻ u&ؼ`kZYŗ8ն؜,myxŃ_ys̷y;+̡qO#?qU~N:ª« J}mVƵqOO`}uޜ'NpiEL͙8;famkb)POCnJPU铎uw}:ys>};e\cQ\|$m +5RߚC3J5ʼCNF>Uc+?wpgv~ngNI-|eM'' /em ̇+[; +jW?Ōa;t/8MՒ)xz ÝuޜWyw#j^yQ̒k{{p y%mnB8tԵ~+G:oΣn>vnLٙcށ##.7ښ=4ޱYC<1Uہgs3 `:o+?e,?Se;dKP۵C_JykEފ̷xHc<ȴޗC죺MO.M*}wq8-~OD:tn^Io +hyB'yS3׏n3b|0Ѥ|Ń2;%Sz7od[/mKe[XaUA%uu(SNȽ~i'׭֟ԗ#w퇭0CpO<':my9TQĮN[֝\(ھ;cqZyjbpLǓ+ldsvg_/$s`Eq)ֶՂMv{)sI +noKkB}Cj5ym-DkNJ5;qX+ mWb e{bGvujg .lCe}rB4KT<^m`TiPK 6OrR_4c2~5yoHʕZN]Njf*RW-u))Wdm$_~ֈv/2umSR:tVP]ongKSCYe"4gy㸹<دz'6x?H<66S/; K8^؁)ttAJ5O uM,X9 +m5uqhw;C[pYtnΧQڌ;yl| +/K`Y,k']mvA ci|fLӯ%y +M$',w/|}}o6Z֝xd|XWm B^6TohqܫZ5 uad eŖ޹{zsj.e:!<4+)C:쇊a;iC/8$} C!ut-w1A +L0ӲG1wfr+@ M4JۍOr-Y.#ڢaQKr.FW +S]5P4\@fMqVe㬎Rj9E:tg bg%J5lZFwNl/rɬXI*;k=ݐ3S۫CW5kg3:hrrP]"O>9F0kp4:J'"d a&'B7 bh Z-l~ਐkr .l$YlS#.Pf 8 +endstream +endobj +739 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 738 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +740 0 obj +<< +/Filter /FlateDecode +/Length 3198 +>> +stream +x[Mda䒪Cp"0`Bbܞ ,sT|y?)5ԞS- Wz/)oU$j#QdGs5J bj*IEjHoA I95XjGQFDP#\Q$+"$ɑ +^|jƇjù; Z*Mt zuT]8,{Ón/|+|FY͈!|/||n}^L@KSwOlTзU4ϯN_O?0|">#>= >/9oy~3[pdޛ|py7*bX^"Hmf|>m߾zWv<ct(6}򽞶ά:OwcK[Yzu\֖{k{l,kdhˮIU(L}KPKğ)GzⱝZovݲ?WNͺFnzͦҝGȎMƻGC|e^۸[oQen|K3Ǽz̨)Rͳomry~)ATo?ӎd#fl1s:)岨q>#Iu2lvg99VO?ʇ&C#K,Wf~Ѥ^o$D_[ttxL]7D1eZ4+ootf6MmI*ˍ{ Cل}*ô?]_{Pi!&z.g}؈%ia'kgf-e}zvk +{?a%Poh[_Oz RXd- ܿlK\v9El&@׵hq_SxLNj(:v@7k^?梁U vޠh c#W9/4GӷQ¹=r}>f9MeIOin zzniK4S9?f=:65o{pGkek'Jg%Z*gj6j|_>2@dcx\.[7ʬ)-ef%x9ۈEƟ`036z@B${L/bl2.#wi&k~V9N!soi)s߰b60Dڽy^5RL46EE/A)pfܦ:6M=U{JƎT:t +rg;;afEv:y' $qQnd{w9ʍ61<ba |S,9o7Z~S<--H]}}=S^ֲó'OW<ߥA>ϣo>kޯ)xY$P66]zaH 2dNiU i$De5ݎ+ZT={m{# Hdr +#;ܧ>}?-<,4/XyZ*m*;u9؆1{8=qzMߓܘI_>ԥ}#kUF b9 (kfp;(+TlbEʔr?uUZS%LFPVz+{0$uZPT3gκdVieŦ3u6];~G<TˇBtY Zs.,w-z-Be; +2gDO/ⷙ ]\ZcɟDf|CsyqCZmY{(Vq@n7y] (l93(p#f< +xLYOݺ #u}"=s:r(4g&qq_۶xRX ?;;wC.{2[zgW#o)H#[~ޏ,ET/ v16CR={W|W^~-hz|9l}j<&k\SZ䙙ܖ%n-vjS}ڏcm+e<k:[ UW]*hށ6ojztք; K(i\)QUf;Rv~D/J*E:^Ga,@.tvMS-k*-LiP6 u[~EZ#ʖs1hRZ7f%]UOl:k\\^/]UUK Yd6?RRfCSߎZ%UMGm.|]? &WfFڽɾxK+WK/'JxC??cm-T˲4hzvزM \_)٬2PTLY-14K>(R1EoiJmD_rˈW%[ 9S-e% }*ٺn]Fkw -2U-[|w&T/^t7=8%g]4ϳV6&t@֪]Dz /PcEWTy-)ka)j?P_vP= > +endobj +744 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 593.554475 101.433071 574.804475 ] +/BS << +/W 0 +>> +/Dest (cb166-1) +>> +endobj +745 0 obj +<< +/Filter /FlateDecode +/Length 4458 +>> +stream +x][+9~ϯ36_$"B0=Bs<ݶIOe+&Lʗr粻g7SJ9w|8}<)zbuQY+'sH6N1{_%Oz/NZg3'SL1*/2TJ[AAP=9K*3n0%p$A`uQۭ* T0CgVCD QY#负$SHdQH:kZ)sg%-^;$lq6EI` V:bR.dA` ЕDlQAiIsrNeTi3O>Y$֓6ÈB'( l gQ[UFYt ocJh54ZybLt%0$ +$01N.'Ivr%LʓJ4`\Q4tFKD`l.HL`5lq$. l ,֩%.[tpaqm +N kX.{uF ڵ. ,x:$.p]kSXdu8*J\FF ɤ$.p]wM 1h%.p]ik (Gxp`%.| ,wu'iդSxN>Q'qa˓!K\ L'̨F3jK\8L&]Q'SwAKF“J`Q'IK\2P x{ wVUa-6 @a+i2` +IU=,J,qAҴ)qA$0I8! +6c dB>Q&\{ DlqI\z6' - -$.@D0e[\E\8؂HQ0ٔsDW%]0SkQQ݄XK\Ԕ0%.O.I\3Nₘa dK: [dK\H:%.H  UfP`ZtN:3I\\(T+M0- ?`&9X$.Hr3I\l1H\lz3J\lA'qAVa0Y8tJI\uz8 0.i$.Va%0n ތd[.=^=KּՆijdS{X|2ѶkRvfOfQG؛U2]G<VwҺfVsZ2P΀RޗB[joȝ6;qLH҅u}o5B Ncy׃[h?GSE#G[D6#"kGEd<ݢF(n<"oĄ;8^[Y.;Qo}~_~>6y F9 {m[Lbπc1 |=[avkE~0áFzs>5e\k>i0Iww=ph{+b$xe?-\5H䦷pȽ~Z# 4mP?~J}u`Ә;Zy4ckIGGPt=iw#P FDّ=ڗyD f#bIbyێ4p¼4"G?o"=ӣ<;V/ZƉo:G}}Z}C9kʼn1湶yamԦ/BA<=Nj>=yͨewĸ<Ǹw:G:rv5 >1;W9ݳ=+~k4Hˏd}}փy }Fs乷T]AftauKr{;H1<OsI"s0Nosxg3qzY|z<5Z'QƕNl9?9V߲O܈6-#F*C}y +y8x`quz!dKTZ ¯SsYd4`n=o,ϣ!_k`'`5[Gb{̽{Mn;hc`Cص%g5Zpg WO u#T㺗u :Ԕߝ:TFc#k'g{ܓבnR`Hx^jTv|QAf\leBګk3pe~m< zAry8$_qzȞqa-kRn9VbTц]+iyWL#b:ܱ{0ϣa:{~ׯaQouG\&1Ĕcy^wVR4ǙQhg$L4?㡂_)=& ?<{~W~K +MomF^cmc`_a߸w, v tz_Ȏ1&o)nڽ1.ZOX:Os.KK2m9a3tᶜ⹧6qcGJ{vKOWtϛy +A9PvAg}^WsVw(y̜wDjw{ae/F uI(myeqTvֶ$qqI쟫[]%ϒWw>~9%z4k[N +ҦśInۣ̂Y'gz\=cm:#,s9IB.sxP\-p=?JQ [DU#SKXQ:tsTު]bexGQ-L֕dt}:(s﫰 &4~6{MB}ĦAh</[ }'ơK,VpuOgV$(iҡue/-[I4דw #v,/J+X_=wOPGI7+,2/ۜctQoP+˲g[ӇF-cIS϶$RWeJD2UeXm +K$z)K=y4'z+aʭ3^l $N- +endstream +endobj +746 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 745 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +747 0 obj +<< +/Filter /FlateDecode +/Length 4211 +>> +stream +x\Y~_1L(^a`@yƒ`@C~b7YIj*:*r۝-~>u3Ԝ|y{zw&G?梱ogg)j* !\p?K'o7&̢`rFU.(M>&kX#ftdeAD1 +]8*ّƂƬ[ % +^h4w&5^&erijRJh<,Z"djgCՓCTC9 |RN`!K!Ap*JY@ aAEÂ%[xK% bZ 7D@.\jXةaA"ܳbn4,@jX@SA8@G\ p785, .kXaҰb|)VbIA  #enஏkX@]O>iXG1V]@Hհ<4,`ƣ,Ѱ w]ESbhe\IÂuSyո +q -Rհ w , 2װ w]@x]հ wQ7D ơа8 UyZ X [$*/8Ӱ`l,P pjX6aAZB٣ K(^5!lFjRh#wș%"+‚Pݏ=l4[~K$9A +}ߞlQ&A~2ݑ`=Z4$ؖ{Ö`it1Z&A~8al;DN\ɃEϩv4^NSAzm΁.l\zvnkk-M$ (+.eCYd>t n|h>$騚ŇCEPA=9vL'҇C:={y_%rT?e7kx M9|O +,V,{{bAJ@>s)%'6&Posyq5mHRlI}W>}nDlGAߗL;ͼak}HOe-51̫ +XGMaW/NPN +W2D}ķhd>>x{ ϭuZG 6zFk5~£/y~91'O:, ~yux(Ƽ{;oVQ2@qSاRt)b}S9Ϻ;=.s&嫅ޥ>׶>c~iyb_qǮK[mkknmRM^Ӽ>3j?5ۮ6$ /UCgc_$'diVWui]bڬ Oaȴ/[sIO{vȐ}#zYir%Bn9-™!]n!uTqn[f}_m:Vmno4tJsX]է6qM{o4c:˜ù ۹'Nt]柎/qD. +[ygq^ y?v]#d8?O!rW rA9|ha9w;ˢmhjF h\Xgeͮ#oQ}d<$y#8ǘ)G9/DZ{8ĥAm=зX8-qJba>-ֹ{0r|Seǐ8V̵;d/+84C#7vi +B?"KM]Ϙl(9Qg76^KtӋvI'^ߺ7RيaX+NGF +5c&T]Zm-jƥ q[r&w_~oLM;w_b[t5[tiGFmSΑsO%E*߮{B^ b"Gpo{gH!/ur>!΄e^!z皯;tw[Q{2;~pzKʮG\>PQn$^oxUj~.f1"}[BH^8 S~ܵeI[RT[DwTq;|?GP]QW7ۭ^_l? t̂_ـL~vGH sz|Cwz}}~#^6&wpT=1ž+mooΛMh“?Ogn$ʑ<]؟ć7>5"wYi3ОBMV<5&xQ~k0$(OEFZmC?\wB_=gg=tO,ޟzv‘t y6'=bz(1uǀ$gG.XAGM.$ѥ0oE0mST*յ!T[аBJOm`VgbD]夶[GRy*k횟LWe(^]w>_&bĆqKm~)҈In7[lj6vד bLj.]UN'*2KjN±9[%IzCV<|Vg6T2Aϵ 5cKv!g`$.8\aCrюɒǸv>Hrwj!W|'^Zb=]I&ۑd8(LчF:Љ_7? 2㩥9烬iHVY_:~ǽhn2{ʝd~O]'DO'ٕ6voy{4 콥Wԡ xxiq2j>~)B +r9,fJ>!qMgJ 9(.ńuJRN2T4Eą(#2L4+ +%pr`rrҺGz0u@>HXS.rN_{N 0ͅQA- I6D14iceJkj)bR*CQZ%=j)(JwsuvdQhIT-C=۞2h +fejgxh^>>ӣ?$ĕ2$jr9kKJWe*h}U$r&P6;~S.qYV)[u'\{Ug;lB2V-Bl> +endobj +749 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 265.954475 101.433071 247.204475 ] +/BS << +/W 0 +>> +/Dest (cb169-1) +>> +endobj +750 0 obj +<< +/Filter /FlateDecode +/Length 3991 +>> +stream +x\K$@AFc 3kX/*U3;d0;]Ue/-lM%E>>Ȥ@W[l.*p[bBɤ\LJ]m{tl8NXM)QPX,^a`Rr!*h XƂ!sV\rX ++C sV.YXÖ%aʃ ³D(=j; ׀ciBwb5p( "pWܦ1 e A4,MI)jX OEaA" KANakS|$Ys$Y2hX[M E R԰Hfraְ | Zxљ*/g)+ 2^pIe R,8*k< YdkXH:/εg{>WENʱCECGO2 3Ry͇UKXuo +uo"BnQPp5~͗2/rG<+e OOqUGIׂx78U廎~i};v7o|sU$\?o;@zGr:ʎu?}2`s<׿I3x`׿q聈'B[[ n-~O ߍyvF[in7xcũoZv&zѶhIF{M#|'Zs<4.T J*u\ō9=,BUNj?EqVi;^Up"Uk;';dwUHbQd|Y;[:O^Ӥozݟw]w?US,-sjc^ԭ߯?1XJ~ׯdϋ|UηkOXN7su]7_+_iG(xl)?gr hS;y:dY\e4}V*-=cȕv<[F-"ϞyqV:.=&W,~134.,u^Kw?<\1y؍}>w6b6Ĉ@ZKǶ}lyLGǒ/t{y>䇼/cSl̻-XHoCd.D3- Y0]7-r\k)Le,_oblI/ٲ<SPLrEӻ+)b pkҫ.Z?yJ^ةg58[‹3)IqyEq+:Xo'N(ᚯDN v:'xC{|bz,a}\\Tsˑ{}8L} k2 ݭ[w9fVdpm>2bc$:y1(dl6٪X{|g}Çj}A3bmn{x605Urvb0=+d$rF׏bqNɔ}K8Z?p|tFMrlv%6L3s]Blz(!6%Pv 8:^%[O1in7yNں4m%iR16T.uIҩ}64c3;5yl!fHەN!juw*Vyt-MCa>w+ae:#-Y})OvΈC~: Lo&iN4ePSnl4yG_"t O`܎>$r6;y;갦ieS6;fR ]cꤲ.D:vؒmNkX9 9tS~ؐ@}h's}A;fr;n.owFbj2ŵ[SK]qVzL1?Ϛt%yWY[y-ٜX= +-ν;GKhsvm2xGdJ[8k,{YZS+!6&|}!,HIȓ\WDZd a{JV^FΘjQԻR4> +endobj +752 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 606.123057 101.433071 587.373057 ] +/BS << +/W 0 +>> +/Dest (cb172-1) +>> +endobj +753 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 296.981993 101.433071 278.231993 ] +/BS << +/W 0 +>> +/Dest (cb174-1) +>> +endobj +754 0 obj +<< +/Filter /FlateDecode +/Length 4871 +>> +stream +x]K$9ׯ3?/ H4iEZ8WfFUV?Hg9k|eȨr t|UJEa џ!LpQm >6s_~q׺9[sƟYTL1j/2X8彊 Qb bH1('/ YVq{V6XdѐXED + OQ JH‚1hUR\H +[JXK@ IX3dR[J3Nt3F‚d! A M2;4bIZ83IX((v%,2A y0!a懃m/asDdq$,Hr$,H Xm%,mr%,㓰 M0doZ$aAv&Bw<$Jxwv)yY3w1 !<"v?%Y5;;^և뼻XbQw\XNp/Z_cj6:]&>u}E^ݞ匽:]).)뱙KLҢS.[t1HuX 0Ɩ4Iw2tD7W=KfZq|((⺣:{cPf7)GۭnJi辡xA[g21`Y(>̊f[u6uz&c\.Z~Үzy,FճU~Mƣ]Ե449waVjks0]_q9;P>aO)&=0+lHƓ|2x%T]ƕ 5AW|Ds\Ner&NY޿?0q:N^lÌ*Omʧna;d)E21[aH4|t  QEc-JʁbNRK/?-tKgf*I䯌6|o5ka((~D܁e8|z;Q$dDGu_/<4?8e Af>CMJ1O<'?SrD<̙M:_0:M8ZUp:i>ØjWI3(ΠHRU'{-[e]qϻu*X^;A3|L:J {}[{vpրKY*itG&T0jpNp%H=d[{/ڵd=YzB :uny^k}ls&'2n~kjr?_ksU^S"C V+}nLɾ귎H%FCQp u9@o?etÜu~͡kIo^[)jt?%쁢ӪAvC? :?b4!cˆ_Gd?ᙻuN.e`p35ڐGygC.eoYi uo>:ػP|2cmnTjƕC}B_Sdg}^h_ҹܳD4²Kv"OۖѫC<٠g u 1d&Mwδ/?#j=5ɳz6)/e _oS(oB0m8:rw'K[Hμ#& שM)5+5K$_a_`,A<8o'~`f䤇 *?|l4~.P;|1MW^VLuHߴ0;*ڎ/~p~_A[Q'Mx RϬ/RS2!&J&:{u +BHiJ<\vdi'rNG,15wZS +0YOytIP*;_TU +䩠 +endstream +endobj +755 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 754 0 R +/Resources 4 0 R +/Annots [ 756 0 R 757 0 R 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +756 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 713.673057 101.433071 694.923057 ] +/BS << +/W 0 +>> +/Dest (cb176-1) +>> +endobj +757 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 373.781993 101.433071 355.031993 ] +/BS << +/W 0 +>> +/Dest (cb179-1) +>> +endobj +758 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 354.834971 99.933071 336.084971 ] +/BS << +/W 0 +>> +/Dest (cb179-2) +>> +endobj +759 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 335.887950 99.933071 317.137950 ] +/BS << +/W 0 +>> +/Dest (cb179-3) +>> +endobj +760 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.046885 99.933071 260.296885 ] +/BS << +/W 0 +>> +/Dest (cb179-4) +>> +endobj +761 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 260.099864 99.933071 241.349864 ] +/BS << +/W 0 +>> +/Dest (cb179-5) +>> +endobj +762 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 199.152842 101.433071 180.402842 ] +/BS << +/W 0 +>> +/Dest (cb180-1) +>> +endobj +763 0 obj +<< +/Filter /FlateDecode +/Length 4696 +>> +stream +x\K%qޟ_qD 0@&0!U9|n>sFx.*>WEvu3+2[sIϗO?Ȥ@WKln*Ml ? +'Jp)Oow;?7ֱggJΆބޤU"V&%Š`h,;>Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=?{> ec`_r^BPgY""$|c7 + Ejp7c`1[>>_ I;${m)MjB #]Suf~4YeEpČEW^yw>^<}8!wӤ'o Y~<}_N. +Al@o`׿q聈RDօneD( O?/RhǓLSMr^K7q4[f~7wq>ӮʯB\ByGSn(p'{LNi mR*%ڈd=0U>4%KbD/`=nѹyRecH Q٤',Kհ>}}\E8 hҿ]u}ia믶mp-3^mmޏߗ@~{zߍ[cpN먍aYCm}IzbwPo1"8_Z/!tcLw5y8cl'DT=~nm6uY~0y{̜Ōڤzy5lkأIJmYeTϭEId4мTf+=PU򶽫Ӑ +vctO7~7ymm) 3tpM%B/b Cp(aA󃁸(иL %>I<_iK`rث tqf`x]u~2;zSi$ \m1%y*٧{/!}վw{R["w5.+mλ>ӮB;a#&Y,p0ȇ4 `/jPSiRlCO0wrH=(CA;^j8dSvh8 +5m('MIC9܄N3t b]IG_yhs269|%jhaޕ;r4^== ˍQv:E\^!I)X$ʞ6x=V^Qr4윾{~Y"B0q϶b3D6گ'?hsyrD<,%Ӊ_wM:)oʒHòroj)[k1ØPM:龹1*J?<[ϱtk>lߞ}XY^VR~d+j˯ǽ2xpр KY*"е>cIBx+i:\m| \iRmW,/Yǖt?A ݿY3 K'`%7lazHIA1r>> =#.r~>F&(|F s2D# i;{4sk1Ju\RSfpf `X7g#C撳~b;mScrh86%f}o7+k5Ҝ=?>!q:bnVd%YXM:wMFNbݲHZ%p \1u}n^‹)jdDL},Im Jos4Z ՛ZO{x^f#/πsLVZi#GϳGs4m+=d:?%k<e;4{Qϐ ^w:SQҔϲ>q65U5yicۿd^kX{31֧mo'>^Cm'ơZ&\s.c5ikfUF?ڷY<\fT#[햴k׭g&NDOJ÷m#PϯvoKtTyk^^_{祭6o-5}ldol9d͇؎zvGǔu>߶_ǴF\:WR+ӯm1uƴf=q!ms&?DL 햽vy[f =v~G6"g=Ƕo="y)率,ك2 ] +!X__̕_?#[ΑH_:] M׶|>$/Mq9ͧsv. ;߆w9m^ʚ`MLl{Y2Y1S/Vq &3f2,r<6M*֞Ԭ,A"^qYT'Ǔ<OQ%gn$b<<KmavJ/郡rxm?^Em4R?j*0S+˰K +5=edJv!@Xb%&3AˎGŻdi"#qg vgi[YEЭSU|,5մ$TJ >O +rR_Qk1?͚|ra!fH˕VN!]Njg*RyT-MCa>w+&Fȷ-Y>ה'q$類a`fz3Ovra/Ϊ*,F*B + ݤnt"kJ鱣k={픺7ŏt{鮱 uRDO' cK:Y cL&M}CrT΢=v9v|ɩϸ/ty{7:6ޓsduo7:C0 }Z;:WXdǽrnhV>5GY({?/0,~QG ױuC=|>1?H)6b_6l(5t?܄<Vv;Dvtġpxi2;7a/ xvG +7pp|ĝ.\vSE̍v 6bAΝtՋ0vөm9>owh姵{3-xs3DͣZ ̝rm:mhhdk:j)bP2k:̳ҕYnx=Z= +91:%{,Zkw*ю}m0xGdJZ8| ^Y;NR> +endobj +765 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 653.523057 101.433071 634.773057 ] +/BS << +/W 0 +>> +/Dest (cb182-1) +>> +endobj +766 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.576036 99.933071 615.826036 ] +/BS << +/W 0 +>> +/Dest (cb182-2) +>> +endobj +767 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.629014 99.933071 596.879014 ] +/BS << +/W 0 +>> +/Dest (cb182-3) +>> +endobj +768 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 558.787950 99.933071 540.037950 ] +/BS << +/W 0 +>> +/Dest (cb182-4) +>> +endobj +769 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 539.840928 99.933071 521.090928 ] +/BS << +/W 0 +>> +/Dest (cb182-5) +>> +endobj +770 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 478.893907 101.433071 460.143907 ] +/BS << +/W 0 +>> +/Dest (cb183-1) +>> +endobj +771 0 obj +<< +/Filter /FlateDecode +/Length 2686 +>> +stream +x]dϯk咪!CpE` Mccz \9GzafG=RU̻RjNv~>nr|5 +Ų/@5. kϯKpMerY"QU+Qr1UC`FYa +fX +P^Uf썩`11@t>IOLKJu:өGtեba:-g[7-%3]-T2l Jt`w-3]Uk1 +\uAEU{7QX.$Rl*K!wg[BFulAq1 cE+Tg9+@Yq@C< +l Rlj` *0–`Xa0(pkR=c&>1( 3@A\- V +*X.=3(1vJb,PpW chIutt2^2cpXUu؇{ŅRP GeTwC (`!1`8Gh4!e,y]P%iRcAw}Q]u>cƉbO2Dp2Dp,`É "'5Ӂ>Ta,.X<o .U'ƂKP]vH0v8 8+cAw%2$pW a-q tp[V]XawEre,Hn;6 RnP `C R1WsN +t.9#cA"EuŲ1 vUka,h9 \iz[]h~`"cHJ5c,1!ì2] +d +t>3lGg,@. +w-\b,yc,U p3- B=cA  cA Yf%1LgXP,*2MiT[ OK#c$Hsh4ƂRBK7 cA)%H`,lff,[1TIɌ8t" -,U&R0_Gھ[1ػs񨷷cޘӺiijݙ^E9޶Nlw_ν^:q]m%˟0w˘ož5bqsG9\&Htq,׼NUr~O^'\lw8dq!0m[0LN<;6s9tmֽc_G6sWeCD~\꽿w;--=߷bR>cӲ}=%FjݙN:K 7Z4|GXdb)~<—6-;. +e#.q~7(]ÃyXٿu\cDf؛1j襶珎-ы]g) S!/|lbP8XǷlL]a:u~Y^7e9?%nV7*mW|U}vu.F!XDD׍jbj-Q:o$jGD׍;JQ̦4enu-clSۧ{qj+Q7IxۓLj +}B];E~RT58<2ެ4;i9Ӡge|cϮ勐 ;2e؉{~c.h  I.5wi{tA-`x=ڇ3C.n-؟b_fw8CXxmL~*sq[7x]f&~Bx}޵Q>8t-V2u:JZyCkaiR̶!N7m] +m}-%hE:.GTAka}zg1wirФCz[c`M:ǥ}q9zisƻt=AtZ]aݣfgvj]vi?(. .oݦt6ӲY#י몌I몤ђ(9ɬ9bBdim=6kj=m} æ!iF2ŧ_Ŀ/íտ_M#jY<&%%0r5|Fߕ=a9J 7(+Wͪ! xʖ_BhsKۿ}i zK: ݯڏ]2| +endstream +endobj +772 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 771 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +773 0 obj +<< +/Filter /FlateDecode +/Length 4231 +>> +stream +x\K$@ AaV>̨Ȗ0]Ǘ9U΄+RjN||8}<ђ#_kho%J<BKt~<ΎKg_jM%) +`b\r1,V1bfGV\KX/@م#B [,jpAb๸$(=Yb  쓅pCf6D;,X ߃烅lHK,,]W1 Z\‚u3yuq7Z^\J‚F,,]g`GD ة-pJD.haaqH,,8뚼P-‚,y /T$&//p$gax!$.jaAR ‚%Fc K(5!lFRX<.9Xwr we۴ e!ba\{ R,,HCg҂haA&" Ala륆Z,,-, eRo<,p>`ȂL R*9&cЪK~)pm +x.[X3/؊HdaϱB؊⑙[<Yd[XL<,,( *3ءQKBIbaAHha&A?(6Q<"[XPrXXP +d-,oJ-,YYXP)-&[X‚ +M .,@7Qq[Cz3[XPD(& iFPo,^,5%7H3Po"7ԛ<. +dx]d\Dfk,RqĀ{yd@^V<3 HDeYyjmLG'}D{fɲȊ`dv6uzY;)?Q0 k +k8A!(&E~ 3"to pMvjш"#:8=U]it5CV)EDO(P^cmt渓%^R޳?ߧ|/ >3^r>S%)'%p?ULK+ⓗ孪|Mە~~c{DR@Pr"WX,Ϙ'иyylLwf,+-3mI"m߭t][c9.%E/!ڿclAMSnim/s&krj,^*XL!wziY\dlNI FfsF1m~}'uu7uܒ#䠹X‹LD`5nzYt/t߸I[4ei1ևot+;UDۺ_a?*qg N]͟\ z~|^BIq7-]gjƆMB>Kænt'>s3XʷO8zv#.!.lx}=&|oMoo|6qx/sVz|rM}Ń<WXOiYw\BH>ދg>r7:d3o?8$?)ɊWg";.q_S)uV?yњx3t{wr\&P'촂uc<ң:5)Gk;{:'lOAs-;{::{뿮FMn!ΝzOE5_k?G^p>tSoZoHe|MŃ_#m|覞򵞞;GjB۵{zW؏<7q1[z,!=ן UN~!y(*5}6tgMi_Kj~Ÿl!Et=H=4,lg u|hpxe_cHyaP(g-,ؙ~Z!m#l>8rmJn9XR1VWyD\ͷQ->:جub]×fxJP@, Iy.,ϣ +캙\S;?ѳvh `&u e /~)I~T׮A J:a'$oSaWVWbģ] dFRy*k횟LWe(ޠ]ԩNWпr`0lME?/#'ݳ{l'VP쮧A;ȅLj.]UNgn* +/KsjN"9{%izÖV<|V2 Cc;R'u,3R &9W~ܑqj1YrwGMN^0*K,_$ivs2E&yc#h$/v_gY;S|^GgYo8fu4lݑN&o+wp8F=+؟dWfؽa+ٝ&n \MSzf J#z0Mtp2yang5$e:BK5aԓ ՋMd.u sCwZ[j8 =0;=icvDN=:}P5u,Lljhi9ڃwjhT셑И.*jݶQOʝo.@N#.SںuSKyw騭2Uҡw-EyfˑKtA2tqnw۳ZOALiv¿Ď8ժWkWQ&]*)CX^y[?L0!PvNd[G0 5T_ݭ)טRvB;YJEynȫ2=0 JQY +endstream +endobj +774 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 773 0 R +/Resources 4 0 R +/Annots [ 775 0 R 776 0 R 777 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +775 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 488.554475 101.433071 469.804475 ] +/BS << +/W 0 +>> +/Dest (cb185-1) +>> +endobj +776 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 427.607453 101.433071 408.857453 ] +/BS << +/W 0 +>> +/Dest (cb186-1) +>> +endobj +777 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 115.110432 101.433071 96.360432 ] +/BS << +/W 0 +>> +/Dest (cb188-1) +>> +endobj +778 0 obj +<< +/Filter /FlateDecode +/Length 3943 +>> +stream +x\[, ~_1WJI !B0y8{:!?Ӛڜ$TJJt;[~'39|ɚ,~jEeW +gg9J(TO|Ÿ˵Oޔ ~',&rJ6(uB0)VtK,EcA 4`89: +ɱƂ[ e&\0J;sE%\.8WL1dǐ%4^,1[YrxP$ ω4^,) +/CXWVyF4^!JfVy &d"3I*MIym(*^daj` z G `(ch  z8Yϓx%+8ZK԰ w]b\hX8HÂ|f 'װ wx]հ w7 `!аq%g p5,)lld`HNC5,]EÂܵHÂܵGA^5mFjRh ɂY*pb XB%kXuG>$#Ѓ,By.>1GTGՇx^GG_7_귿?<G[8",_>In:sx˷NPN.6ט*p%\.oҦ$,bx p#͆]kǥ0 *e쫷Uӗ_~T|2ᗟ/DYQ^FFO_xsb !!jbK6H e]{+>yܯU/~o3G 5e.cw&|rT,2 E"H/7s-QخClfTW~N.\s5i&R,:k1H>dcc{bV&v2l&-txuVh.Œrêܯک²ʼ~MG?o_rU&)XG8 +!tDZm]AR8s-;}\&xFz^6;r1f#}k.Lݮ-*] &6_lVm]v96\[0ηaG/s}8ˤ}tC$YznSeߐnu=;]ݦk޴n#vS7O.gU[|=`ÞB-ܱt[r}W_堯@aJ:Snzdǹ9fVvuNwnG?6a鞞䚭/g M<<p:v7Xa?Ikۅ.}07ag^u]]v`=' yyU}t׶:v-:eݯznw~T׮FPePCo96>)I!~nЌeA!hWz;t9haTZ()+˒T'vG,{cm^Sቓ| +Ii&VMo%2 g;eRSkv.7*S8&%̫9 @48Ͷ\JfW}l؎l'au,3r%.0LyGrɢ[=q'9|^i츓犆c;R6&>${;N9B&ys%wo$ߕN'Nozy +^>15rel縷-y=KdNn=/?.϶[8ǽ_gw;tA0u0]hLC\iq2?vo恽]R_!yKu9̓GH>/CJ#\KG\rLvbA Ջn\F%Mcv*&iXfNZv(Bٽ~7ch:&x:e_3'RyX g -xwBͳ[kIvbhƈ[j)bRj:2]2n?FD# +9:;[X2+T-ӎs~~ڞe$nMQZZ qy>Ɉ]"O˩lRyucEJ֙lr5c`P+nŪKzn>?Tg~\ B2I(_+Ef6dǙj'k Y +endstream +endobj +779 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 778 0 R +/Resources 4 0 R +/Annots [ 780 0 R 781 0 R 782 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +780 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 770.673057 101.433071 751.923057 ] +/BS << +/W 0 +>> +/Dest (cb189-1) +>> +endobj +781 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 458.176036 101.433071 439.426036 ] +/BS << +/W 0 +>> +/Dest (cb191-1) +>> +endobj +782 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 397.229014 101.433071 378.479014 ] +/BS << +/W 0 +>> +/Dest (cb192-1) +>> +endobj +783 0 obj +<< +/Filter /FlateDecode +/Length 4574 +>> +stream +x\[,ɍ~_Qφ Eq30 g1uNYz }ؿOqLUVvOϸaOӧ+(2+UR/?]^_i(779$ .r˹寿c\9X,r*X,m^h}X(,1g1|$K{VXM+A GѸ=+C  I,aha"h"g*@AYB6V9B$*#6Coă,Rxȃ,6E'"dNx ȃ,:h#S>'")=j|rNKив2!d 6%, 6IX`+aAHrA‚5xD^PD dX@.,BCDP%71|Z`2e]4O<`\%}mwt(`p +#r;ԓ}]gzϻˊ +SrB>jP:6# uu4i:ݝtίp}]gzϻ8yi^ Sy EWNlw\Ab?"#^$+ he9 h1HVHNܤnAtlӏ}0Cm&7f{W!Tԙ(x +l#jBHorM_ЩNDhk4b(@|b\ e?4mgͣ/Rt. +`iG!o+0\ o<ЌNy7բȩ_m?*xwb?fCL 'Ocֹ|k9h~^c}y>l"nlz% O,-K0Uf-9\P h%ͤegE FA_-ן믛l +Nĉֶm.lͺ_mnnIwrbHeъMdoQ˱^԰fAĿ}8*}u=ۺzd ovY}[fcO5 f2cmgxMaxrkW4gIv6uaԼF6N%yh7,Q eGrtO=Rv] ?4!.p[N"g]b*{iYzNSxϕ.Kw lqۼ]G^>nȅn7^vX7.G4ծuFOȰȂxHWd{'2#.( u 1?__uy[>1myaޜhcXKx=G1Ƀ_1iiW4{e}:Sm2£"ߡ-S_iҷ΢X% Awcʫ i|1V m"W첆vR7-áv}FtGLӦ0yk_6J>ҰNxx16h~x7z4LkmyHo~X8v(Rq^.vʄRX=];P|F›`W*'7U@@_Ǐ0-u}>~p*p~&_V:~)=0}>Zq;}mR67* 5\bݵJqcmn_q+p;|yĉ{?Xg3GcjĐkl8wgy!6+Õ6)zM_ߊ&(MR9o'4,yw;Yyst&2­A6n#?;KBGpgyhf,?({ly|4+]߷54ml5;af5۹~&9ڙuuC\Μ-a[O(Č>ժ=My{Σ;V8Ōg3}> @ǵhu9[q69Pܖp\G~뗅o^)p5S'AG~/G7g՚Uŵ޸㠧u}䁙5מ鿚3Z7Vt-FX1=Pm>k^b[5>Qc?uѶ^֚=uSO;i3~?ɳz#*AYn~dS^PCRbvd6Xsӳު +LA{¦?^L&/6BN] ˅@&G> 3~},2qF]-W~drYo7GߺiIF|tX g0{2^+Sꫤ\ +] in;zn-5y *. b}Vq#iݖ"R;m];MBNe$nnC6], z ElWG}boF4?DRW@M-G~#ڵk2? +Znxx8/~`f䤇 jLMU$A*|2I՘}J顣I0GI]&nLB{޺klET6cn1HuXMNfkX9u "9}wUdL:vw[8}V6ڒSdݘl" +<`vt7 ɤvsyOgRse6\Gl[W$Wd~%a#v&dF[߬NxMZsg:ȶ5nҌ? 6Zݛq`/-8~E +rpύ#: +n:tpNq1i<$[9OUӼ.0/8fbjdIJA7*rh2S˜Or֗qaCC},7ApZbщFϓR&mE tc)nM-eIR1Š}ִw+ϻvmyvhhc$ܻSits:- aDzto¿gSuZR 1i5+r)`"4>ǵ}EJ晰Ke^ȏPr%NB)hU[YK]eT_8MȨUUjJ(_X +endstream +endobj +784 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 783 0 R +/Resources 4 0 R +/Annots [ 785 0 R 786 0 R 787 0 R 788 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +785 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb194-1) +>> +endobj +786 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 736.726036 101.433071 717.976036 ] +/BS << +/W 0 +>> +/Dest (cb195-1) +>> +endobj +787 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 409.229014 101.433071 390.479014 ] +/BS << +/W 0 +>> +/Dest (cb197-1) +>> +endobj +788 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 348.281993 101.433071 329.531993 ] +/BS << +/W 0 +>> +/Dest (cb198-1) +>> +endobj +789 0 obj +<< +/Filter /FlateDecode +/Length 4800 +>> +stream +x][$q~_ςSK lk1~m0s G~Yyʊ]m/ȪW4St|墖wՊt] q?%/q.fI).!JP)msKyA[LIR ^`$ c0RvJ0M +f䂠 +vh!At/^|L&FY@iIｋ`KJK:[&RAybU ;IEtEQ[WZ%D]N:⢵Ji8`ӊ:( \uYe$-Ip6(VgUVK:[ $` _ba +^̠%&!L E  +J4`[ȧ U:%" +8X [3WHk` +H\`-l1d%.`[Z$.[RIK\`paqm$qJI εN ,H=H\`y#qZ^ ޵޵5El%.;.VG+qwVAb 0 p%.V&*&` uax8܂rwSF2^e(1BX3V4%8NX9 ZtL^'Ң<.[xy' x wAQpH\bt]mw78 E#ۢ+ҢR8.hH\UxQL" i @ƋB*qbyOxrJ\:bq tœF(t]1’THxn^6%.! L.>ҒBC'k'qAP8P-HK)J\ lH\ lA q"%iDbz[1? ؂HQ0ycft-"t:H\-XȥI/q~0:M[0U$.RD\i؂ [Di-qA4ѠDd^I\$\-H<3J\/9T&RЄl; D#`u$qA&QaQF`3A₤` "> K%.CIG䛆$.f Y|)0o9 $-!-0oI7NH}73o"b7]u $L@Vg23; +밶[ +܋*{ +s$qf"^5 +Vⶁ"'O|kf &!9(f[˯߰^_ ҄ +$ Cq#64XTmH, "l,,xuac+LƢ62!sv )`d&֧<49 &HA˶~$[le>CҌ =su@A*+T9m9ɘ#)PvV>hstL}w4X-&el2ys#=x~룄~Gة~w׿?~g ˿"u7?h\wQL\XDt۶ʛ܇a[_jrwB;qٌwL_~q7vق$h+!6"ܝ-[-CCLu4JV[YwZ#p`oTRnIn-} !m{+U CLj;qM$ aa-=>2_m MͶ~AܷK Mq' u}[YfD  +OJ.;$=WJII0!NZҔx{ݫg~z5 KyˌTnB&le3e6Negݻfcrȅ*7G]8E64v8uęˉ=pT3mAOtsVY3GCӗ:eae6_R #$rH|>C3?6 !m;}%џM;eNl*m pć&)׃!\CqL9qy cK7mz?[Sm{>Y'c7oD&CS+u޼ "}y9T?/" 7ӻ'c}bodWC=؛b&\mW9k5fع8o |J¾rͷ6޳C{ɾǡ>l˧exK> m Vl;6 On`]e{v],=m]ݎ7;}k?f^5j۵OQ1,c[pv.ös>?a}H0Uw4jo+S[XoG6j}l֣C>bϛzNjM_q5k04̝9|UyjmXy䧠g?9g󞧫{uw)mZ~SU_CۍZׇ̟y)ˊ_yv3nbgK0z-(elT{i=]sVدo"tuDcK8 G"wؚKKbjql~Z|,VȖa֎!jzW|m\l *&t{b fGu!si6 l8 C3[Sͻ2RVqD A lc06 Q/Z9AtjkT⨚)9K/fsDq+λ}Ud1;! v+kB^4`dJK3:ljtfo徳IFY.B,J(IH˘GY_(; ]N#[q:[έ1_Q8-ބ}0!FC(:n k VRw]˅nMіyo{ c3ҶC76c׬\ơcI&q%Z2".xda HIw}P`aDCGcM7Y V!aҼӴG0ǽ N]Ʋ,o/cK~&Po˲g{3-hs1ʤqTli[(:]@MVkn)wE/S _DGvۊף% ݩQǒQy^KiM}n!~DjTs̝δ j?e'Dq~'j[KP>U;Pd[#O9+c!kU?בM"=V#WKJ l S+͹!/CNbsAi$f 7 +) +endstream +endobj +790 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 789 0 R +/Resources 4 0 R +/Annots [ 791 0 R 792 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +791 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 228.873057 101.433071 210.123057 ] +/BS << +/W 0 +>> +/Dest (cb201-1) +>> +endobj +792 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 167.926036 101.433071 149.176036 ] +/BS << +/W 0 +>> +/Dest (cb202-1) +>> +endobj +793 0 obj +<< +/Filter /FlateDecode +/Length 4069 +>> +stream +x\K$mׯ E/`!`d`` X0[#5#㕙yit%HFfZ|_fgr.)嗋5)X-vM,'\9\%J)^_.p67qWoJޅ~I9%V:RX!| ++:% FHJK bYaeAYbXcA WBRXBUy2Wx.G睉x.yGdbb+&cu/@ƃ,L9iY(UyD/A! +)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{ Fd YaAqg Rof +Yԛ(-L,)ʃ,H$ԛ@'!/aAQͬa ԛ#,fR 4pi԰7jLgf8zb`U=2^DXHDezj +걁"&lOU9$̜dnG1ѝfrG_78?qZj-9v~LQa"DB>"D*SHXln"$B1mn/2$2͋Ra(uꈑ!%B^^e tF-ky?*k_,~q`ͼ\6=D$ϗ?}ç"[[LQHKOOh|ik.CH?[Y}_q6GXmV5ĩU5/m6~{ªgm.e$0m]zeM2JLJaqU= k)ݞufՖiӏb/\emշx㿦#ζbo&49Ye$.صxkwU*-7^V^CQ5XpuS͸tokE?݇[*V W-);a)qcʖZl氯. ɀMՑ@ rވjIu;=b9+";1p=q|h@OQK7:xwb/WlA^xR}^hn{wܷu:lG#&k"]~f8ln-*=-Q[U<6QaҺw^w&)?sNP8۷/-fBk'y<6jOz<ÔkGuQ?9{ՏF۲*==#=;r>ݮ儉Bl${x}/wtZzF` Fܳ]Pk'v&.R)GN-ycŞ-׾ghiߠ|2vMK[ݝ8ii短m5Nt[ckuA+_^p"~v~sK +L<%_ .ncv}M>▉W".* v4Z*z˱!bܓ%!{mb7D]OKHJ0†nz+q9i/rW\1x0> +endobj +795 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 582.273057 101.433071 563.523057 ] +/BS << +/W 0 +>> +/Dest (cb204-1) +>> +endobj +796 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 521.326036 101.433071 502.576036 ] +/BS << +/W 0 +>> +/Dest (cb205-1) +>> +endobj +797 0 obj +<< +/Filter /FlateDecode +/Length 4092 +>> +stream +x\[c~ׯг I !WKиrneb,.iXϬa0z p<:_!hXs0oY+Ɩ5,]װ^ $QyccjXpEÂܵHÂܵGA^5*gHa5pT4,]q$5,Qװ f6%aA,<|*/\ !Td 6Jְ yBkX Fd YaAqg p.%7)P|3iXP(* h*ʹ&!:iY|a Jof f DDI-wC2i<."Өa.o"r{ ̒qfb`U-X`/URk+9Z4,sTp`: ,0\}ZKT3sE Ft?rٌ4;~[8/:<|V+ecMqb 2u.+I\v^Uȧ?)ɿ/\l޻wyu޻wyCHlKyơϫu^eE /S<}jjȾys@v(7x_poO<~Zڐ;,]5Q!j4᳴x1^|AڏvR }?OEy-Gڄ]sg!:Sku:|{Ewe]Uע*6\2w;[Eez,yy8 2{jnuNߺE^ɼ߮f+f[\Iu ?{up~+S[k1\Z?Fq^_~o3umfW ?Û +4S$j% "q9s6"+>ϋCC\Ȣ)TdHl0}ֳjƥ0Dh 'mEo2QYW;1&\)-R_P>vshc6w_?lC2`OI۷E7[֞1vŋkw EqXh݋jI^ωY2sڦCG!yT8~ ۸qCSNKNNO''n5Ӫm]6bhG]ikAOpZ+}hvXu5;Eȸ>݊8|,hb:N$Cُɀb] 9p~aZ6Se;"R xL4z{&oVfq`.aIh/]Fyo$g8~3ͽK}m演g"Qߛ1]_O˺1Iz~=3rI6Lr..mtn_?G=+dKfr~nx4YyݣzM;^;}-v˥(T}Ty?Rq W\WZ|[z;a*S5_PC6 U [5q_5(Ʉ|ńHnH.YXK e]YmU1G{?SYmc=bzS_{_IWV>*ȹXEzgO08chw}vRe:7D,B ݕ;|2}}߻c&S=+IoUV&nr8zomϧVY-6߲߭cfWlͷ+rK{^נ>vuw?&QQORGNٳ IWzKZfG飏̚{V^qJ@jۭ)`7,$D);&O ~/]euRi|6p s +RZTKcZ4zJp6eݕ|D7oװ۶X_p6 <~l$Oe<@6Xwҳ2ѪXّ/ ,rE짯>k+9~1ɏIX!3#Yci'deK86>Now(z7moD +=ۓeָF㳡v(!vAv8;>Ivdb2${ȝJc{./uWչe{[.iR>T׮FPePCo96>)A!~nЌe31wCѮv +tP۵ة4ZٵtOQSWhŵ&Xdm5bi7~G<xIi&VMo%2 g;eRS4y,D?CETA0)yk^IlVI+=aMl˥4lv՗Vi/;Zmz*]<[V7a]?+WB`IÔ7)gG51Yt1$ǁ+9wސw|'cK~L 0F+ցN#to>_R_!yBKu9̓G%!q%MK렸\&,Sb$C"?[A2rrIͮCwZ]!0IFE&r'@q uNzP;54Ƣrјo.V]yvk :)wf(\f;mLuj+Ϊ҈)&UaݕİJܵq(l9bɬ{PyN۹=.)H®%gG}Jkj%d05Dꏽ#0:4>k%H3a; gt(O3O݊U<\}ZdnS-mׂиL*ϴY~]&Y^9(ԿbN +endstream +endobj +798 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 797 0 R +/Resources 4 0 R +/Annots [ 799 0 R 800 0 R 801 0 R 802 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +799 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 698.673057 101.433071 679.923057 ] +/BS << +/W 0 +>> +/Dest (cb207-1) +>> +endobj +800 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 637.726036 101.433071 618.976036 ] +/BS << +/W 0 +>> +/Dest (cb208-1) +>> +endobj +801 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 295.229014 101.433071 276.479014 ] +/BS << +/W 0 +>> +/Dest (cb210-1) +>> +endobj +802 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 234.281993 101.433071 215.531993 ] +/BS << +/W 0 +>> +/Dest (cb211-1) +>> +endobj +803 0 obj +<< +/Filter /FlateDecode +/Length 4914 +>> +stream +x][$~_QφI`w eه}lx*Rt/[Os*#t I>E(3UEK)x~rQKp +#jEaq:?%$g]rLvӯ.[Wv׿e%T *rn 8/^Ĕ$p mUfPNR 2& +3,m3L$`N.*`6J:t-%ы$QH:kH;-wQlqIiI`DJ1H:[JtNt]Q啖t..E"QS1ĭ(htZ/ش3 +䃠3+DlqVIga ៤O8bfmՒc:؂xآ(3ha^8P2$vHQbB!XLr $JCgDVG^ba a:bI\` lA -lK@tK*i ,X.TX0$.\@)I\`)qb ,X:o$.]KK\`"-`h%. *H\@]L##qFubbTxDEx,.,V&H+7x8e$. !%.P.(lJ\:c%.@a["qO`E%.p]1|.-:Džy^^IBe%.p]g`E58X%xW$.p] Nap$.h芺 Z2`^THZJ\Xޓx"=h$._0.ʀ)$xWi*˦>D `/H\#-)/qO +:|/ve:B$.c$k #X-p-%.-1I\G<^t,1E]N BK1%./.I\3$qAHSE,EK4%-p%. D[ J\MDXK%)3®&4&$.p$.@`a-֑171&ǛA₤` <> ơSJ₤#MC`^r%.HV!D'd=ǛADEuNS-8 &IybI\x3J\7&[TpX3cF&L wb$ϗ_`/;e-y x'0%G0l^B +LN] fҍ).߇44c u(j[CW!;]Ulmb04iA.>= +%UOE!}凜[f } pw#Ʊ?-iĸ0}g7x~ϊ/uo Gh@`4E e[Jhx8Psѿ9m:'']E1`hy7s<i?^nSG͘= 3[1di^IH!)6ސAR?;{TkwM5{#LlTv8~K~f0ln/*Tak';1 d#\'A\7;##< |cpÅ'Ƃ iIŠ +Kvcm)x'< :Jk,. G5d0%:fY9 [t?1ռ3~u$PG1zyL'< Q&E|}Y>ڸCo𵯹ĊvH3yf.Uf>̆VFZu= RZKRmclꐃf4̑{FBϣBYE\!}۶ 59yR 3 ׼_Yhxu8JnqF?$qΓyhڪr&DLz%Ϟ@IFGØxyn+8 rx_QcDtߪ_|>r[;ͺVc0-)PywyǾhºWG|<3QђG4L\PFt<;c9D5p?ިm\|a4E>Oy:iysm=۳Iؙ=iG}wWt~_Tգ6rqhA)o3s}mgKޖz4ܘ?ŖQ4 >{gQv.ӡGtcv١Lړ :8\gCh6q b9?]=lc9f'86pjO$=㧞Cr1*wP$m!)TZttQ0A}+:V)ʛηhSĦUޤ-ߥMy<85ʯoiNHj aQj:<U{ר&QI]M8 EjфlaŻ0V QKj:AtJiThbϚjwS:ml/ri_戲Ż#VqoGm&v!\\(CMUKr~Ư/QSkRfES3ٯz%<7xI7!4v.B_:*!=nKzl%lTcj놺&f +Ӹrjbנw;]NʼZ]wF\V*免f1C?Jبa7 ŝF߲N;kdҊ{咗9c |e ]P\F50[Wq%L' +Uئ 44~Ӻ35{M 6 Fۡg܁6bsdul}qi*\e:ۗP$8i_ҡ%3dX(. +Sle&ru=OPXk]G}܊! \`;^+M+{?Eei7JD7ߤr׼% 79֩Q1wROil[7뮫uhuC|LU6)?;⁡R/O)BM:XcO=8akyJ;"ud ñ*h 1ل7(cPTy19[RbVP7d^cjCE(No_J>5o#V[(- +endstream +endobj +804 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 803 0 R +/Resources 4 0 R +/Annots [ 805 0 R 806 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +805 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 638.673057 101.433071 619.923057 ] +/BS << +/W 0 +>> +/Dest (cb213-1) +>> +endobj +806 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 577.726036 101.433071 558.976036 ] +/BS << +/W 0 +>> +/Dest (cb214-1) +>> +endobj +807 0 obj +<< +/Filter /FlateDecode +/Length 4504 +>> +stream +x\[$ˍ~_Qφ/~0b㇞g)2.LUvtÙ+($')2;2%"]o?\~%梲PZ-1LiI%/_.}-Dg_E~I9%VXBXRr!*h,1B"GGVTrX ++C O#@ ,i,aKH +a1*" Kңsvx69`5^Yb!k<,d h'!ި; ׀mi$q@ +5x]cRѰ w9ljX\ְ.Ȃ1RRbCʧaA2 @ʃ,H$K%kXdiXdAʠa2XdjyY.j}@@%" RǠUݒZelҰ %ZMa~tI% R,* -!3x ְ.xjXdA6aAvUf4 B53©&4*&4,}A2GAHÂYÂ!3N&כIÂb 2> 3FÂb3MG`_r5,(ޠD#כIÂB% EQyISQ-0 &IE +iXPbz3kX4&2zH sn(@&Ef5,MdZmo!!?ә+ά@o@lU *g5zh1QY樞 izl` Urr.Бw*I>$QR̷}>\r޷}>JV?Yi5'd{&y. wm|q?| mPڤXOǥEhtӧ(N E@n{8 mPFqs9\;}^5s9@q?~4˹̠">s@9nl:p:|'/x~:ImJQd !ԯ=~pRN7߃2R2qC]tc>ߚ6>j PWp3,LƦq#w^jg06Oϴx}oovn5uti{)LyƘ1?ls\"0zCP:7陔Z-y!vݫVvvk׾izRo_emkkkm?F;6-3WE$X(cWŘ[o6/MWyj_wiϓx+^u6N|Nu>[a~gFvU>vV몣'&w*%gjr멾A_BOU6^3f'eC;{ngǵ/zVJ=V鹵-IDncQ7̠t( E{QWkn(t瓡c;{<^O]ch f?ymR~nc5td3ϊ :`[xM_}[}9?Bm:i7Y枉=eŁvl7r*6 +[Ӽ^_Ǽaz;NyIUO3WzˊZկD;z[b&O@xWŚKVnM -n➞پ5a[e[y{Dw<-܄lF\qq)dGp]] :Jy(^+й{kHd+|ln%||Oo/j]v4-yL/"}qMNHܓ݅qd{MO {sIjJ{_t+nxnn#nyټPkWʛ7]7\7[MÍ͛ߖ\Msp|67_MwOջu?oX,%x1bg0C$'Np`} vV`iw3am}qTeo`\Ư;*^b>qF5j[58!yjI>~\z;ezSSSSoC7lsCNasoFLqq7 +g_9co怟0 6e>֋C~~787kZz5!.-f2N=W-ߵRu4i66yK目vVD%񣮪b8 +֌'\حxw༱c{78T ͡p=V5cT׮3PePCo9 BN +vQߙ>4//oX;vSHڮhg5?E_UOۑh(wM~%؉r Ii&V]Ow2)wUakv?P~4\__1$7y$IuHӀ4 +uٔJ}&Q3CcPc%u3RMMr!O9تɢƸvHr.!W|'j`=]?I&ٙd8(LїJuS}}L_.59g[~̲hrX3- YF2~c~#_؉c#ll78k+aPp]gL8!vZ{m3z0緀tp!*yvk :m3i.@36FL]غugUKi 2U-#ȖHt4WgfˑKfeAwqnݣU, qffv __w>SU'!6Ϸ!PMBkc0QG#9?+99̱&Y~5. u\Vp5RGw֧MиL\*='ߠտyJ?F 5 +endstream +endobj +808 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 807 0 R +/Resources 4 0 R +/Annots [ 809 0 R 810 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +809 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 426.873057 101.433071 408.123057 ] +/BS << +/W 0 +>> +/Dest (cb217-1) +>> +endobj +810 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 130.126036 101.433071 111.376036 ] +/BS << +/W 0 +>> +/Dest (cb218-1) +>> +endobj +811 0 obj +<< +/Filter /FlateDecode +/Length 2862 +>> +stream +xM +l@e 2p Axmry;V f5MVWȧȚ *Z[zoJ"[.vxta\ R,ϳ˵Wۿ%rt'SRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:D)GaK\lIB lQ<8Dkt X,Ga !Kb)A[TJЪգ@-h)a 4q@@$ a"r]l $4X [m@[ U@\I ĕcp@\;=p/ ԕvEkX (wEp-p`c@]a* EEX? +!J ܍c` pu% c1܍wrpI~:[XcAwasb +\[X]X>W̸97 F%  |V`|=$p;w96X] c!0\յ@V *HJ#8P<dpǂ "quEjX:HVEӁXaO mz,z,YpXVJXA䱠 ruEz,@b걠D"1z,( eX 4F +[)z,Bm Jʨ0.P p*t\<[1{,@-*c,]X3cXPlAx,VjDf XL:f5d j23y,ZS锬ά ` *M`cNJM9HRF+7ǂZaKifX X(K=y,h\QoFXzz,hB7Q9q$[Y<4- )-H`Mez,h9[Y= @=VoM dt.27z= ?*ЛGb*V#0eU(cnOU;왵C6"5l&hv;|/?g{j?)/f+HlXn*) +L3}-fBiD#7316vl05\:P]K?R"aFv׵/Z'r7RػQذV£~[9-~-tjK$+E;"i9v<.YRn#]m_7߾]WzC_(r;kC!޻Mmzl~xM)Ӷ]h{?o9()o1k:\n{N3DF;EjV=t_6[c;酓}=%Xoq}z{eqWLf~2|,r9א:plCPZi䅹;/9gGFXz(,es,IlR-n7Yn77Ws{ɳ>@# ojG%$O|-L?c/}RϗR&B:8r b jLO,_>p-b۷~6Fi`on;]J#=?m%:bf&<>K7o["4FS͒c_v3؞b"90S١mg,ӽ8jcL]a:u,o˲^7 +ϥOԎ{W}vQ^t,F!MX䈮#|EkbjvqH:ڵ]7[+UF:om})եwdb/1B?V5*7NxP0iKi&+(u[;ĕL) +c]f%" g:\ʎabsϓz3Zfe|q%Aw3v.SK?np姓xڙF&e^=~8v>2VLm;]| Ʀ2őn7[0@a'FvqA'@8q/۾!GVeahͲ_mzIHq$^w2AAD G,¨ l7}<ƅ:o ޒAyhWaspȲLlG"[fnطKaNUXudnɗK\YӹCqk\lӲ c~]BlbI#RN6veS,MzvN8Fqxu?L=L:>Oto>uȽNXsи,V*O*Œj)~ dewh +endstream +endobj +812 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 811 0 R +/Resources 4 0 R +/Annots [ 813 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +813 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb219-1) +>> +endobj +814 0 obj +<< +/Filter /FlateDecode +/Length 3998 +>> +stream +x\݋$ ￢ ,$ y,!aw0C.۪*uO,yg$-OßBΔRs-~ꤱOGg)j* !\xͩZaw=aZ w!Q/ V{|аDÂuOiq& "pLʫeX\[XٸD4,]gѰoQ2:_!jXw0oYʫR4,]װY$QyccQjXHUÂܵ1 p]Ba4Uc=Bw k<வjX65,H hX `aA*djIÂT-x(T^28d Bdy1Vv _||Ra1bigkߝ}%煀| %~j!*>/X?tֺÇx[ж>iʋ "b Fw?]ЃMzpE )n"ܔqϛy5 F_C-_x-yp,˚3!+EhFk w]6_$>_{Zx>qa ڴvX{8{[[Y#EV# )0(ه5Чo'(-~W^qX<ğ}\эoI|JsOK"NZu~a+o<{4#|m|fFtϗ^?pN[0Lu=g԰mJ[}[jɖMuf>o]`fk#p-֖^ݺ0.ck=5t-<ɹHxNv> =>_ڦo},]c; on"n:4]y<V`q{_}]Q,K5M5Ȭhz+sDk9\Ix_^_2Y~,o,]Y~K 5T~#3 Yo+/>mQmv#ng6TrGe*=yҽF9l_ 4PV2Jed +nú FS_1܇}mcCEGћ:d.lQY:RڰlyOnlQ삜V߶>D^[iU>·#Pg'FQkÛW7kxo羈/6\oW|փWmvV91V7ĎXԅ^f ]­~ht9?U [x—,.V8bLi󹫸Q7pcNOzrIgƾ^]mg}v/pu]ݓdlnVg,6[;p=3nA +|=qCp3^nq/#:G{M0y_aPGcr[DzGHć55;:d!"#! E/v+ٜtX+r'i{ qd]M7\Ugy}wҨhP|&E52w>Nt9eh{fdx_/Bm a7m_=6>a](+D\ܞ̣-d~@1a9KC IO]D+dO] ӥIK91]g1׈ [Jǝ{SݺZJA]rLyRH|Ǝ 9b3tG!WB:T8f*2/S +3IEσ$sa:7~G<"Hv^:N$ ;eRQ(.Bhv?rP8.ŏͳ $iip0y+Vgb+0c&u3RmWMr"O=U8{,9q;i`$1㎟vw%6ڒKdnv&S1$O}l.pqO_-}{:GeO@ǿ{ }p&Ӈ]+L^)(Δ.yq!Nd8֩JMvH0=Or*%NDahYtQAȆNJEgr(c`LSC;Mӑs‘OzN 0ՉQA-E NVD14iuJe,mER5Ť*- #F9+i'70 +(9)9jɢВzPiJNM{=aT$NkbGsZm'ĕ55|h/ҳ%%`P25r5_̯=T! +`ԧDj!gNv| +Eo7d{wZQj ut +endstream +endobj +815 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 814 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +816 0 obj +<< +/Filter /FlateDecode +/Length 5429 +>> +stream +x]K$qׯ0ۀ !=n FdfFUjzGexg{3 #|;[L\ROO$X=?'YJ]? !$ +'yyٛRw|$Q0)dYI*H.(I&%QIKђ 'OJJf- bYI#PraT O$ +'%YἵjD+iMDG-;sEMKHski!ȱҊ1rpNKcŽjiBNZZ,!ASdhejd:-%ii6O afP0I1)iDEM,d!ҀRh2 NKc}"5 552K O e +\ 4 Œ4!; ,LQC ai%Ұ xȂ Y< Ж--4,[.jXjX!GҰ rJE N @=iXװ vaArVN5 @5,:rа٤aw1U=@WjX@]-iX@]`Դd0W,7p׳pד@Q Ǫpº;Y# PpK4,`+0ʘZK԰.Դb\B+l\EP   ,װ.Rki]հXqp4,}3BuմblYf iX06~ ^4,]!hXi%daa*cΪHwCki]kSѰ wljX|ְx^ÂɔXSӢ3kX, R %Ұ)d ,{ ,p4,G`Y)jX$3iX8"CjiћjZFKDiXXd z F% iX +dPѰd\KsNt朆CxdeFa,4bI4FV̬aAhU԰&RM, ?l~l"Q K`Ұ g/fְ gװ)fҰXOÂb7Y8Ҭհxӓof J7)㶄(fҰda(jdTq LB t"d4,(1J5,x:%%Ltp IK3&<[-^N,gVg ,a[) 셵J꜁JN@LD90HtV6_cÄS?E 63'yɂaA[̱d W]ӯ_`|LAE n pejqTJ!RYtiM)-[ Efg"RpuY Y/'en3$O_ǿ7ғ-$^ 0OpIs͟_~孄K@^%p_TuN' +Yf?.M, duε,5Ԧ2{Ay ]v s6h$KKW7`?5%_4w+$ekoTSQbZ ޾f>Msn.pץ[ n F^/iZ¿"5ͬЈZ&tX)(-˧@gt"792ݭԕ ^j,ZTU=]F b]b-v.|ER z%;TY?K<c(.n'HAS'xb_;Tp˓zՌFx_?[k_T M` +ǍCe2++c])|Gߏ "Qj0B3>WfN&E88$Rqq"^٣X5-_QhdE܂( 3cyT#BbM5,J"Jog,M%Wa %ApY9d1#Hkmp=et+ d\ #(U8>%,4ˏ!dKI#eF1(yB JQ<fj?a ge& +:܈S%x[⫍A^ucP?wKXB?PJ{YDK(]+pxs4ܝU܀Ts6iMo.+oy#WvsZф,g +$k?,{83i܇uc6)C֔R. vjUpԇ4GS,K̅ܽAҲ=/̬[o]սnߞO{aObUb r^ؕ ц|)t͑<[x_.-nxCVŏNx{no6Q0O]J^=wUחGF[eI끈^)AQk. HH+Kh)g/ <̀d9 +K8kﯚZ`v`Yv:yf%/Uvn"r8\^Xz8 +Zn67l,9bK5mM̪G ] pvF;SlVh^$\>rc<V57n)Ym+Zyz-.{߮C{,"׭(,NF $@xG^AW){tWmඐ$W -y9tvy_*#@elQG0E_94]3r|γZ62h1HnW+|s2 +7ku|!yF)x2Qޔ\nC}y: A&G\z:u8K|N]7g5_axo skv3G"RgEJ#ma}ݺرyҜ 82{i[Ib95f+hu}s_ESH̏*t kf0aJD={7P)2 {%̇ z$h zJ$HLZ{mzlQ96gm} T77|jsy@)S҈ P\Uss gFŶbcAfcSIX|ŗ!/5= S?K w3z\tu V."z^noItpV.K,1&hI20p \G+;>0캊{OE90Va^/v &r9RvepE =-dyWuO6)cu߶+6kup[:oWۼѤB︯^u!>Ox.X=~p;sI1|pO ʹdȗB"wgs8Zy!$/›,xSÇ:Wmv:?_a-YT?ϕ,d fiuE0B^`IR]fq_O;U3_K/^;?yOn\츷 -|d> +endobj +818 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] +/BS << +/W 0 +>> +/Dest (cb221-1) +>> +endobj +819 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] +/BS << +/W 0 +>> +/Dest (cb221-2) +>> +endobj +820 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] +/BS << +/W 0 +>> +/Dest (cb221-3) +>> +endobj +821 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] +/BS << +/W 0 +>> +/Dest (cb221-4) +>> +endobj +822 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] +/BS << +/W 0 +>> +/Dest (cb221-5) +>> +endobj +823 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] +/BS << +/W 0 +>> +/Dest (cb221-6) +>> +endobj +824 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] +/BS << +/W 0 +>> +/Dest (cb221-7) +>> +endobj +825 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] +/BS << +/W 0 +>> +/Dest (cb221-8) +>> +endobj +826 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] +/BS << +/W 0 +>> +/Dest (cb221-9) +>> +endobj +827 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] +/BS << +/W 0 +>> +/Dest (cb221-10) +>> +endobj +828 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] +/BS << +/W 0 +>> +/Dest (cb221-11) +>> +endobj +829 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] +/BS << +/W 0 +>> +/Dest (cb221-12) +>> +endobj +830 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] +/BS << +/W 0 +>> +/Dest (cb221-13) +>> +endobj +831 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] +/BS << +/W 0 +>> +/Dest (cb221-14) +>> +endobj +832 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] +/BS << +/W 0 +>> +/Dest (cb221-15) +>> +endobj +833 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] +/BS << +/W 0 +>> +/Dest (cb221-16) +>> +endobj +834 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.982628 99.933071 369.232628 ] +/BS << +/W 0 +>> +/Dest (cb221-17) +>> +endobj +835 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 350.088585 99.933071 331.338585 ] +/BS << +/W 0 +>> +/Dest (cb221-18) +>> +endobj +836 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 331.141563 99.933071 312.391563 ] +/BS << +/W 0 +>> +/Dest (cb221-19) +>> +endobj +837 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.512413 99.933071 179.762413 ] +/BS << +/W 0 +>> +/Dest (cb221-20) +>> +endobj +838 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.565391 99.933071 160.815391 ] +/BS << +/W 0 +>> +/Dest (cb221-21) +>> +endobj +839 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.618370 99.933071 141.868370 ] +/BS << +/W 0 +>> +/Dest (cb221-22) +>> +endobj +840 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.777305 99.933071 85.027305 ] +/BS << +/W 0 +>> +/Dest (cb221-23) +>> +endobj +841 0 obj +<< +/Filter /FlateDecode +/Length 3621 +>> +stream +x[[d ~_U% $ÆBv;6a6C~>t쮓aOIuQI:ǿ"ޕRsÁ\Ǯ_GO]5x|.r:>v:ÿc1ZS[e \rh*X`r1nV1b ׬ 1h P V,5BX,kA`|t JO/xJ e|٥,>zW]J)'%V/BEA-^,Ld %ː%@;*&P"o*XɫQ(Xy"lM< + %Q&D`~-p"r.֠EBYY(' ANq€PIb@(Il@I&^0A(BE&p 8@ta h+ p+T BL\XX\R 촰plau9`avYJ,,,.3F<@)[X ]Q`؊  ` `Enn,,n,,8pt`-,@/%DயO/5YX`L^u>CBΧT-,]* w`CD DgDj!ZXsp oLUG "p,,@vT$&/;`y ^-,H]$. Y ׀5|ɪx]a%‚հiaAJ RWsNJ!3yɡ-,Bd<"Y,,@b*baAC ȂdzdfyY`.f} @2W9&cЪK 6y<-,YB+pz N% x^,,U,,@(r% 3x ɶ.x[XPdA6haA Uf" QKBOHbaA4UnJHi `?(6Q^u%xQ ~][;Js# yg(pQ^4#",ps,jB/A; uɮh.r#67?^˾zwy߷?U9(y.$ۯ~(\ߙ!9)S*8+Y#d@$yw]&/"7zNXcC>ʂ~ é>#np" FN:wù R~"W0ؒǛؐ/f[P:H^/4QMbm#j['hY=D}lȗ=wSqs7ܬ˳˨UKjEj?ij ίΦA@>#](-2+/'NNO☷ڛ7v!Ĕ +yո mlx]Y0wK"o7/0)}|b&L'b>]7xnfZn8sQܦ~MϙRcc>l-P<߲Bz>HEl2~"RoCkDaQUbu4k+C/xF.j -{NWhYs4׃Y +*w_:OgAg{rf3gP < MsTTc5n}<67|O. 6>5^Qy\U'vINV㔚V^%/,ö8Kޘ䧃-Yd;d%KsNH=PLent|TNwya_FwQVeqN(k9xb&Ҳ$oe{}U_ y[%ɤjէ 4hU5cCdA: ԧl/=~3HٯNѫ̡k~2MPA;-I^/->B/d7^SY&\O_"?b6zljD^B^&5*f[# qPy /äͯٚo^I+= K^컨O+uܘRTޚi1sSCc.^|G3]ck6P:uQݢ=P :m̘L jZ#_VMuW+骯#Ȗx$@q5> +endobj +843 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb221-24) +>> +endobj +844 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb221-25) +>> +endobj +845 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb221-26) +>> +endobj +846 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb221-27) +>> +endobj +847 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb221-28) +>> +endobj +848 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb221-29) +>> +endobj +849 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb221-30) +>> +endobj +850 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb221-31) +>> +endobj +851 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 605.596885 101.433071 586.846885 ] +/BS << +/W 0 +>> +/Dest (cb222-1) +>> +endobj +852 0 obj +<< +/Filter /FlateDecode +/Length 4344 +>> +stream +x\K$ s+HÀ $`#rmflrGUQUoٙ"(R;[|'39|xt&梲r2(TOtŸ\NqgoJޅ? ɤ +e)LJ>DKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ%ų>YCH_Xdxi@@, Uy +kX@D3iX@@[hX@[iX@[.jX@\i5, . T4, `.;5, .=iX@@] +kX@]5, .0p5UdkXt42iX]r6iX]װj`Q؊9[ e  |4,`rw}^zQX5B@Xa3a +?ŧV5,]1}*qoeb,.*Ұ wY`5,]GX5pb5,] Aq4,f骼blYÂ,y +$*/Ӱ`l,P "p{Ѱ wm Ұ w-#Qyװq xp[ŧkfXwMEÂܕeSÂೆ +̦5,łOEaA @ʃ,X֦P$Y{ ,4,@D`C Y)jX$30kXBD>jMNksIÂ`)v 2NaHaϱ@XL5,5,@ sdY jX}FXKBYÂHa&RAIH~l"QykXt3kX3dkX۔|3iXP,dAħaAHa`mrO9ĚkIzF2NH!G*7kBfB* +yܐ 3XO}ᳰa~#I~~o~Λ~iu-[i2ππr|'ᲫaI)W;J?iŸ)9OYD] epkvUݮ-RHY߭eV歎 }V_ikeI3eUsoUU6lǪ*:,{wx3j/Lŵ8 KkRh3X!pۉ$>xͱlwM䟓=Wb1hǢ-mڜyx|6~OCOpeqǿ_u&pUتɳWIVY[=*7cXZ4P^OFi謕ClzOr{}U]կZ{ݏ$C0PsAÇ#W2Z_ph?jk#cеjo$i'̪~Y8laubqs܏sy)SK7qMkخʦ_ 75&\dSΙK<ӭ r 5T&ؒ-ǭE5Q8#OKo͟Gw!khPܠAzv^9Bfl] l4x9bM(K's:‡[6io̰FuD|9[׃ݼ5}ۭ X%;39ƉGmV'2˚}VkrrQk*kxfoz}=lP7a{W!opP0 cwĨ5Nu=Oi/ۈƝ:rˀhnp}p~&WrxxoCBL8o#O3jfawv3Zn@vlU(uU437.2A')oa=Aݓ\;"'.`uӤX֦C$6"=MN <ؐ)kûi[K Јh= Ңc{p}͂Eb =eo&7Gz \5v \ >176\e'vmgm>yNى Ώ" +j[5=֟gs޸{uK (aW[Hm;[Ѽh-S܂vx͂<^X #a@U'!4f?/D߱ P qV3[FRwy0kLãҺoThmyٶzq99cǶ i {}To]{7> ]Qh'zȍU<dzENj w5!ܗ]F5봶*KUu!aZwt HL6g}>,Q+\ţޮ ݴ־'y;16ô}:XfHw7#y(gy8[bצU"k7^}֗`Yy/<]qX~JF䧓"x,mkj]]IXx%[F#C&bIJl~X!ftGOz(!64ho粣Q&ّHSw%]uq4Ot^#^N'*iM5"m4*Z>!I! ۚfLfO&/ {)I-L^*i~2LrWBLiM>b}ݒ%smd7@wOz\X: LNvˠTl4yY.P:U~qMJ^Y0F'⛝ULuXӀ4Nr)uU ]cꤲ.uo:vؒ]NkX9m r!9Cw`{gMz;v>g'R6ޓsdegOl" +<`vtw굯ɴrT9OˍHN^4GYo=~~9eغ!+|/I5bwyAvy :<쭤:w&ÉzGfeع rImprAФ<\$&q%Eǒ.".Fq9uXd1 NE~b +#2;7huS4_ ;-yv=ȱyP;wLj> +endobj +854 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 432.754475 101.433071 414.004475 ] +/BS << +/W 0 +>> +/Dest (cb225-1) +>> +endobj +855 0 obj +<< +/Filter /FlateDecode +/Length 4378 +>> +stream +x\[, ~_1UU I!L0y3>;unLxm/9˞RI_Ige&"/?~TKr˱N^ggJΆOޤU"V&%Š`h,;޳Ƃ\VXbxNYbdYcA [BRX uD*w +51WT^&71 Vc Y1d %Xfx}N/B=DazQlIz*5,:oװRҰp#avr& 2 u GK>5,` Xvrw] awa Ha{װDÂܵǟ@+cs>WMив1 pװ wY`4,]qRkJ4,( YBY4oI7N/BWXÂY7ѫ%,fRPL4jX 䛈lܞ!!>әY2άV p%Jj̀#E2GjcLKjـx si,QEC™,-}9z3J>?N_<=?ϦJY0~Q . +pex*&!~߈."B*]D P\Jn""b>صW$eu8-Q.o.)< y=Ry]Qet^nVr05m^=l}6c}\(//e XwX[XHߔL$ / đ.wvy='$h勓 [U?p\.ĴKCSq4 ::şŴO}Iğ~ߐ:.\?27b*8鐧?B~)}ᨤ5?[A]N$ oudnuR&b:O[He.-~',EtĈlp3RȩY@ciĮB[I a`O]w}m ۯmYX#T,L))c]7IJ&. Y +f 6vl.vyͿ鲴ㆎ@mc222^l[cdߧ[Vcp1ny#6c}` em᡹l[C81^Q`gҺ -cuW7)DBkŎzqVf몾i6fC8 ZtY*oϝabip8^*84)惩-oqш8}'pF`Cz>Ȳ7-0lW4*@#GBJ na1 r-ޯ?KIqi^d pBtԠUs"A<S"l|o?^9"s.Ӽ>AxBW'[yPc3c.f;r(,߂c}~NKk5ԴuP߶T^{={ko/wXo_f!i<++Bz$ނ8%d7^ 4d^'s'X0J$r}bβj 6P a\-)il9OYb7lU}\{Dk8qn7U&jFĞcӒ:eQg&8a-u,/ +g=>-:k0>ꍷk-2 J=/vo^7}oeC$9F\xㇵ7Ɣ_17:JHkV!v: 23wigfM=Cˍ2o;pHTe»}{Knzm?ވ+|[[tPUv }G.>uyZۖa [vM=%"Xz߄h졇vd(9'î!;9" Ji_w 7y iM7.@KfA2Z{('ު¾0SﺰlfEo__Ox͂j G Ǻ7I!];gߏH~Wܯ2.F] KIyiCʵtYKϋ=] cJ{m >S,+}|.59~|۵oh*gOouy|~ӲJe,sǙzɍAvs:L!S’Y=5ԍM[2]Ѵ]÷8WI%ui4@^ܻ4ӢKwa{t[Ckmۏ8=cj P:y9,ϵfHmb~lH^ N8^,6lb= DF䗓z,#ض.n["c?%&?PW#C&w&2F~z.pX!g{]lr(!VAض;$[O14LɎ)I!~Nuhf6kLՐ+BvhTjrZ(}nWh!MJG׏kPm)vviueK~9+(T~3u{Ԕ&3TF>Xn&%>f#4cC4`9lJfG}LJ{ֺilET6S H5XmFiX9 +:94S~Yj6Y6n'dž/#92&owJLobNrw56@:DI^W?v'N韧s>8!z+,{/|0|;jhI&ofJln36ZC;ǝ{w^[چqGb:Ȯ~LBl7/}]|"1Rb\.s~$!q%M.wạ#.Aq9LXd+1 IE~\Fȥ<8tM 80qҲGaA{Զ06ө~v;]Cm,?oANwZbс{A'J[MZQS).ݪZgUKQaܕ0Jܵqע%0sꫣ޲ŒYűwro+m?7箧yXwAbLw #3TVg_߂mOo#0jPZɾ"Rk%LSne]0m0T}ޭ:Ѯ4\sf*$KWY^XRFI?A +endstream +endobj +856 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 855 0 R +/Resources 4 0 R +/Annots [ 857 0 R 858 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +857 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb228-1) +>> +endobj +858 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 446.531993 101.433071 427.781993 ] +/BS << +/W 0 +>> +/Dest (cb231-1) +>> +endobj +859 0 obj +<< +/Filter /FlateDecode +/Length 4384 +>> +stream +x\[, ~_1J NLy3>k;Tun58gٳR]T*T=lɹϧ_N֤`\T_YN&s8,J&Sgaw}aw}BPyI%h0p׳P Ǫpt`5,@ϓx%+O%jX.cT^1.ABX4,]*Ұ wY`AD#DjuX pyCа` ߌ0]W-9kX%aH!9 "հ wދkkiʃ,k*>dXx]km*D஄M b@@,kX3R԰  R> ɂY*pb XB%kX`r4QECBIY=l9}z'RXq_݀+SUXI.U !k !`q=t!n˹p[!ԕo.wrVGç}Qt$`[XHj"@!4 kfDIvy=(UE% +ZP?X4 NuKGɍЭw?zWL?Xo_vW~Zw^k&۹e:TmXZimJ< ~\S}y]89B \x9HȨ< Is\÷H +չu.-k[S" +#\g(cG[íH jy29i3: +ͮn &G>*= vyK6no~}7\8YI}]^kof]\$aHdg[wlxXm~w?)a&y8m܏wwv&o/kg{*a ;|:& 'js ڣG͇q=U3߇xy3{WlRzߌc|0V}w!=:>XJLNS"t\gTof|0rа.tAnwq=n8=wΑ$ɡqoa^)LJ[Ryox_\-koMrIdae!'cؽ-r"ˍi>$T+WPǖB^8aYg}%4puг~#W y:>P5o_}?߬aM!(,29-{@ackYTѬn&yz]iP'y܀;|oQgQ\I@þ߇=i{o&!^`Ee+ A,^lE5Y'WyĦMx͂0t,^Ϸ}]>5!P ıԴI/'k aCj .D a\VKh E>,,,|^[rOްxZik֊1,YR5?x<`V:ě}/v{tuEKWu:įp9j?n>IBKp[;p{¶;v7NqzF^÷ R> <aqmrCMU~][ÖŒ]hqC>#}^/{q3ͼZ>c]mCks;r0-a^@:ud9I y P8PrDZ7'e}lwB}y +};JLUs=d^'55s e&g˭۱=Cu<@ồKU{?#\W9JV=#vCg8gt~8Gw﫩Gk6ΆƎ:7g^q#OΒ܄C ꥔17L4coޭ֯VGEyrɍ[+v=rc!{"(a +g\Nᨩ,{apj+nTU.6O1e\J0|v*b +!5SZBF#)JS9kH']U;?ӳ~/wr}?#%a[R_,$O' +yd27B\?>5`eߒǑ=m5?n< ֈk +=;eָ,_8 W"E'yn;oىD;M7ȞTyͽ մhtjh-p't9)m?횼,s3$Jk.':Z;zwɻ]>dxd1&do{M!@a>Ur֎N}>p2-^N?j<-W9Y;m?O|;qo;Zd"Fn3=O?.YCOxͣZsgb:Ⱦn}k&\!^vZ%i +rpFH>OCJ.#.Aq9MXd1 IE~dbJ#Gn R`/͓<ЯvU<@;i Nz=P}9P&ߣ o.fyt[yRnͤ-PtLqRWU-S Oü+]aޕxh+㶈׳% P9ѲYŹwhIvsh{C82S;CWk|g;uZzxZ^=T@!,߁8OG#/sx"J晰lrUO`یi5zb%LQЀ9{8 ߅VŭB2I(_}HfƦd*(ysR +endstream +endobj +860 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 859 0 R +/Resources 4 0 R +/Annots [ 861 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +861 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 797.673057 101.433071 778.923057 ] +/BS << +/W 0 +>> +/Dest (cb234-1) +>> +endobj +862 0 obj +<< +/Filter /FlateDecode +/Length 4884 +>> +stream +x][~_D l$@"Xa;N8y?եKU/3g;.R"?R*9ٙK|<}:|>Xꡲr2(TOt_ǹ_ޔ = +ɤ +e)LJ>DKX#$g%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪ)ñ$ :Ӏ,d 5$ Y ְXaw=a  w!AO V{NcL $&ŧqeCYKI\Ql(6'(%8flCQN] h=}_s%U +ʮIwȋNۤoǜ/ F<+beߜ}sg:dK9/87xcBCMy(p7YS|dS˲EEew.A_:rnV򵞢.+߼?z` \_ $w?61lƒū̚-ichm;wb @@׈Tmv9xfokzmcn>(ļcCa#6Hy]dkkuF,"־uZKr|qڷ]mLHqiAyZti6%愵2-*]KU45\@1$km'f;u$pW3XGLS!%Xrc3 +YxyU*y"uDX7Tr7?XfuI>b'ʼZ %\QQh.]U^e5{c= {p 'YN!ra~)Wj;;$ASJ&dmmLW1), ܒ:oϜr0 j2ӵߘ]g0{xILI0F̻ ˗9vxԍ1yDa+ߗ{WC^!I4fnL|)[Vۼ=H83yvX>6-jp<!3+c6)qOcQ%49OJ^tE_ ³%KKs>J 8Jz;`x29Al5}퇯\naDT<\9@p ˗B*)4E_*\cY._ՎKv_7hQ[jIܝ~n}nf#Nns(a%Su1 V59 ڵ]aM3\K?lBmKe*'zRgV}6+_C͎(k TΛIY2(Tt0yRo{a^.cU;\A}XFMuD|OX]@on̮7pڀIz;HGnPW%<]pI +!Б`)[@wy; vixȶjc3[ѭf6]ql+*{IbFq_49nj/nh,r+'> ;c䈹/v&Q.OG ~`r:)0L֢GڟdQR:jiqBi|F"WocdC2( e lbBz^JʕrTa)N𧃤1]otZY!#w|-DpMI +.\BxV-2"jF'/d6Zb%&3AˎGśdGv"=N &Ѻ vgչi[YF<-mO*UnlM5&JVOyRHmM3&Y {)A-L^*i~2LrWB;MGؓ\=qMS}mܑE + {"Mvr^5*fMO*B +Immit"k%Q5 8N.RY_.[n/5N*4:xɮ[]' 5t 9tS~Zj&sA;fr3.oowF<[~n $|zgqPOܼ{iit9OKRtKo4Pǁlp>qo;Z+|'Y!o6(58<쭤:w&Épxh'2_:7#` ݐ\zפ<3nG#$&$EGHTsx:,Cbs']"?S!5)G<avn("Hi~f7wZV(Bؽxcvhԧ&x:c\?CGyh;4ۢ'95FjF'jՖami .@[LMTkj#ΪR)ﳦ<+]a++׳% P9QYŹv(I}h{C82S;]K|GTB+ԝerS[lrw> +endobj +864 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 393.004475 101.433071 374.254475 ] +/BS << +/W 0 +>> +/Dest (cb237-1) +>> +endobj +865 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 374.057453 99.933071 355.307453 ] +/BS << +/W 0 +>> +/Dest (cb237-2) +>> +endobj +866 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 355.110432 99.933071 336.360432 ] +/BS << +/W 0 +>> +/Dest (cb237-3) +>> +endobj +867 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 336.163410 99.933071 317.413410 ] +/BS << +/W 0 +>> +/Dest (cb237-4) +>> +endobj +868 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 317.216389 99.933071 298.466389 ] +/BS << +/W 0 +>> +/Dest (cb237-5) +>> +endobj +869 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 298.269367 99.933071 279.519367 ] +/BS << +/W 0 +>> +/Dest (cb237-6) +>> +endobj +870 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 279.322346 99.933071 260.572346 ] +/BS << +/W 0 +>> +/Dest (cb237-7) +>> +endobj +871 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 260.375324 99.933071 241.625324 ] +/BS << +/W 0 +>> +/Dest (cb237-8) +>> +endobj +872 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 241.428303 99.933071 222.678303 ] +/BS << +/W 0 +>> +/Dest (cb237-9) +>> +endobj +873 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 222.481281 99.933071 203.731281 ] +/BS << +/W 0 +>> +/Dest (cb237-10) +>> +endobj +874 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 203.534260 99.933071 184.784260 ] +/BS << +/W 0 +>> +/Dest (cb237-11) +>> +endobj +875 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 165.640217 99.933071 146.890217 ] +/BS << +/W 0 +>> +/Dest (cb237-12) +>> +endobj +876 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 127.746174 99.933071 108.996174 ] +/BS << +/W 0 +>> +/Dest (cb237-13) +>> +endobj +877 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 108.799152 99.933071 90.049152 ] +/BS << +/W 0 +>> +/Dest (cb237-14) +>> +endobj +878 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 89.852131 99.933071 71.102131 ] +/BS << +/W 0 +>> +/Dest (cb237-15) +>> +endobj +879 0 obj +<< +/Filter /FlateDecode +/Length 3166 +>> +stream +x͛[$ S̳aRIu`Cpa &M8X!_?t]zF綻&ٙV~g+?U9JӇm%{tf\ R,|?Wk_}ZˑMJ-jPJ)SvTn5O3RѨ3`XUV`F, +fpKQ1DDG)d8={!+qN$䢜ӵsN)lI%ؒX<lQe"YXx["]-` ebO$VU]]jH)*B9$Ħ:( R..–L:ؒآtDR3[n!aO`KE]l{P0qc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[Ex,Vo8{,fqfX @.By,0WNbJc5{,pWc"` cx,PpWw1j@fk% +J@X0c1܍wrpI~:[XXcAwas4h \1|.3o97 B%  |V`|=$p+w96X] c!0XBյ@V *HJ@ 8P<dpǂ "quEjX:L[gN#Y A +Oc=KTǂ ڲ dcAZ)cAnR>WǂB$ -uhҪǂa豠D؂c2ٷ=-w,Ԧ걠r ׮BcA)BŤXK< X=[0U<`) +5"3t [d{,@ ǂa A5V23y, +$\lY=TRE&i 0>N fW[$ǂZm7ǂZaKiⱠlA籠Q&{,ơ#Xиbc7ǂ&&xμmmY<4- )-H3o$7A'OaKl걠li#jLEf=MdޞTj;ЛGb*Gr `&v5XVdr E>7L>GTPfb70-sb@o|NN#EmM0Uؚ퀇f! :fDiHC73K1v_h2,6vgc$guJ0Ql _k =>gtg|~[!wot7OZ'F +gTl~@`Ҏ"ے],qcjF)iv2Coޜq *<~7Coޝ~ʶ7>2,TCkր"лׯxkOo>)(v^~V܆:W OTZB*ßpE?;^ll laϪǛ$Q%Y/yi' v%Yvw2u` Jgrȉy)՗SYFr7@TkBڦ}aG,d}w.eR//!|=4uC?6ј:o@aÑ(|*{M$1nP%D^(&9wݕ=wPKO!Z%}GI봇|phh_t^uC={l '=ϫ)IAy$j32"=RzDl5cYt~nʳ~AIǢnDT [r ݣnvFbכj8{¶G6JWox{t%IJfZ ,nztdvh^D;sQ|E`GujxoW|Aᖓ%-HK9=H.ˇɷU=_~6X}gأ=,9q}Y8W9^0JoM=HC+U^6O4-T/o8&_LpQG3&ܿhK;LuIL'ڿѸͱטXԫYn vvf[=P _aJfg ΊOYh[!-MqnSL:>tܘI|lx9΀m2d$9sjBk.:کv١ӾP \@F]6Z,ݦWn^*#_WOuT:*W-He͒#,TgI۾w_mm4$̔ftS1sR+ ,ElB5g'lؒȋ<~Vr{"J֞0AEo=iT&Z#^5UIvb[E{k=ڎeH5 +endstream +endobj +880 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 879 0 R +/Resources 4 0 R +/Annots [ 881 0 R 882 0 R 883 0 R 884 0 R 885 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +881 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb237-16) +>> +endobj +882 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb237-17) +>> +endobj +883 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb237-18) +>> +endobj +884 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb237-19) +>> +endobj +885 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 681.384971 101.433071 662.634971 ] +/BS << +/W 0 +>> +/Dest (cb238-1) +>> +endobj +886 0 obj +<< +/Filter /FlateDecode +/Length 3336 +>> +stream +x[K$ 賁%zH8!FzsGUIbusfgvٙ.zPRMJɻ<Bg%Rh!PqXzŸ~=_6]k9tGa1RK`5| +%lrpbk b‘YbpbA  +1K{VX#T V#DM ^H.Crm^(\8`9jK%fo S-/CMd+%B;U&kR&kK[\mɃGar1xdɃ,|xY?8jxk&O%caY Y|-BXRȂؒ܊x1X@@$P, 5y[X@D%2YX@@[XX@[-XX@[![X@\-, . ,, `.;-, .ܽXX@@]J9ZX@]-, .q0p-Md[Xtt*YX] +XX]Q`؊z g  B+>H0p7&Lݘ|c?dka=x,,@g."- wCC3|hBm‚ g 7Zv!faA"P "j w!R[N`&9&Pb jݬ +Y6eY,,h 㳰$M0PߌlaR‚FMl meY,,h YRY45oIo,^,-goV f`<,qp75 "3&2[ko ?Uv<1ބjx`/U1 w># s($܂=ǪFT~;O>=|OƏF'Lccj8A!"͊|"3!`z[b?I-:둎`t5Q[ɦ5EYҪ;D^.UQפPK;~/uK&N|0Ɓ&.%j!ZceUƿ*=*kr7Y5bPA#Yϣ.Z i:a-s qŰjPU6TQ;DmCٴI]^C-Xzs%Ueڙs`;NvЛ:o+8XX+`ٯ|B3e)#xs秜ޞ YTƎȑ㟰|p7އ߀"g)m !o-zhO~w n]w|ެ"8eT~&|OK{;LEٟuVDI>C]n[WqoyXlӼ㲍7e<Sw7ކw/&{|scW]4i/}*08'e ևqO&9ЖK[|OA?&Ǯ+.K'iNqtC6<=܌z_6{rW~;O?LuYٜ%s2>]x}-< + G6=sՋ躷tضom+ӆLi{/ =!%ZO#dZ +ǪMK%'~=P+ }?/CN_ }(X,9ޛGf.˦,ސ.{Ѿ{RVVtÍwްF! M.D~uqk' Jߕ^N6Ag_f,)njRr~\xiFڧLJ#$6 l2{޻yu{6CuW'Ɂ"{W-r!OGSuyZuA-ZΧ(|jRjhMj5\'$;?f,U?CYzr2Re֪i_,S:o.*,#,9\k_;儜vZX0=M$$WeQKkܝTIIUZoNQI'갥eU +L +tgULK HM8ôIX~9MSK4]>A{.ry2W=YM ye~5Kw5? >wW`VOBB]g9Կk/hm> ȗ mE>P]͚72> +endobj +888 0 obj +<< +/Filter /FlateDecode +/Length 3182 +>> +stream +x[MdadIUc! 8d0!x1؄8R_}ƞ" x=+JUG%]u8{ +W5Z[z?}8yWO/qw_I൸Z)K>_Ov/~=}τstLJ-'"j D+%LD98t5&hGQjb"1V"PCy5KP&BDC2(U%YH.bpب@Jd2sL%5,AT=AZ,C Z +tN# +]]ʠ>0YZU>ʢO.Ud!*CDar!]OʠKLIJ$ZEx LKE ` ]|ɌAxq@,iH VqZ29-E ĖV@) FޗƸ wmd\2.Ypd\VJf\ )eĸx EeE2.@b횴ʸD"12.( e`\. ܅ Sd\&s2.()c=2Y5UBa\P:LŁqR"K dA]* 03Y.H Ӆ,5Bd jXefϸ34֒05ufe\P5;K LSRtM0.b;1.M,s HRF[nVB#7 2>ggi28d3.hbq֛qA&x$nd[oMKBBeIS#q NzdĦ Zζެ f`n T[o]M d]dqnDfě +3.tzVe +3 _[#Met*mE>p}ڷ2ܡ`ά:~9V1ymO_{?w_k,HA0O0k_WdO`M 6RC0X ֎o!76d',"}vPW ^=njjYracYR0Y! psX.%J#P`C2kqf.p*{E(·|C;ixl.ؼB|rU~ +vpL}hӫefK_"Ru9?^{ٝ6ۿK΂/O9?^|B +o= q/|/GRg%^wx>|\|6uŶ4ϯߟ͟w|} O/G|Sq}_;ÿgڳ=k"*AuܪF)ޚMuoͧtwBϳ@-N4ۡRG~*|5:] O`3#]E3mW뼞mCvʽ3M}8/7m>́cOᦹ>-טo;,nhaj0WBYrnz |'mQzh9tK]!??ƠGHn1Ct#9k̍=:ovp"1vuYYz G,3:ˡC^z(>{Gn8돯-~ПS+m;حE>G6o@[QDGxb+Qe&0D؎NY;!o#0YwvÍ'uz{on^ԟ {*}H;I\]vi^z0)tÆ3OfDC*v\u9 .|k7 Xu/~֥a#X$5H1iXbc鴸§z;([~Bt9L{7H5AKu؜v RHwC7m8~V'yaz݄†}&WJ;xfGc9lf Γ;;\; 2n>?K)l_G# ~v \h\AfS梤lsKmܳp/|ױuǣl'Lf'믄dgl`ԍ*7y<ƍu=a2hLˆ eG+D淎͚o2:fĎa pwudMJY5Cq{7{lK;5!FM݇BfK#VL4W=ދR`o5썶;}ҟ^yC'OcN|;9eYl'3YR }tCz(Fu`wb0?Yc:aJTfNПvK}T>*;f-Leί3URض޷=f ]䕙Xz(Y9CYwBB]0Qk(ל!j‹mk䓟O{K"n(W +AeV(yڥO3_o +м-T%վP3/Fm{r +endstream +endobj +889 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 888 0 R +/Resources 4 0 R +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +890 0 obj +<< +/Filter /FlateDecode +/Length 4326 +>> +stream +x\K$ ׯ˂l 1>Lbz >ST*BŇiz:CP(ORTe;jtVr<>)_jt[XLr-tLPLiɗ||:MSv:{ћֲw'b`J-&.(L)>e[X#U Fl5i, +B {V k(,g!֪<bc ^d25w&+5^&xSxfK%ƃ,1Ԣ2d 9XY|-A⡝*duUYlN`R1y&jV9gl3a ZdP Ǫpt`5,@ 0HK4,H]ZW[ְ w]f\˹iXTAÂ|V kX. Rk IÂbAH,Yb 6-aA%xaA)LsȾ\ BdLm1jXPRF=jM-kWsEÂRA(v2NaPaE J,p L5,H5,@ sTY jXP}EШ%j-ՙUÂTQ *M ʃ, ?Tl' PD KHQÂZ=UÂZ!^&՛EÂf! 2> ͆d YaAs/ެ`QoSLfѰEȒ<Ȃ)~ LB tx5,h9SY5,@zz$P,qp75 "3zV[o*tf'Л[# E*ꙁR@LT5`:X/Ä<0Y --"QsnBد?}@=769)`v +Ay6 ~jщ #:8ا5U]t1C ID(Pn)s:IsI+yԹ9Ԏ'l9&@ ѭHwa{vͭv.%zVciM֦jJnbE7"*pk2UW;ʄ&ymB䇍eL(l*&du„*zo)OkI4РEϩv4⸔ӿBYϺC^t277{sߙeW;O,W,7{s7T'/ox3ǻ=ܗ??@mX!}χo?翠~|xwֺ_:o-o߈3?7s;𛗿7awv& +YbCC8*uw)M"I=Kx]:x$8:?K&H",J;4ag?ȴ/->mu9BeG;.^~:kȋYM1X0Cc qrj2~g_cI\ee;!llMr{BvYN>"D಴OﷲmqSӶ]w_q!/㞦ײN{}XcuV4sXޔQ,Mt'QJɄ}@hƞ5-HVέU=坞nч'ۘY?lm^41Js|ΥXi:&viLR3=PeӢ{5ǪY9Ű{3uI_@>ْ۟Эdt;W /C(c;t}ROΕW{n>w ^]_V_+[c[QVu͞6kF˜@Ԧlp돎}]wc@x2j#>Lܾ.~7e:8~mm=VsUg:GQ_Ր^g]f5csu]ӤrMwyû|nra2ob{j\CmUS64/ko| >㴍CƁkLok!4 ic=Or9-;f_e϶ykw ?~\3:Ym$֒XKgE^ +p, +;&r DŸt@ؖ\YcV;t bsNO'z̓թ8`(=q읧o:&%'_d?}&պKr,S$UO/ucih,Į3m2@ϖ3 +rOKv +bn}dy= +=T'q.Us_T&iÖR<kA B6{ c}ApG|gy|kXXِ׸B:~hiT꼵(CWh'qzWrMDj쵭nx:8?_x+?Fp[WdcF2rmGF^u u+iP0]LBIXQЛy1';54 +Hrk"FۖINŀ ,ƈemjbRNrWܕKrR P\9rɪв{P;h{ˈS<3S;oK/¿p֋IѕCU9C"m*F祯3a;L G/Ex=C yۚUt. E}.ghҧ^(nb/> +endobj +892 0 obj +<< +/Filter /FlateDecode +/Length 4317 +>> +stream +x\K$ȳ%X 0vჁ6 :Ƣf2Pd2˞ `PG(2=~ ppԜ|ɻ,>Ysvj*rI ]s:_w'5 <+咳U 9J2X)8b bH 1Xc,@ U!F́-U +rɃ ,^ .-KW]JIc"'Exd %&Ēej +duY|UrR ɫ=/zqR lLv)e!KRMddaX‚A@Ƀ,֮R-Y(F r,,,@Dj@mb Y)ZX$s2[X%!V-^d+laAȥ\4\b‚\! pEDD/@ / J,-,( LxhPcyfpr*ZXmLHi `&ba$HsLd!a Jn J,G `of ,,,>9 -,罅5䛑-,|XXP#DgJIlaAe"QLdAT} LB tx Ԕ4, @, 7Y.J2Y<."da.o"r{f8Y1^o5K o͚jd &2˒̪*eE%s%MVl Ft?rZN~=N_~*e'&H7R rm8F0A3a4 !Q!r] ťB#lE*s@0y),%[7y'YW%Ѹ(g%!膯Qn`w<$K7ywYi!OBX/yM!JG! B5~G!7N{:O!O_~/Xfx\w8#a|D:]yzy5?\:kU#YҴn6s ڧp6S7w*3]tո1G5j 󝢥zqj~Wj3>e d$.j˲+R}.C?,o/HhQƆ /Nǜ.}sqH!?R@a]*qC煞ה B`̇MAYc`j='MH + v{,*w}cʲuWnqf^,ه,~$W)z]cz)"%!j|E'>ϜCTmX_ajօik͟;_fd1Cʜc/;'.L-=ؚ-jzy<`uARFq1G,Hz9] 8rh'*}>m +ABsڏ ݽXduK VsyÈUE0ɼ/U(~l'r`2?nn/JAJ)qcɎ_I1o̢&7CK[5g*3Nfz0'aZS䧛o\Z< [|#}|~\t8 ^ .|6;꟢n;O79oCznI%lYܜRVCzKI DUV>=ўGc}>LEaC_k&{8VK>Fݍ\8ajs3ϲ#Let<Y>{ R܅ zCR_17L+ 9 +zQ'\ˤx u0PѻXL5}!_ y&13;q_)RZ<OcwO$.1ľil5T.F/I.jCz-0~7}rHv5rñ.(P0h~#N{g;[+FoɏvۑxqownJzS MG.!m#rǺPJXҎE}/z}~i'~쫾pjIנ=<^R+^Kݟji՗n&m}2B߷>G@Ӓ\h=8Micz.ql7X PI/GNVblVJfGWb͈wGp?j}!]_Gm;9Bs f!C$ZYߵ1/m#k@|= M8u%pn;eG!m|^ Q]CgfZ)ŏӻe{ 3A=|l?R{G,=3ΛtYO2p~gG+$/i zm狥m:Nz8ro`PXƑN`#m?ǮFwwsJm:ADzޅ@R-WiuA\:qOD'iա´mr>"^Nn/&U>TnFPuP c d}haUӷG Gl&chU֮k~e5u*ChfJi}fKkd7x9 _Nֲbnz3q^V*EUؚWAUi&ϮW$7y갥ym;+> +endobj +894 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 766.923057 101.433071 748.173057 ] +/BS << +/W 0 +>> +/Dest (cb241-1) +>> +endobj +895 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 747.976036 99.933071 729.226036 ] +/BS << +/W 0 +>> +/Dest (cb241-2) +>> +endobj +896 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.029014 99.933071 710.279014 ] +/BS << +/W 0 +>> +/Dest (cb241-3) +>> +endobj +897 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.081993 99.933071 691.331993 ] +/BS << +/W 0 +>> +/Dest (cb241-4) +>> +endobj +898 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 691.134971 99.933071 672.384971 ] +/BS << +/W 0 +>> +/Dest (cb241-5) +>> +endobj +899 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.187950 99.933071 653.437950 ] +/BS << +/W 0 +>> +/Dest (cb241-6) +>> +endobj +900 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 653.240928 99.933071 634.490928 ] +/BS << +/W 0 +>> +/Dest (cb241-7) +>> +endobj +901 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.293907 99.933071 615.543907 ] +/BS << +/W 0 +>> +/Dest (cb241-8) +>> +endobj +902 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.346885 99.933071 596.596885 ] +/BS << +/W 0 +>> +/Dest (cb241-9) +>> +endobj +903 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.399864 99.933071 577.649864 ] +/BS << +/W 0 +>> +/Dest (cb241-10) +>> +endobj +904 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 577.452842 99.933071 558.702842 ] +/BS << +/W 0 +>> +/Dest (cb241-11) +>> +endobj +905 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 520.611778 99.933071 501.861778 ] +/BS << +/W 0 +>> +/Dest (cb241-12) +>> +endobj +906 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 501.664756 99.933071 482.914756 ] +/BS << +/W 0 +>> +/Dest (cb241-13) +>> +endobj +907 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 482.717735 99.933071 463.967735 ] +/BS << +/W 0 +>> +/Dest (cb241-14) +>> +endobj +908 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 463.770714 99.933071 445.020714 ] +/BS << +/W 0 +>> +/Dest (cb241-15) +>> +endobj +909 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 444.823692 99.933071 426.073692 ] +/BS << +/W 0 +>> +/Dest (cb241-16) +>> +endobj +910 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.876671 99.933071 407.126671 ] +/BS << +/W 0 +>> +/Dest (cb241-17) +>> +endobj +911 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.929649 99.933071 388.179649 ] +/BS << +/W 0 +>> +/Dest (cb241-18) +>> +endobj +912 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 345.982628 101.433071 327.232628 ] +/BS << +/W 0 +>> +/Dest (cb242-1) +>> +endobj +913 0 obj +<< +/Title (CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 141 +/First 914 0 R +/Last 1050 0 R +/Parent 1055 0 R +>> +endobj +914 0 obj +<< +/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21) +/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] +/Count 2 +/First 915 0 R +/Last 916 0 R +/Parent 913 0 R +/Next 917 0 R +>> +endobj +915 0 obj +<< +/Title (Overview) +/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] +/Count 0 +/Parent 914 0 R +/Next 916 0 R +>> +endobj +916 0 obj +<< +/Title (Testing controls methodology) +/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] +/Count 0 +/Prev 915 0 R +/Parent 914 0 R +>> +endobj +917 0 obj +<< +/Title (Controls) +/Dest [ 309 0 R /XYZ 84.259843 612.381496 0 ] +/Count 0 +/Prev 914 0 R +/Parent 913 0 R +/Next 918 0 R +>> +endobj +918 0 obj +<< +/Title (1.1 Master Node Configuration Files) +/Dest [ 313 0 R /XYZ 41.740157 784.430079 0 ] +/Count 21 +/Prev 917 0 R +/First 919 0 R +/Last 939 0 R +/Parent 913 0 R +/Next 940 0 R +>> +endobj +919 0 obj +<< +/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 918 0 R +/Next 920 0 R +>> +endobj +920 0 obj +<< +/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 553.851496 0 ] +/Count 0 +/Prev 919 0 R +/Parent 918 0 R +/Next 921 0 R +>> +endobj +921 0 obj +<< +/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 920 0 R +/Parent 918 0 R +/Next 922 0 R +>> +endobj +922 0 obj +<< +/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 277.251496 0 ] +/Count 0 +/Prev 921 0 R +/Parent 918 0 R +/Next 923 0 R +>> +endobj +923 0 obj +<< +/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 313 0 R /XYZ 84.259843 146.451496 0 ] +/Count 0 +/Prev 922 0 R +/Parent 918 0 R +/Next 924 0 R +>> +endobj +924 0 obj +<< +/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 739.970079 0 ] +/Count 0 +/Prev 923 0 R +/Parent 918 0 R +/Next 925 0 R +>> +endobj +925 0 obj +<< +/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 609.170079 0 ] +/Count 0 +/Prev 924 0 R +/Parent 918 0 R +/Next 926 0 R +>> +endobj +926 0 obj +<< +/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) +/Dest [ 315 0 R /XYZ 84.259843 478.370079 0 ] +/Count 0 +/Prev 925 0 R +/Parent 918 0 R +/Next 927 0 R +>> +endobj +927 0 obj +<< +/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 347.570079 0 ] +/Count 0 +/Prev 926 0 R +/Parent 918 0 R +/Next 928 0 R +>> +endobj +928 0 obj +<< +/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) +/Dest [ 315 0 R /XYZ 84.259843 170.823057 0 ] +/Count 0 +/Prev 927 0 R +/Parent 918 0 R +/Next 929 0 R +>> +endobj +929 0 obj +<< +/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 694.023057 0 ] +/Count 0 +/Prev 928 0 R +/Parent 918 0 R +/Next 930 0 R +>> +endobj +930 0 obj +<< +/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) +/Dest [ 318 0 R /XYZ 84.259843 365.776036 0 ] +/Count 0 +/Prev 929 0 R +/Parent 918 0 R +/Next 931 0 R +>> +endobj +931 0 obj +<< +/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 702.470079 0 ] +/Count 0 +/Prev 930 0 R +/Parent 918 0 R +/Next 932 0 R +>> +endobj +932 0 obj +<< +/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 586.670079 0 ] +/Count 0 +/Prev 931 0 R +/Parent 918 0 R +/Next 933 0 R +>> +endobj +933 0 obj +<< +/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 470.870079 0 ] +/Count 0 +/Prev 932 0 R +/Parent 918 0 R +/Next 934 0 R +>> +endobj +934 0 obj +<< +/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 340.070079 0 ] +/Count 0 +/Prev 933 0 R +/Parent 918 0 R +/Next 935 0 R +>> +endobj +935 0 obj +<< +/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 323 0 R /XYZ 84.259843 209.270079 0 ] +/Count 0 +/Prev 934 0 R +/Parent 918 0 R +/Next 936 0 R +>> +endobj +936 0 obj +<< +/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 935 0 R +/Parent 918 0 R +/Next 937 0 R +>> +endobj +937 0 obj +<< +/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) +/Dest [ 325 0 R /XYZ 84.259843 668.570079 0 ] +/Count 0 +/Prev 936 0 R +/Parent 918 0 R +/Next 938 0 R +>> +endobj +938 0 obj +<< +/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 349 0 R /XYZ 84.259843 184.188585 0 ] +/Count 0 +/Prev 937 0 R +/Parent 918 0 R +/Next 939 0 R +>> +endobj +939 0 obj +<< +/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) +/Dest [ 440 0 R /XYZ 84.259843 702.470079 0 ] +/Count 0 +/Prev 938 0 R +/Parent 918 0 R +>> +endobj +940 0 obj +<< +/Title (1.2 API Server) +/Dest [ 508 0 R /XYZ 41.740157 784.430079 0 ] +/Count 35 +/Prev 918 0 R +/First 941 0 R +/Last 975 0 R +/Parent 913 0 R +/Next 976 0 R +>> +endobj +941 0 obj +<< +/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) +/Dest [ 508 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 940 0 R +/Next 942 0 R +>> +endobj +942 0 obj +<< +/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) +/Dest [ 511 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 941 0 R +/Parent 940 0 R +/Next 943 0 R +>> +endobj +943 0 obj +<< +/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) +/Dest [ 516 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 942 0 R +/Parent 940 0 R +/Next 944 0 R +>> +endobj +944 0 obj +<< +/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) +/Dest [ 519 0 R /XYZ 84.259843 164.720079 0 ] +/Count 0 +/Prev 943 0 R +/Parent 940 0 R +/Next 945 0 R +>> +endobj +945 0 obj +<< +/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) +/Dest [ 524 0 R /XYZ 84.259843 427.220079 0 ] +/Count 0 +/Prev 944 0 R +/Parent 940 0 R +/Next 946 0 R +>> +endobj +946 0 obj +<< +/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) +/Dest [ 529 0 R /XYZ 84.259843 652.220079 0 ] +/Count 0 +/Prev 945 0 R +/Parent 940 0 R +/Next 947 0 R +>> +endobj +947 0 obj +<< +/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 532 0 R /XYZ 84.259843 183.470079 0 ] +/Count 0 +/Prev 946 0 R +/Parent 940 0 R +/Next 948 0 R +>> +endobj +948 0 obj +<< +/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) +/Dest [ 537 0 R /XYZ 84.259843 464.720079 0 ] +/Count 0 +/Prev 947 0 R +/Parent 940 0 R +/Next 949 0 R +>> +endobj +949 0 obj +<< +/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) +/Dest [ 542 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 948 0 R +/Parent 940 0 R +/Next 950 0 R +>> +endobj +950 0 obj +<< +/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) +/Dest [ 545 0 R /XYZ 84.259843 314.720079 0 ] +/Count 0 +/Prev 949 0 R +/Parent 940 0 R +/Next 951 0 R +>> +endobj +951 0 obj +<< +/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) +/Dest [ 550 0 R /XYZ 84.259843 520.970079 0 ] +/Count 0 +/Prev 950 0 R +/Parent 940 0 R +/Next 952 0 R +>> +endobj +952 0 obj +<< +/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 708.470079 0 ] +/Count 0 +/Prev 951 0 R +/Parent 940 0 R +/Next 953 0 R +>> +endobj +953 0 obj +<< +/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) +/Dest [ 555 0 R /XYZ 84.259843 501.723057 0 ] +/Count 0 +/Prev 952 0 R +/Parent 940 0 R +/Next 954 0 R +>> +endobj +954 0 obj +<< +/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) +/Dest [ 555 0 R /XYZ 84.259843 264.976036 0 ] +/Count 0 +/Prev 953 0 R +/Parent 940 0 R +/Next 955 0 R +>> +endobj +955 0 obj +<< +/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) +/Dest [ 562 0 R /XYZ 84.259843 520.970079 0 ] +/Count 0 +/Prev 954 0 R +/Parent 940 0 R +/Next 956 0 R +>> +endobj +956 0 obj +<< +/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) +/Dest [ 567 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 955 0 R +/Parent 940 0 R +/Next 957 0 R +>> +endobj +957 0 obj +<< +/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) +/Dest [ 570 0 R /XYZ 84.259843 258.470079 0 ] +/Count 0 +/Prev 956 0 R +/Parent 940 0 R +/Next 958 0 R +>> +endobj +958 0 obj +<< +/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) +/Dest [ 575 0 R /XYZ 84.259843 427.220079 0 ] +/Count 0 +/Prev 957 0 R +/Parent 940 0 R +/Next 959 0 R +>> +endobj +959 0 obj +<< +/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) +/Dest [ 580 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 958 0 R +/Parent 940 0 R +/Next 960 0 R +>> +endobj +960 0 obj +<< +/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) +/Dest [ 583 0 R /XYZ 84.259843 314.720079 0 ] +/Count 0 +/Prev 959 0 R +/Parent 940 0 R +/Next 961 0 R +>> +endobj +961 0 obj +<< +/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 588 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 960 0 R +/Parent 940 0 R +/Next 962 0 R +>> +endobj +962 0 obj +<< +/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) +/Dest [ 591 0 R /XYZ 84.259843 183.470079 0 ] +/Count 0 +/Prev 961 0 R +/Parent 940 0 R +/Next 963 0 R +>> +endobj +963 0 obj +<< +/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) +/Dest [ 596 0 R /XYZ 84.259843 445.970079 0 ] +/Count 0 +/Prev 962 0 R +/Parent 940 0 R +/Next 964 0 R +>> +endobj +964 0 obj +<< +/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) +/Dest [ 601 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 963 0 R +/Parent 940 0 R +/Next 965 0 R +>> +endobj +965 0 obj +<< +/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) +/Dest [ 604 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 964 0 R +/Parent 940 0 R +/Next 966 0 R +>> +endobj +966 0 obj +<< +/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) +/Dest [ 609 0 R /XYZ 84.259843 595.970079 0 ] +/Count 0 +/Prev 965 0 R +/Parent 940 0 R +/Next 967 0 R +>> +endobj +967 0 obj +<< +/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) +/Dest [ 612 0 R /XYZ 84.259843 164.720079 0 ] +/Count 0 +/Prev 966 0 R +/Parent 940 0 R +/Next 968 0 R +>> +endobj +968 0 obj +<< +/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) +/Dest [ 617 0 R /XYZ 84.259843 408.470079 0 ] +/Count 0 +/Prev 967 0 R +/Parent 940 0 R +/Next 969 0 R +>> +endobj +969 0 obj +<< +/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) +/Dest [ 622 0 R /XYZ 84.259843 689.720079 0 ] +/Count 0 +/Prev 968 0 R +/Parent 940 0 R +/Next 970 0 R +>> +endobj +970 0 obj +<< +/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 625 0 R /XYZ 84.259843 239.720079 0 ] +/Count 0 +/Prev 969 0 R +/Parent 940 0 R +/Next 971 0 R +>> +endobj +971 0 obj +<< +/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 630 0 R /XYZ 84.259843 483.470079 0 ] +/Count 0 +/Prev 970 0 R +/Parent 940 0 R +/Next 972 0 R +>> +endobj +972 0 obj +<< +/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) +/Dest [ 635 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 971 0 R +/Parent 940 0 R +/Next 973 0 R +>> +endobj +973 0 obj +<< +/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) +/Dest [ 638 0 R /XYZ 84.259843 295.970079 0 ] +/Count 0 +/Prev 972 0 R +/Parent 940 0 R +/Next 974 0 R +>> +endobj +974 0 obj +<< +/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) +/Dest [ 643 0 R /XYZ 84.259843 577.220079 0 ] +/Count 0 +/Prev 973 0 R +/Parent 940 0 R +/Next 975 0 R +>> +endobj +975 0 obj +<< +/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 660 0 R /XYZ 84.259843 411.552842 0 ] +/Count 0 +/Prev 974 0 R +/Parent 940 0 R +>> +endobj +976 0 obj +<< +/Title (1.3 Controller Manager) +/Dest [ 674 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 940 0 R +/First 977 0 R +/Last 983 0 R +/Parent 913 0 R +/Next 984 0 R +>> +endobj +977 0 obj +<< +/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) +/Dest [ 674 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 976 0 R +/Next 978 0 R +>> +endobj +978 0 obj +<< +/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 677 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 977 0 R +/Parent 976 0 R +/Next 979 0 R +>> +endobj +979 0 obj +<< +/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) +/Dest [ 680 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 978 0 R +/Parent 976 0 R +/Next 980 0 R +>> +endobj +980 0 obj +<< +/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) +/Dest [ 683 0 R /XYZ 84.259843 745.970079 0 ] +/Count 0 +/Prev 979 0 R +/Parent 976 0 R +/Next 981 0 R +>> +endobj +981 0 obj +<< +/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 686 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 980 0 R +/Parent 976 0 R +/Next 982 0 R +>> +endobj +982 0 obj +<< +/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 727.220079 0 ] +/Count 0 +/Prev 981 0 R +/Parent 976 0 R +/Next 983 0 R +>> +endobj +983 0 obj +<< +/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 689 0 R /XYZ 84.259843 524.420079 0 ] +/Count 0 +/Prev 982 0 R +/Parent 976 0 R +>> +endobj +984 0 obj +<< +/Title (1.4 Scheduler) +/Dest [ 694 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 976 0 R +/First 985 0 R +/Last 986 0 R +/Parent 913 0 R +/Next 987 0 R +>> +endobj +985 0 obj +<< +/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 984 0 R +/Next 986 0 R +>> +endobj +986 0 obj +<< +/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) +/Dest [ 694 0 R /XYZ 84.259843 257.404475 0 ] +/Count 0 +/Prev 985 0 R +/Parent 984 0 R +>> +endobj +987 0 obj +<< +/Title (2 Etcd Node Configuration Files) +/Dest [ 700 0 R /XYZ 41.740157 784.430079 0 ] +/Count 7 +/Prev 984 0 R +/First 988 0 R +/Last 994 0 R +/Parent 913 0 R +/Next 995 0 R +>> +endobj +988 0 obj +<< +/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) +/Dest [ 700 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 987 0 R +/Next 989 0 R +>> +endobj +989 0 obj +<< +/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) +/Dest [ 705 0 R /XYZ 84.259843 464.720079 0 ] +/Count 0 +/Prev 988 0 R +/Parent 987 0 R +/Next 990 0 R +>> +endobj +990 0 obj +<< +/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) +/Dest [ 710 0 R /XYZ 84.259843 258.470079 0 ] +/Count 0 +/Prev 989 0 R +/Parent 987 0 R +/Next 991 0 R +>> +endobj +991 0 obj +<< +/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 717 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 990 0 R +/Parent 987 0 R +/Next 992 0 R +>> +endobj +992 0 obj +<< +/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) +/Dest [ 722 0 R /XYZ 84.259843 558.470079 0 ] +/Count 0 +/Prev 991 0 R +/Parent 987 0 R +/Next 993 0 R +>> +endobj +993 0 obj +<< +/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) +/Dest [ 727 0 R /XYZ 84.259843 333.470079 0 ] +/Count 0 +/Prev 992 0 R +/Parent 987 0 R +/Next 994 0 R +>> +endobj +994 0 obj +<< +/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) +/Dest [ 734 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 993 0 R +/Parent 987 0 R +>> +endobj +995 0 obj +<< +/Title (3.1 Authentication and Authorization) +/Dest [ 741 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 987 0 R +/First 996 0 R +/Last 996 0 R +/Parent 913 0 R +/Next 997 0 R +>> +endobj +996 0 obj +<< +/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) +/Dest [ 741 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 995 0 R +>> +endobj +997 0 obj +<< +/Title (3.2 Logging) +/Dest [ 743 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 995 0 R +/First 998 0 R +/Last 999 0 R +/Parent 913 0 R +/Next 1000 0 R +>> +endobj +998 0 obj +<< +/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) +/Dest [ 743 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 997 0 R +/Next 999 0 R +>> +endobj +999 0 obj +<< +/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) +/Dest [ 746 0 R /XYZ 84.259843 333.470079 0 ] +/Count 0 +/Prev 998 0 R +/Parent 997 0 R +>> +endobj +1000 0 obj +<< +/Title (4.1 Worker Node Configuration Files) +/Dest [ 748 0 R /XYZ 41.740157 784.430079 0 ] +/Count 10 +/Prev 997 0 R +/First 1001 0 R +/Last 1010 0 R +/Parent 913 0 R +/Next 1011 0 R +>> +endobj +1001 0 obj +<< +/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1000 0 R +/Next 1002 0 R +>> +endobj +1002 0 obj +<< +/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 553.851496 0 ] +/Count 0 +/Prev 1001 0 R +/Parent 1000 0 R +/Next 1003 0 R +>> +endobj +1003 0 obj +<< +/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 748 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 1002 0 R +/Parent 1000 0 R +/Next 1004 0 R +>> +endobj +1004 0 obj +<< +/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 763.220079 0 ] +/Count 0 +/Prev 1003 0 R +/Parent 1000 0 R +/Next 1005 0 R +>> +endobj +1005 0 obj +<< +/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 454.079014 0 ] +/Count 0 +/Prev 1004 0 R +/Parent 1000 0 R +/Next 1006 0 R +>> +endobj +1006 0 obj +<< +/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) +/Dest [ 751 0 R /XYZ 84.259843 163.687950 0 ] +/Count 0 +/Prev 1005 0 R +/Parent 1000 0 R +/Next 1007 0 R +>> +endobj +1007 0 obj +<< +/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) +/Dest [ 755 0 R /XYZ 84.259843 519.629014 0 ] +/Count 0 +/Prev 1006 0 R +/Parent 1000 0 R +/Next 1008 0 R +>> +endobj +1008 0 obj +<< +/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1007 0 R +/Parent 1000 0 R +/Next 1009 0 R +>> +endobj +1009 0 obj +<< +/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 383.493907 0 ] +/Count 0 +/Prev 1008 0 R +/Parent 1000 0 R +/Next 1010 0 R +>> +endobj +1010 0 obj +<< +/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) +/Dest [ 764 0 R /XYZ 84.259843 195.693907 0 ] +/Count 0 +/Prev 1009 0 R +/Parent 1000 0 R +>> +endobj +1011 0 obj +<< +/Title (4.2 Kubelet) +/Dest [ 774 0 R /XYZ 41.740157 784.430079 0 ] +/Count 13 +/Prev 1000 0 R +/First 1012 0 R +/Last 1024 0 R +/Parent 913 0 R +/Next 1025 0 R +>> +endobj +1012 0 obj +<< +/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1011 0 R +/Next 1013 0 R +>> +endobj +1013 0 obj +<< +/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) +/Dest [ 774 0 R /XYZ 84.259843 332.207453 0 ] +/Count 0 +/Prev 1012 0 R +/Parent 1011 0 R +/Next 1014 0 R +>> +endobj +1014 0 obj +<< +/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 675.273057 0 ] +/Count 0 +/Prev 1013 0 R +/Parent 1011 0 R +/Next 1015 0 R +>> +endobj +1015 0 obj +<< +/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) +/Dest [ 779 0 R /XYZ 84.259843 301.829014 0 ] +/Count 0 +/Prev 1014 0 R +/Parent 1011 0 R +/Next 1016 0 R +>> +endobj +1016 0 obj +<< +/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) +/Dest [ 784 0 R /XYZ 84.259843 641.326036 0 ] +/Count 0 +/Prev 1015 0 R +/Parent 1011 0 R +/Next 1017 0 R +>> +endobj +1017 0 obj +<< +/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) +/Dest [ 790 0 R /XYZ 84.259843 445.970079 0 ] +/Count 0 +/Prev 1016 0 R +/Parent 1011 0 R +/Next 1018 0 R +>> +endobj +1018 0 obj +<< +/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Prev 1017 0 R +/Parent 1011 0 R +/Next 1019 0 R +>> +endobj +1019 0 obj +<< +/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) +/Dest [ 794 0 R /XYZ 84.259843 425.926036 0 ] +/Count 0 +/Prev 1018 0 R +/Parent 1011 0 R +/Next 1020 0 R +>> +endobj +1020 0 obj +<< +/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) +/Dest [ 794 0 R /XYZ 84.259843 208.126036 0 ] +/Count 0 +/Prev 1019 0 R +/Parent 1011 0 R +/Next 1021 0 R +>> +endobj +1021 0 obj +<< +/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 542.326036 0 ] +/Count 0 +/Prev 1020 0 R +/Parent 1011 0 R +/Next 1022 0 R +>> +endobj +1022 0 obj +<< +/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) +/Dest [ 798 0 R /XYZ 84.259843 138.881993 0 ] +/Count 0 +/Prev 1021 0 R +/Parent 1011 0 R +/Next 1023 0 R +>> +endobj +1023 0 obj +<< +/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 670.970079 0 ] +/Count 0 +/Prev 1022 0 R +/Parent 1011 0 R +/Next 1024 0 R +>> +endobj +1024 0 obj +<< +/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) +/Dest [ 808 0 R /XYZ 84.259843 392.223057 0 ] +/Count 0 +/Prev 1023 0 R +/Parent 1011 0 R +>> +endobj +1025 0 obj +<< +/Title (5.1 RBAC and Service Accounts) +/Dest [ 815 0 R /XYZ 41.740157 784.430079 0 ] +/Count 6 +/Prev 1011 0 R +/First 1026 0 R +/Last 1031 0 R +/Parent 913 0 R +/Next 1032 0 R +>> +endobj +1026 0 obj +<< +/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1025 0 R +/Next 1027 0 R +>> +endobj +1027 0 obj +<< +/Title (5.1.2 Minimize access to secrets \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 523.851496 0 ] +/Count 0 +/Prev 1026 0 R +/Parent 1025 0 R +/Next 1028 0 R +>> +endobj +1028 0 obj +<< +/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 423.051496 0 ] +/Count 0 +/Prev 1027 0 R +/Parent 1025 0 R +/Next 1029 0 R +>> +endobj +1029 0 obj +<< +/Title (5.1.4 Minimize access to create pods \(Manual\)) +/Dest [ 815 0 R /XYZ 84.259843 307.251496 0 ] +/Count 0 +/Prev 1028 0 R +/Parent 1025 0 R +/Next 1030 0 R +>> +endobj +1030 0 obj +<< +/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) +/Dest [ 815 0 R /XYZ 84.259843 206.451496 0 ] +/Count 0 +/Prev 1029 0 R +/Parent 1025 0 R +/Next 1031 0 R +>> +endobj +1031 0 obj +<< +/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) +/Dest [ 842 0 R /XYZ 84.259843 449.446885 0 ] +/Count 0 +/Prev 1030 0 R +/Parent 1025 0 R +>> +endobj +1032 0 obj +<< +/Title (5.2 Pod Security Policies) +/Dest [ 853 0 R /XYZ 41.740157 784.430079 0 ] +/Count 9 +/Prev 1025 0 R +/First 1033 0 R +/Last 1041 0 R +/Parent 913 0 R +/Next 1042 0 R +>> +endobj +1033 0 obj +<< +/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) +/Dest [ 853 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1032 0 R +/Next 1034 0 R +>> +endobj +1034 0 obj +<< +/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 589.851496 0 ] +/Count 0 +/Prev 1033 0 R +/Parent 1032 0 R +/Next 1035 0 R +>> +endobj +1035 0 obj +<< +/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) +/Dest [ 853 0 R /XYZ 84.259843 238.710432 0 ] +/Count 0 +/Prev 1034 0 R +/Parent 1032 0 R +/Next 1036 0 R +>> +endobj +1036 0 obj +<< +/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 603.629014 0 ] +/Count 0 +/Prev 1035 0 R +/Parent 1032 0 R +/Next 1037 0 R +>> +endobj +1037 0 obj +<< +/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) +/Dest [ 856 0 R /XYZ 84.259843 252.487950 0 ] +/Count 0 +/Prev 1036 0 R +/Parent 1032 0 R +/Next 1038 0 R +>> +endobj +1038 0 obj +<< +/Title (5.2.6 Minimize the admission of root containers \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 584.681993 0 ] +/Count 0 +/Prev 1037 0 R +/Parent 1032 0 R +/Next 1039 0 R +>> +endobj +1039 0 obj +<< +/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 453.881993 0 ] +/Count 0 +/Prev 1038 0 R +/Parent 1032 0 R +/Next 1040 0 R +>> +endobj +1040 0 obj +<< +/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 323.081993 0 ] +/Count 0 +/Prev 1039 0 R +/Parent 1032 0 R +/Next 1041 0 R +>> +endobj +1041 0 obj +<< +/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) +/Dest [ 860 0 R /XYZ 84.259843 207.281993 0 ] +/Count 0 +/Prev 1040 0 R +/Parent 1032 0 R +>> +endobj +1042 0 obj +<< +/Title (5.3 Network Policies and CNI) +/Dest [ 863 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1032 0 R +/First 1043 0 R +/Last 1044 0 R +/Parent 913 0 R +/Next 1045 0 R +>> +endobj +1043 0 obj +<< +/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) +/Dest [ 863 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1042 0 R +/Next 1044 0 R +>> +endobj +1044 0 obj +<< +/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) +/Dest [ 863 0 R /XYZ 84.259843 538.851496 0 ] +/Count 0 +/Prev 1043 0 R +/Parent 1042 0 R +>> +endobj +1045 0 obj +<< +/Title (5.4 Secrets Management) +/Dest [ 887 0 R /XYZ 41.740157 784.430079 0 ] +/Count 2 +/Prev 1042 0 R +/First 1046 0 R +/Last 1047 0 R +/Parent 913 0 R +/Next 1048 0 R +>> +endobj +1046 0 obj +<< +/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1045 0 R +/Next 1047 0 R +>> +endobj +1047 0 obj +<< +/Title (5.4.2 Consider external secret storage \(Manual\)) +/Dest [ 887 0 R /XYZ 84.259843 568.851496 0 ] +/Count 0 +/Prev 1046 0 R +/Parent 1045 0 R +>> +endobj +1048 0 obj +<< +/Title (5.5 Extensible Admission Control) +/Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] +/Count 1 +/Prev 1045 0 R +/First 1049 0 R +/Last 1049 0 R +/Parent 913 0 R +/Next 1050 0 R +>> +endobj +1049 0 obj +<< +/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) +/Dest [ 889 0 R /XYZ 84.259843 684.651496 0 ] +/Count 0 +/Parent 1048 0 R +>> +endobj +1050 0 obj +<< +/Title (5.7 General Policies) +/Dest [ 891 0 R /XYZ 41.740157 784.430079 0 ] +/Count 4 +/Prev 1048 0 R +/First 1051 0 R +/Last 1054 0 R +/Parent 913 0 R +>> +endobj +1051 0 obj +<< +/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 720.651496 0 ] +/Count 0 +/Parent 1050 0 R +/Next 1052 0 R +>> +endobj +1052 0 obj +<< +/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 604.851496 0 ] +/Count 0 +/Prev 1051 0 R +/Parent 1050 0 R +/Next 1053 0 R +>> +endobj +1053 0 obj +<< +/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) +/Dest [ 891 0 R /XYZ 84.259843 324.051496 0 ] +/Count 0 +/Prev 1052 0 R +/Parent 1050 0 R +/Next 1054 0 R +>> +endobj +1054 0 obj +<< +/Title (5.7.4 The default namespace should not be used \(Automated\)) +/Dest [ 891 0 R /XYZ 84.259843 193.251496 0 ] +/Count 0 +/Prev 1053 0 R +/Parent 1050 0 R +>> +endobj +1055 0 obj +<< +/Count 142 +/First 913 0 R +/Last 913 0 R +>> +endobj +1056 0 obj +<< +/Length1 41004 +/Filter /FlateDecode +/Length 7589 +>> +stream +x| xUut;YH',-11 EB$!`B'AIT&d 0Ȍ +88L@f:cLnx9ֽrι{?R R23[1i& ǩ=x~sg7;@>x>|- `wbkͷSF'N+KX-NSE@7T^7y\L`ySgξ}/{6eꌅy3 *ϟ}7*zSTKsr> @pFEiY3s+ ,\R{ϬSy `=m&s3|Pu'<\G PɕMƎKIEfJ H[&*DC +4i#w# `QD|77(|;FLv)XVx[ +_p rߧe)s*`i +:iO(N(svx{̦1f0[xqpD'[yZ#j5nQ`,gz‹:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:tСC:to%2Ckmԯ9)e]twj, + Ca4@Lߪ~=6zzt= 0洶^9~7ADtj*r<|ht(^*W:4׊|oxUx~5_/_=^io.xqwӻp'Ǘ8݁8*[%Iun |0\|nMz. 7p 帾*@Zϱ*+Se{*Kgt8*XQ>Q8KxXŧ8YSZquO||n,[eʜʌTQ+IS+Ž|]Zqดc G_KHs\bTEr|̊ ,8߄8m¢&ӄcYgDtHiT*q1d8&|؂9ǙM8΄IX 1.lPIs2}GkFr׆#8'9jЈi `U8 +rG!ӄDZ?ǻtHw9Ό@Nf 2|/rN&&vbtˆf=0663$L6cF {{*vꕺb$ՋILLJwcf)>f1&Ihzr1 #I\@7i1 0*q T`.NANm 梕c%X +h֖`4s4Qf +G\HBEN^& =8Z)/"X:g;~u6T `̣7V&p QR8E` j>As>YqxP%֊ų[,ϊbKíXi]}M! +jE(#-a8PE/~I2,$߲u_YCWr ?<6:Fխ3'qӒK*HgdL!0FV6(CtI'tI'tI'tI'tI'tI'tI'tI'tI't鿟L4A.(~DwoƔhWt|SJW Px$7Ns~zKqtL`(TKOڨDn(f^8f\514ǰ( +{Gۥto8lÆ5o- ta7 PE 6ºc.`$qm}]@sL3Cl(Gؚ׸ 51"NOo<~uMb҇x> a0.|y^e2lYe;ag}"L齠w^Ȇ^RES6ʄ#Si9s-:?0~} ھ3]P5woKwm/[/U$`/.HmՖ5^Kp/-I@kpvU%:<gY,-@0Md12\ļ*rB6N ڼy]8o w`L׾-*b#~Gn9zt#ڸx7݃w3{-dHoUlR>Y@6;`'DA]Sf7  вZiIQ 4T2|(}Q2 Q5|# zcQ;n?kX@C`>0"hY0,SY/,9cJ)[%,<+l*1Vhb1cz~U⯅>jydd͍$v=04+OJQv"EI`uKaFp;hZf:d}4ӥ]r 0d`hmb;2^Z-)c3l/"g֭]rŕZN|^z +!U0gv˶:=g}}E0źTig[`X־!,R.*ip5``xT@fCzdàZ_c6.=zedW^&]xa~?~ܐ!l3u`q>>H+>Wu&Rv1-4l$ޚOvp_GGe13Tͷyl5{if((l^ͯ+,9h)fYlÐ?>{KZk 5B g4ϨV H|R-K%ybP=;HƑ8A$QD.8@ x,J2n),Lw1B F:cG: ]<6Ǣ &$.1DyxL Jً2Y/I Vɫ X{=ڣ&M,>uw]g?~}>{͠yyKi>qJ&I>#}-WK/_U$㾌`5 QQ0&sdb\Zi+a 61d +7@Lx!hdcscGM/ ¯)'0s(*)9$۷?CB MoKK WX--nr}a!ODf^KOCޠUZU[(&{7POa9h]!rYu][k_b 0*(Ti=ߘjזdfoz2JHLJDOE"}Q>/ɊΊJ(LXQYU)^SPp-!k{ّQٞ¨BOaȥQK=KCo:s{c/ĐzEw>QgZ~bKrl¿_'}|0iDrNl}duϞUz / /VUue*S] U#8jhw^6~)>s`-|ixExu:-rZisbxy Y֫Y/w!{utnvű9XXZAJ ; t.u`uIk-[O aadh~vjʡȥՑ:6 vobݿLk[N;w>KxHxƝ9l Spי˗m|8ƕ*ɵIuv4QkYw K#p[cOFRˆ"EH?/wdcwSUn8[Uptpn5LчASA,i>`9{S&7_XRWP+l_*<<ةo׵;3??M$` ]x[1Kf*כ hTݲIuf-jy5d8ٜqC8 t ۮR!\.[lzj?j&˒u55^'7'#!Pu/ V&Z&&(0RݹNg_WF2сlvڵvQ&ͮ1vʽuu^w-a[C¦͛mk)-~ RBYatYc~$ؚ3Uskhn$},cHHvz8QKBx&EI]%]%GsI@FYbLffU')eNFh6-B{DLJ $IݔB0U)H˄273B^yQpP<( f1AL >K>f[pX&=%6zn|I:dxx .^L x1b ޿_k9U';K-[ +-7s 4oH[!^(]dHa6]"h_0apYJ#-bv.IDMV[ϭjfn[b4j~45C u:ք5(TsDmwlb(K %JTb.XKKl%bGuص0o= {uh=5WxӗyԷy#Bny'ïFځ^d3KzIV@t(`V U'($E Kuu}ƃc-Hy%f+s͖bmwes,T=Ｕ7bQՠ8c%\){t>nən$7b DsנdgkpbdbT'):.aiyeeCUBdlF цa-F'=T4":ZR(o ` KsBY٤uOnGޘVβ5S<%&mC?<WlH{Ng.z?WJMf16Ur`H% ^g4 "IQz*VW /z [KKMw-e#7n@.gwy8m9}c1zg~jHf6 3oQB<ۧnkk?숰%gcۄ⟪M;U=^"f ?8$ $ANڏ.![:g(o-"<* %JaV&(DFzW9`1Y&%Y_+(ɆP1S"0bylNJr2b,E +Xʰ΃rTF|V|VZ/^kEUkz 077CMbvS?vC|AZa ThsWT6lj@>1!t)rTq5‰ԔBNaj>Zvܠj&'ijo/c XCP.G:EE`< ~yPC!ZC﷮7BTnrwT + Z)(ئe]WTS#v2|Iɢ(6agO厢]FB8>@PWLSݭ0L:~F,RMј!fOt6>S]JFHcL7u2UM5uGSTX6XlVTڜT_ݫw׼%z>N^ဪζG&-p%lWnhBn5a/813@:ܲnI2M0 Bݞ]vez^nV-N;E2.kC!LPh#I7jA0yٖNbld[^'˃{ +a!́i0a.x & x R(7Zx` Et́)3;YԾ'D1VVB)g> f1i>ͥ,jC}RQ7Q >9hS9Def;y͞=u(EtUg-Ҿ(4K'M[?Uk}c҂r~eSi]}baꗏl1P= #FiY>Ӿ)hݺSNZf@J3i $ 2x [UDd00sș; BA$PԞS[S"\3z&hwFQ[ +a qڦsLigЇ/5pGU7?D˭[_ƶ9-֩ŶI TNE~Fsm>ܩ-zPFKZRCj:utkο0<#+t'#~! Q;/@i{Lo{kyDzHd5L#=@;x"U}A(R2-Ue!meX:Ϧj5eߖƝ qv^;qSN97?gHFGDDM)> +endstream +endobj +1057 0 obj +<< +/Length1 7648 +/Filter /FlateDecode +/Length 4712 +>> +stream +x9yxSU眛&-PhZHYӄ(rtO&͞nItInPR"ouFD}*OE2 ~CGE8qDܼ߹IK|{[o;)h1Ho.)vW;V!4^]dv,(; S])jnBn_/.A(l5+=*A9{%ˏewr|i a=J y%NFV%0f%k#B9d5mQd~kFNF)$9wПȉJ*`y1;$Q<9{ 2g_gA10;x^~cԎ1l"T'D҅IQ}H -!5*h܅`B Ff?HB&ZXp*u61 +7"4E 3)2\ +A5h ZhN PhV VUl]p6˧~k~KڎGoA9>CWCI&ny/ALa1_ R킇''87|_وyDcƈ"x7iis,[T?R@#fM$WP*3Mx`.'8PiS"\dccdQk5:r, B$ZQZc ]e(ՖԉLn[VZInN,Aiixs2]U¡/\:<3ܑ%ja,WXF(9_;#/ 3]%sB(HNg%B"-vuyq#8Νw#V`eupT֨RFKfQjkg_o]{_glq9}RKm0#IEJ<]LWKAxb] QYrɣY2fevB8Гhc͵pǑ7 [pv|E-\Ej66UJf % +E|Pj+>)`_㾪bkԧڧEoQ$$M r@7IBUXhVgm16|Jd65KouQnKsktՑaQLzeKÚe/plFׂ #4"49XJ -uMMz +%NQo>m4[!$He87KtnZjKҮ,k4*ҭ/.))GȖ vZ 3uEEr h8t ptBĀ&A%SLJ5PUk5dz9R*L'ynuhK?Wv> 7 +[QJkm}Rmidg/F. \x%  rh'{Bp2 +*B Rh;tVgկr8Ub*,q\zjVl6BSgi4|C} caƩB}Q` jУ8ZH9A )'TU*&C{κ:kZgV&WYѝM'ylEO.[iVR-x;Sr(iFI7AA nw$*r::zAd#y!X&ǰ1r%?qg2꯷_/y~s{t8>G[&qc6[m5qׯTt{Ho2ŧx{nz!۳^A1\̆(xסC=;G;;wȘ7?O)]p# G,8<`\(46|{o=dyQHfZ 5{U*k˖ܟPw׷foJulaMʹb xo9i +NZ#ЎTޤxp#pj9dVVðFO> h Rɋ<T=[[{#.z^F!=[K&GULNE"=jFl_Z~u+9}L7n u2PC-.L)tIQ(ʎJmg5qR+wn>sܦO{F$] +Τ7V"GxYqz۰fڷdLͶDsq5Wg G /Ǥ3IVM,lb|BWvVa}xS-7ӒY"JL3KTqԆ%ٚ9Q1luPJq8!GWOz^GVڨ؁J D|SZlBasMuu ,CYYC!v7_lL GA3"|@RfD 3Ovn&t()#NX\c(fAh>\h>r+⾇Kӳ죘UĈFUq,>Q\l!rLaC2 ggگ;t„ibaqq:`~m큭d}CeMg@%f&9$Jͥ}~_!$ #~ds2hZ:޹fj#>*gYJfrn`ҥ4ϷY6ri^]^MZZ MVp &'Ni&\wVs.A@E(u n&.\>(`BXkM+܈\͒9EE9%b4 )+ ΆƮ 4bBZHKҲ{惴:֡[H+;給@\A\mo"Ԑ; M5e$la͖(`hɸBWFBlWVQ{q-' &h,͚$ +x|SsvܑU]ug!J1 =~)l)xedMbz6(e;z|1yV( ]OC薶C֏_Ԫ H"w_)2*hMry\$. 'a5:(CY5Feh 0/οs_s\\σ~0$dOCo̢B<qҎIo81YG'~n\56?I"^TAl כ#EE#VhQ +ڝr"@ G7Jޤ$o{ :x[y Λ=ЩΐN:}@y)܃̒)Z[zVO +s7bgKnnO+Ss%JڃDǿȃ{JFc +LSS+(P t7+0y,&%ۦ*OvDST,WQ|2RoIzY\$2jNdY +;yj"Sr!SBVb2Ca6{vyii*m4Vox]*szj2-٠jV7Qϗ.K[k8J`?ǰxg o< ,A>%(ݲHjXG1c(85>ͱtHxmӐ)fǰt=ںi]3GOQx[oqqd1K X,枯DqCNpF".GvJ^qiwn6@6v3HA!^x:;`|~I"^O>t8u[]j oC?M7rз-@WCah--D p<2 ~ԎZQB|]0 m  0=hH5+*h`_4+PDػX 7knc- +m06қe໐@ [8Bs*5АOoNK .x_|oLCpC*S>ԼZk?5G" +endstream +endobj +1058 0 obj +<< +/Length1 47128 +/Filter /FlateDecode +/Length 11768 +>> +stream +x} xEhUw2353IH0<W $0 s1bVA +nD֋.rO$XoΡNwUPBH + 3e㫞$Xҷw_}p?+< B{~0!/oCΌYЭx?|Œ H'dxvmsyF݄affrD|^5xv9 myyOr7%֭X>i[N1"o=lBB!3o/̖c 8xFI[۵Hse4 p||VI_2E)"y^8gIwO/ϟ ٦FjUL2${"lCMkrfC`M`E"߱PeK8t6-zH)0ȶf})=I"U=CXf/mhhOHiSK[I5J 2؈xI<*1:36ڑHsYm^ϰ'W'er^A>Hͻ 54xdC}y AF|i^ Ul2 ^k6Y+v:.$`H,kלA b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b 1A b7@c;KgzKj"F\X AEޤ?La2#S- iEڑk@|> 7iy×^5E` Yȍ#o k{me V!y CF(|d5OVӿ_k;pȈnڪwAc +x){<U'L>z0냮-DaƲ% !8mIj.lXl'2id"24ɬeY&,ԃRkkuY:,NN^Syf' +Q+JOEXg:`ojfi!6o;kϯ9/n +1%4,߀Pw-p- +B_BQ ? QyeA}]Pc@MD۷[|k_kG|_Wpo8-K%  8%Z8i"?9>MaI-|>|q]p+?glZx? GpO~$^ދp*C xB"H[av!Q +ÛޘAkjW^}6+{$u{le'K8Kv x /Sx>xyi{-J6Ouz|2BPv(w);EREg+ke>!)! kְ5i{ t 8-\fзAw[?hrY.=KFWa7U832[^R~ TfЎG PR-~E#v8f&*UWw0'.?#qdP%2'/_E-?r=wɓy]0{Nfun1*nr;̐/a͋h֪_-~8K,VѻB3 X ?m_ddM2Φh:s|V3oow爕$H^*ZD%8O"$r>_:M]-T)'H(Hf ۧ,X0uS]bD|,ͤ4jh3qohX"ft6Cr~_ "^خ|l׵D5 H"VMs3a;th:XC xU]?a QNC,p%S9W<89UqkKr|^Ӂa#^"аոFǻ7߹-.4ZZ'GOLHHHlAZ$H% 'ORI7,yiqu +*^ja#_g}Tߊ;fy&34~΂)DiW<3|K,ΰiCUJy{\x>*:}*ߗAiYc5qm>%,~<:M}>G t%鹍i==!Ğ_:՛ڴf#{}cg}>Ѓ<⳯ae)F:&)1Pu NB0e;D6$bI~&ckмQk Aɝ.~:~\VpT#BHVWx,;9ľ* Z3ĕywu*Li^+L^lʟq it~\fߟAC;@m۴VZh-IH TԪJ +WU)6=$BeXZiك&yRg?"mz=PwIc5;SPZRBouH~W5PxS\'ZA{Oz}qw#DM6Q8ES,TPj&YJzGS,̑J,O'H!3FH }Ƈ4DC(%{,#?EEكn!'bihˬ"jUn*;ѫ۠eu7COJ΄$gFe6z7"Eޡ \ɱpFFn疡F#2s^粀;̙>m,`4 I-^8:ϐ}=Ä1Ə5f[{̙3**U*e~eg_~ٲW#FW$e?@'FeoWd%]T.VVS–"n`]D6svQ$s[d&q:j`ͨ3kO-%Ş)ieI)*Eiizڠsr6JN w{w#gJłQVSxU*]icxNC)  d؋Ac+T[RUUkCKTP +ٮ)KTf蚅+] !;@ |QLDxFEFcQjTJZUsuƫGO8-EZk=h}~ 編aR'E9d>C9}>}/h/7]k{C!r\D` QASeXȲ,K,JW.qmlݽM@iMdH$G^rS_JZ ĥٜzbb_uY|~-AZB4*H)ώ褅ECZ(QgM% qǎ}T̩/ob.֋v |ogP\,1ז?Ȍ7JQǠ-IHͥ1vmv}-Jog#j$fuMi8z#Js- 79|O3!1 :?iiC\C7ZJ7\Eۿ@\kq?j#T7y@Gdig՞tfJ4q.{?1nٓU`sN]T#NUvϾsJą(S,s%C鰒GٯcmA$`3x`_pهM&q⬟&կf/sR|ǶhcfErQ́a]FcbDH䚑>^*.6juwE505:PTMijFq f}ܧlݡe R-EJRi)ݫܧn$dMjH>BR>C+gUj%3Z|9ygW;_o֟bug٠]͹IB*9PPQO7.ٕu{%6H'ȳhG&OtCy !3\׀Qn#A=`#r\.y&N3>̩9ZZ@mXO֏YdVf)3Ve2iVm6`~p9Z0tp@_m6RL'A6U/rܫ=?%YkoQaӿGbXΏ}6JA _CB' "<`yE иJ-bYY7:Y.sPRlW}u8N"$oX'K|r3e)eS,VSTJ${; bh&D!H13*g$tl-doPNjlps!xD:>%.jҎRJz;(GUo>1nĉ= 1=K +?R\$$~K!umIOW_%=[|VH;:I>B^&H $'&Ry޾!i%_Q&9OB|БSLQTA_솅E ]n =GM*!?տˏU%FCQ#go=<iMŠ'mXx_OV׺WJ3d I;<VOk9(#RJ=יK*;2<GcG&˂3Cssls  B+O[X\bbbߖ-m[`[p[Ut""j9qff4)Qw;{FVlw⿖.w7zϏ u̧ +"vfА%rriAgPZ(;N #0SͼSġF5گjtt|MN6/;y ./VvD{63*fqy"L%*Mai_I`~lR 1qBeD#m s f + $DHTx@ j}I_):j&BC>Lw$rёPGGBҗj*R$/5Ү!<\Wy+ +̆qF.VY1~1j!vC}VY.M7=/0^AĮ膻򞼓1q,ˋy13sjDHPܫy$k-Lǔ#Gj%[;{:Cp7+7PPm~VFh ɖm>͘ib+ͅmm-j^d{e7^gxI.fIC= 3zQ .΋Jy-J5VDZ]_4Ih~̢t>բ7.E4EaiTLȨlaCXj z$֐KBqQfH6Ac?`FԿeF[_zGDB ]*u c7+Å8o _*o(ѪHk]%9ሺq<x7e]!*IODn-C.`s0]ulP C3m3Tp'B |%I\ ܔ6$0!(poڢei;Ҫ..csP\~9lco,yPkǸzm}ͳC;P;0h@Ⱥ-n|cw7oO)˿MG>V`nB$lGdwPģ~I$rGS)slҊdlE +&Hp͞=*PCtb~uO[4;>P(_,AJY墬N"1q~V6$,5qɕr=q95BO=rca"0704''x.8Nj% 1rUĹJ@:QmY$i +ϟq+31)i"8"~Ƒ9;7J͚7?l0ؿ=yD+dr]$Da_g%;d[eN +-Ť`ɹr%3U bZqeڇona%ƪ9:!-[Tz4&8UtaL)L\.AƓ#).Nm#N[Ev{omV^u?x0=SW:+FM#|eƐjEo4T:7u9Ob͎?T=R0ԭ"J)Wч;y(Vd`$# {w̿..A?dߙ!r2lxnYMAr:*eY[n\Ϛ[7(Pti{mT{'V]~Iӽ񅙯ö/LJ|vuǪ~³/Tݤ,̈N&)b7)ыr}\΃hCQ.W=y pcKwMM S;q]0=-E~c,e#,̥i%ܦܦη,{CuTI>]֗ІBmF>~?=׼W.Qj?bXzꞧSH?shJڋdd_2r72dFZ6\B)doXHP$:Oá)h:8fWyqTWFt֓*vv[.@І!噋2e>i)ܽ4%ϕ=/8$VQgpi"C'^LLqᬟ=%i?aL{Iٝz>H"Re}h&R!.n#lV%꽜U?U{K|Oxhє%܅ V,XP +[,NK/fÆgAx[ Mk$%Ub88-z9rT134ʮӧ5Kheq'Bf ѳ1lߥd"ctcI_i֘/$;?sJ5 ͢`mRD6Ҹjty@Z8j6aune]MCq͕3>s٣%/kG{)gXO'3} 7qk]|s3V7^L\QW?X,r+:J"5]#Es~N0򁁶OS I -iRHgJև"v~Օd%] |^/A G'bRTW r0nmWGtGt~D_ݏ8rOVW^#h\m57ӍJdG4}㨁  >Fw.&N>km,Foi :8rI.̺jWK[OG_~pm>:6QʊH-i"k+WfrR1ʭ(>CGm[ӰEyA{ZbfC/h/ޤz} )3_FŠ7@1c1b +z]\N4jy>FXTM'dsWTEURꦢI_E$2,j5&V{.0;xi'?'Bt t;Aw:1xφ;`,їꏑe S^ _%pD?pJ??9ڠb*6 xhFBWh- Mld @eV`#Rux`kmZ^U^դ^QhQvJzJ;j|M>g+ߨk?ԮRSh[b::[Žu?{Y.vAIiw~\Qšܜ4/r38lvp 930c .êk#w5 L3 '8LeMb,5ST/;,Te=j:]ֱ͜FP8G pGܫz--yKE5Yޤ7޼:}bbcl%..VW;mMyt/VjUKow:q~ΰK = <]õS*7%]kżWr} !JN$ih c &mTѽq_A##pVjncYnP5EZ˚YZk:@g<kڗP͉xriޯw5 FT'IDIn9=)=;>\0buw$wbJpC37y-Ii*4օ7[nXN@n.yBMw~j tn58(r+UߒS +~EtߠiLmC2t~2W ~]V:u{|o{XRHHOgq )dIF}.yr5&˓#5 oq\Xnxs`W&cbxZuOiKq5˜T{I$D3N+q锯Fz]nЕud[ig&v_LJwa[HAݩ_|mȵ,E -I{2cgʖ,@pt 6~˱2He*67t& /FjmXְ_ܡMô_o0O\xe X~+{b1WԿϣ\Qj~'Wz5ؼi䦸 Ήsչ<@]K\@U\12yHzT]"p*.ɹKslن ݛkPK忐ׯAEiO\.^FZ/m.m-˄Q2Kt@޾[?Kd$z1?ʗ+KSp_Qamjz7Uc:.]9/]hn<Ǒx"?I͈[pd7"CϘDTL‘< )G +"oQih#%!7 :1> žoFt/\Gأ81HCԗ>Iw*OϚ1,?x +Y6xl,'rެd٤24dY6x&\2k,&˦e>s&e3ɚI3ȲY3ҙ,mrIWnD}7E3{H +iAZal yPsc9(Y,ߩDY +endstream +endobj +1059 0 obj +<< +/Length1 17264 +/Filter /FlateDecode +/Length 12304 +>> +stream +x|yxTŶo {s;ݙ:N!d" @0 a<*C &P"ǃA<!=9\q@#z= +݉N]VZހ0B;̔=/ ۻO~{ :dx.FAc8h_ CTnh:oB|qS,j "DR/1o,s ̘h!aCm1w&G ˚ ' >pu9'3Ȅ]0ur65pq'ZNE^~{E¹.X؝X~}v;yF $G .+2 +Ds  I( ME#9y~&1G;3uC&Ȃ$@Y *ftc4D/""7tzbC1hdgvU;lS'%4 J8oPA{W~ J1pn:PnBe]\E|UPVϢu(PPSAZyc(#.޻88&?eS~?H@xLj6:v\+!ԂjTs~ҳ~虧HP>UҦ2iFO-2zw=(62zcQ精1І[(:O +i}E/MFPw}`bD^F_cV*{2nJ:m/ﲊ/']Vחſ./%ӿ0&/Xa }^lctVo,V33*isJFz0}DW ^tpNi9(/e 2/}J1RF׬k]m*FO +-yrq^N]fK}]A\l1]3ǎ +ltOxG]tDqp:/etN:t:qNgtŌN2:Y)n:INdt8Dqұkc4NG1:ч#ćF3:чӡ FiB?>h ]_؏Ѿ[L Upqpw6}0*>hO'2V_OzLb/3UB˗g}&%3<ͫ>_Г@B[49 b5-\:f3l@] 8d073ij8MZvօN!b&>l'UB;qr+bxiGMh" ƛ74_4XYe,zӘd=ad7QFl#Yጆ1b =8 h#Y ͧEt$S}!vjmZsk>+dg6D3Ud ;J AG \=*p2 ʌJеĨh9$@NBq=.^'C K-鈟)%+m,Mx>]Ugғ8j lhd-os>78³KۺGcq/ Gy% \V8a2z¶ @S +迈2tm!Wk +M詖 VH@,6$p]lpyY %Kv9rۅid0:/C#8 'UTAf3bdGr%$m[#Op- +}NBm8F&sdk^-Fp?e@'@2-0L\P-lzZ kN2&Hs퍲a(ZH^>$ {n0KFj3MGEB0Y8(đK)Y~rwyK S&^]TU5M}J}UDD?lVݍLѦѦ3̵5(Emn=da+=ck Y=>ݾcB'|ەZu#lҢsE̴TZ*1j9ےR[RqQk#MMMbs#lZ@Z +[FQ:BAo% YCmtkg_N@xѴ (EH\NQ]yYo5F"#]b6 N pc9{>7ן-0 ɠVBx2=Zq4ycVͬإ5n11qSfbƈ&lVM/Ro;ZOu;'-b_]מbq`oY щn{Y\a-A$""&Ƙ@pnʩg?r y'kkܼfXs6'dVVf$9V||Bfh%+;3 :L/f.wO?5i껧)Cvxš[7L+?,~^X8ad:w<3u6}5)E`Eۺ:~fn= +GnrH_;;*16AuϚcޔlMYWdD̤:H5x.h5xbƮpL^pnո'\ +ՙ +al1/P1W -θ 䆸*i +Ņ m5Yggee8\OK6~h'SOkUA}&/5n)"BZϦUΌ)^wW +zc{+t\7cu_y/NfabA.71Z+]pҨ4%a\~%DjvdIȥ+. jqmθxŖM^juMU +W]-87_+c\M[7#9.˖مqZ5лdka.ܖo;_^._HNƔC>/Z ϫTiS *IV +3 z]Qi&s(N(pq3S(^f WHb[oۗ9x"JA)8!ELR%EP#y4O<9Oy!hBCD;HVFU:%NrS=La_0 ^UfXp7zg߭-km$zEzEItSgW|ecR@UYTU3B;DY0ѣ`]/`6L녑3PvV?y 6J^L^/>]Jƾpɟa͵'pK,ߐ{iW1cx]zQ_7ʡv貘]UqR㕎!7;@[@5rrHK7f MM7f|4c;Sv߿eֲ׌nF'|w8٥rSջ[,1PLgo,{70,`/QjGT/Wa܊ L#]5[@ħD%X(O&:=ߝu^:W_-TB0K(^AE')p,Fͭ\oi[$I2sDiGZ)&\*`~uPUTNMx%emֹmD¤heѦ꼕K6Wζп PMlV8Ɉ:bM0LH3/3Ⱦ/L*ۦuL59X_XǞf X)[ 4d>#ى;%G HѠ7Nt~βpЃ!z}! +T@QX 6pA#*'YzagD J¥kH8p&_n_68/q紴!~OCcz7x Gf>'ƭS ݽ(m>zŁƍ# Q>`o [E +ĤNj2"нN^5${oZRfQJ4 )Ɏ vO!s&,6@Fms3%R\Rb/qH ,LjYʬl'\ 4lT2gʕs攔?]5s^þ7E۲-ƶI{ܶmS۶o~.葷A&[jwd72Ѽz!/@]Pk(P$( +:/U(ثRy xM\AU$-ST=(ƀ2ʁj +2x/\EfT@ dIYe<GGf6C7Zڭ$-{@<YRuUJ{UܡbzdmhE-B)Am.G~Wvͬ?>կVmzdrϮ#Yυ)^i@X4Xqa/:lh}?MAm!A:Y;T.jwww.hGnkm/0GQ( G4*yrG (+$]ts5΃^ez5=ήFQ }vGypZOe*O\f֙A L)wqD$ qRE.i:.Sr\e@H%5MM\vR|+lR<JZ5Umv*-lg!#]?E{8簓 +jk(H)*Gwd/:H(ETgC%;ᖣS%i7@Y Jd0RqLg"eID7%$9^F i_<"y2.ON03 03 eM8Oz¶r $[Z_'-/77g i"Y4ؔr% k&r_,6cx΀V:)[eJ UP0`V$ )R%&|x*%*F}DE9:.wJG]ΡYJW,æRC<Ȁ>ָf5qVȯ4֧A]yH@=@@>ebd+JULFޜ'S|%w$rWy)&d$ X*(<ϔ :AoaWĔb [I3-:-W Ui\B,)ݖ҈j-O06:]Wzk_Z[oo\Ņ8} ^}p![JZ\KX έb͎$ WYREUtcW+r2H-Ur. ߕ?}=„ݹi1ի7ٺg_W j4YV`F.0j3P|FZҨ !GKLR]9)-R!+~rXWnM: _C1^Iw(LD}]0PUR^AT!^DkN*HUk]uRƛΚc fsm&;SL: +qZڅM~<Xӧ-v[?qC3m]l&^ubn>LF^{juAdh &VtDV|Uuˮ*+~,Ty+ՉnU!S]ΉMM䱩 +Y.MusGQe$22紝9c1q'T_Y~6^ |{GΌs}F󿒓?.ncRj=q'̣"}&)`_&wdZSE,%#k6zhy>ڐuUj ^6i,}ouooBLI,i|&9fQOz̆9g>اA Ƈu6n.yݻuE u< [DG">@BGRT9iM ⎎r3L<,p 8[+&m~A OUGU +fT5!CDE2`/2 *WP <4 |QJ?K5 s/pq%MhgbT!cDSO^1QIyLҍf +J7]}aǐ":J)ÔQ"x ea }\X{\i 4ҸTtٽisV}ה Ҡ!w|t^CJ֫%@g|=܏N҃ ݥ]> a_BOlhW(]bNx}ID|Boz͊YpqRg駑E* HO—>eϲup|Uu9urh4~^p^|fPQ2rE7ʕu FK K1|<#Zg +3 uқ) kI#Κ3xO?"^wXE Km Ki2F&m#:GF=$_7jAP`d'l&%觟$_THYJw&7P=Iy/pv +7t( +fx%{k6M8:vᢲ=cH# - +>S_߹wme浫W^%ֲ~(;gb.|~ m\@O_ʼnT-uYAp9f$DF:Q2v&Vm\r>m >pNW'd~h + +=[15M:` ~0;"AGme!rwhju'{ ! I18w+W c;N~M=]S̠cJWnX7w Rsk;mws+SIΙ?>s 좟##:wڹOY>aen#lDAEhsLa^nm0lOB +|j0EC?9R4fYYV_{^!uI]Ն7Z*[_42~7CF!C H@$DTuşxyL8x>.za?yb#1B%"+ZM1M1 ^76UV,Doq|ӯ*n?}׫\-~ͲuSst=N Ich[0ˠÒ1[ •  pcaQP]J&"f)d:YL*JX&.%&rwqF g1 +sh?HPs\^*RRT}^h3ϕ.%B0yJ}EhUV^QYU5j{yNER vg ;a/{ Fs]j}aѲZW?-GaҤܼ +Wv:7U/VYY8-s!P#ܛ=]=sqĻ?x 3˟y|3Ϭ޼I/]Ϛ?}4N؍;F +#`\3|~TcQj.z۹ b{0rWͷWJxt})I>þxpj ul-^7{[#cv 9:w~hqwk̜:$7xq8]rW`\&QY1NU:JiE-sxg%N6a3r!Uiʦ]MdRħ„V}K_[w0Cі"h,|^ydn/{ɒ;wO.8'LB~=g &! Cd(bQ(D}dm6yE +UA$^BҸ#.8<vM[nh1`ܦSyfZY:Ir3pλ(9qD[=w] hH8H]6ģxܑċrɐC)GPr }B]aRmNf,qnqT|RQ}Y #<&FjI{bO&ę2.VK?+Tȭ-y.x;ױ[^߿omnא[II+~Ad  S'oiUNWA:'H6_,(0$X#qJ1S2dMn@;tBXIJP:t B G5h]N#vU(ZLt$qЍ=_d0Y0eZ*.:`h/3K^]c<t; ykЩb0!Ďbzf 䋂[~gBY?.;zz+s{\?|` lccVtqSŨ >!,b_+F"Ll,4HQ/߸h{/HQ~߳}ވPY;̂CQX]{'⤹72,a_Є;l +v q?=Ou柏I p.^?r̂cGs|gC_o*6]ъǪ~Y[AAݼQ u|ӻ wEB_`%D B=fh&z NDS!fAPʀ#=EPEd@l!wZ/44EZk3þTQo͆FpTw22C3e>=SYp_ <Ɲ]Z/Ap|(P9pZTd{o{YNw>Ac ?.qrvvB +#bhBp @E.{"a@$gT7½ q;~sv=~򣓧ԩKRg<:mJ;yA ?6ާW +endstream +endobj +1060 0 obj +<< +/Type /FontDescriptor +/FontName /SXAKMW+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 557 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 1056 0 R +>> +endobj +1061 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /SXAKMW+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 42 [ 774 ] 44 [ 294 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] +/FontDescriptor 1060 0 R +>> +endobj +1062 0 obj +<< +/Length 744 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +30 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<0052> <006f> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1063 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /SXAKMW+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1061 0 R ] +/ToUnicode 1062 0 R +>> +endobj +1064 0 obj +<< +/Type /FontDescriptor +/FontName /YFABGK+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -132 753 704 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 704 +/StemV 80 +/StemH 80 +/FontFile2 1057 0 R +>> +endobj +1065 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /YFABGK+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] +/FontDescriptor 1064 0 R +>> +endobj +1066 0 obj +<< +/Length 1430 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +79 beginbfchar +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0003> <0020> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0048> <0065> +<0051> <006e> +<0046> <0063> +<004b> <0068> +<0050> <006d> +<0044> <0061> +<0055> <0072> +<004e> <006b> +<0010> <002d> +<004f> <006c> +<0049> <0066> +<0024> <0041> +<0056> <0073> +<0057> <0074> +<002a> <0047> +<0058> <0075> +<004c> <0069> +<0047> <0064> +<0035> <0052> +<0015> <0032> +<0016> <0033> +<002e> <004b> +<0045> <0062> +<005a> <0077> +<001b> <0038> +<0052> <006f> +<0030> <004d> +<0031> <004e> +<004a> <0067> +<0029> <0046> +<0017> <0034> +<0033> <0050> +<001a> <0037> +<0018> <0035> +<0013> <0030> +<0028> <0045> +<005d> <007a> +<002f> <004c> +<003a> <0057> +<005c> <0079> +<001c> <0039> +<005b> <0078> +<0027> <0044> +<0032> <004f> +<0037> <0054> +<0053> <0070> +<000f> <002c> +<001d> <003a> +<002b> <0048> +<0039> <0056> +<003c> <0059> +<000b> <0028> +<000c> <0029> +<004d> <006a> +<0054> <0071> +<000a> <0027> +<005f> <007c> +<0012> <002f> +<000d> <002a> +<0020> <003d> +<0042> <005f> +<0043> <0060> +<0005> <0022> +<003e> <005b> +<0040> <005d> +<00cc> <2019> +<0007> <0024> +<0038> <0055> +<003d> <005a> +<0034> <0051> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1067 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /YFABGK+Poppins +/Encoding /Identity-H +/DescendantFonts [ 1065 0 R ] +/ToUnicode 1066 0 R +>> +endobj +1068 0 obj +<< +/Type /FontDescriptor +/FontName /PPVKZX+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ -9 -92 733 729 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 729 +/StemV 80 +/StemH 80 +/FontFile2 1058 0 R +>> +endobj +1069 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /PPVKZX+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] +/FontDescriptor 1068 0 R +>> +endobj +1070 0 obj +<< +/Length 1182 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +61 beginbfchar +<0014> <0031> +<0016> <0033> +<0017> <0034> +<0018> <0035> +<0011> <002e> +<0003> <0020> +<0028> <0045> +<0051> <006e> +<0056> <0073> +<0058> <0075> +<0055> <0072> +<0048> <0065> +<0057> <0074> +<004b> <0068> +<0044> <0061> +<0024> <0041> +<0033> <0050> +<002c> <0049> +<0059> <0076> +<0053> <0070> +<0052> <006f> +<0047> <0064> +<0046> <0063> +<004c> <0069> +<13ae> <00660069> +<004f> <006c> +<0050> <006d> +<0019> <0036> +<000b> <0028> +<000c> <0029> +<0015> <0032> +<005a> <0077> +<001d> <003a> +<004a> <0067> +<001a> <0037> +<001b> <0038> +<001c> <0039> +<0026> <0043> +<0031> <004e> +<004e> <006b> +<0049> <0066> +<0030> <004d> +<0013> <0030> +<005c> <0079> +<0010> <002d> +<002e> <004b> +<0045> <0062> +<005d> <007a> +<0035> <0052> +<0025> <0042> +<002f> <004c> +<0036> <0053> +<005b> <0078> +<0027> <0044> +<0054> <0071> +<0039> <0056> +<0037> <0054> +<0042> <005f> +<003a> <0057> +<0012> <002f> +<003c> <0059> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1071 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /PPVKZX+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 1069 0 R ] +/ToUnicode 1070 0 R +>> +endobj +1072 0 obj +<< +/Type /FontDescriptor +/FontName /MWAATU+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -155 598 728 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 728 +/StemV 80 +/StemH 80 +/FontFile2 1059 0 R +>> +endobj +1073 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /MWAATU+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] +/FontDescriptor 1072 0 R +>> +endobj +1074 0 obj +<< +/Length 1570 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +89 beginbfchar +<0031> <004e> +<0052> <006f> +<0057> <0074> +<0024> <0041> +<0053> <0070> +<004f> <006c> +<004c> <0069> +<0046> <0063> +<0044> <0061> +<0045> <0062> +<0048> <0065> +<0058> <0075> +<0050> <006d> +<0047> <0064> +<0056> <0073> +<0055> <0072> +<0003> <0020> +<0010> <002d> +<0051> <006e> +<0020> <003d> +<0008> <0025> +<001f> <003c> +<004b> <0068> +<0012> <002f> +<0049> <0066> +<0021> <003e> +<0038> <0055> +<001d> <003a> +<002a> <0047> +<0059> <0076> +<000a> <0027> +<001a> <0037> +<0013> <0030> +<0054> <0071> +<004e> <006b> +<0042> <005f> +<005a> <0077> +<0011> <002e> +<0006> <0023> +<0004> <0021> +<0037> <0054> +<004a> <0067> +<005c> <0079> +<0007> <0024> +<0014> <0031> +<002c> <0049> +<0033> <0050> +<0027> <0044> +<0035> <0052> +<003e> <005b> +<0005> <0022> +<005e> <007b> +<0060> <007d> +<0040> <005d> +<001e> <003b> +<005b> <0078> +<000b> <0028> +<000c> <0029> +<002f> <004c> +<000d> <002a> +<005f> <007c> +<0015> <0032> +<0009> <0026> +<0019> <0036> +<0017> <0034> +<002b> <0048> +<0036> <0053> +<0028> <0045> +<0030> <004d> +<0032> <004f> +<0029> <0046> +<003f> <005c> +<0022> <003f> +<005d> <007a> +<0016> <0033> +<003b> <0058> +<000f> <002c> +<0025> <0042> +<0026> <0043> +<001c> <0039> +<003a> <0057> +<001b> <0038> +<0018> <0035> +<003c> <0059> +<004d> <006a> +<0039> <0056> +<0034> <0051> +<0023> <0040> +<002e> <004b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +1075 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /MWAATU+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 1073 0 R ] +/ToUnicode 1074 0 R +>> +endobj +1076 0 obj +<< +/SXAKMW 1063 0 R +/YFABGK 1067 0 R +/PPVKZX 1071 0 R +/MWAATU 1075 0 R +>> +endobj +xref +0 1077 +0000000000 65535 f +0000000015 00000 n +0000001112 00000 n +0000001246 00000 n +0000040647 00000 n +0000040781 00000 n +0000043473 00000 n +0000043672 00000 n +0000047406 00000 n +0000047812 00000 n +0000048013 00000 n +0000048216 00000 n +0000048351 00000 n +0000048487 00000 n +0000048645 00000 n +0000048804 00000 n +0000049037 00000 n +0000049271 00000 n +0000049486 00000 n +0000049702 00000 n +0000049943 00000 n +0000050185 00000 n +0000050408 00000 n +0000050632 00000 n +0000050864 00000 n +0000051097 00000 n +0000051311 00000 n +0000051526 00000 n +0000051753 00000 n +0000051981 00000 n +0000052190 00000 n +0000052400 00000 n +0000052629 00000 n +0000052859 00000 n +0000053070 00000 n +0000053282 00000 n +0000053501 00000 n +0000053720 00000 n +0000057475 00000 n +0000057940 00000 n +0000058141 00000 n +0000058343 00000 n +0000058558 00000 n +0000058774 00000 n +0000058971 00000 n +0000059169 00000 n +0000059388 00000 n +0000059608 00000 n +0000059809 00000 n +0000060011 00000 n +0000060239 00000 n +0000060468 00000 n +0000060678 00000 n +0000060889 00000 n +0000061104 00000 n +0000061320 00000 n +0000061551 00000 n +0000061783 00000 n +0000061986 00000 n +0000062190 00000 n +0000062327 00000 n +0000062465 00000 n +0000062659 00000 n +0000062854 00000 n +0000063044 00000 n +0000063235 00000 n +0000063426 00000 n +0000063618 00000 n +0000063810 00000 n +0000064003 00000 n +0000064242 00000 n +0000064482 00000 n +0000064697 00000 n +0000064913 00000 n +0000065120 00000 n +0000065327 00000 n +0000068893 00000 n +0000069371 00000 n +0000069567 00000 n +0000069764 00000 n +0000069960 00000 n +0000070157 00000 n +0000070356 00000 n +0000070556 00000 n +0000070756 00000 n +0000070957 00000 n +0000071155 00000 n +0000071354 00000 n +0000071588 00000 n +0000071823 00000 n +0000072022 00000 n +0000072222 00000 n +0000072425 00000 n +0000072629 00000 n +0000072831 00000 n +0000073034 00000 n +0000073234 00000 n +0000073435 00000 n +0000073631 00000 n +0000073828 00000 n +0000074017 00000 n +0000074208 00000 n +0000074400 00000 n +0000074593 00000 n +0000074783 00000 n +0000074974 00000 n +0000075160 00000 n +0000075347 00000 n +0000075559 00000 n +0000075772 00000 n +0000075987 00000 n +0000076203 00000 n +0000076416 00000 n +0000076629 00000 n +0000080328 00000 n +0000080831 00000 n +0000081033 00000 n +0000081236 00000 n +0000081438 00000 n +0000081641 00000 n +0000081852 00000 n +0000082064 00000 n +0000082285 00000 n +0000082507 00000 n +0000082736 00000 n +0000082966 00000 n +0000083167 00000 n +0000083369 00000 n +0000083567 00000 n +0000083766 00000 n +0000083979 00000 n +0000084193 00000 n +0000084392 00000 n +0000084592 00000 n +0000084803 00000 n +0000085015 00000 n +0000085161 00000 n +0000085308 00000 n +0000085522 00000 n +0000085737 00000 n +0000085929 00000 n +0000086122 00000 n +0000086333 00000 n +0000086545 00000 n +0000086764 00000 n +0000086984 00000 n +0000087183 00000 n +0000087383 00000 n +0000087591 00000 n +0000087800 00000 n +0000087996 00000 n +0000088192 00000 n +0000092056 00000 n +0000092527 00000 n +0000092664 00000 n +0000092802 00000 n +0000092994 00000 n +0000093187 00000 n +0000093386 00000 n +0000093586 00000 n +0000093743 00000 n +0000093901 00000 n +0000094114 00000 n +0000094328 00000 n +0000094524 00000 n +0000094721 00000 n +0000094913 00000 n +0000095106 00000 n +0000095329 00000 n +0000095553 00000 n +0000095754 00000 n +0000095956 00000 n +0000096153 00000 n +0000096351 00000 n +0000096548 00000 n +0000096746 00000 n +0000096906 00000 n +0000097067 00000 n +0000097264 00000 n +0000097462 00000 n +0000097597 00000 n +0000097733 00000 n +0000097916 00000 n +0000098100 00000 n +0000098292 00000 n +0000098485 00000 n +0000102326 00000 n +0000102813 00000 n +0000102972 00000 n +0000103132 00000 n +0000103353 00000 n +0000103575 00000 n +0000103778 00000 n +0000103982 00000 n +0000104205 00000 n +0000104429 00000 n +0000104633 00000 n +0000104838 00000 n +0000105069 00000 n +0000105301 00000 n +0000105514 00000 n +0000105728 00000 n +0000105957 00000 n +0000106187 00000 n +0000106405 00000 n +0000106624 00000 n +0000106860 00000 n +0000107097 00000 n +0000107315 00000 n +0000107534 00000 n +0000107669 00000 n +0000107805 00000 n +0000107998 00000 n +0000108192 00000 n +0000108403 00000 n +0000108615 00000 n +0000108818 00000 n +0000109022 00000 n +0000109213 00000 n +0000109405 00000 n +0000109619 00000 n +0000109833 00000 n +0000113909 00000 n +0000114396 00000 n +0000114599 00000 n +0000114803 00000 n +0000115008 00000 n +0000115214 00000 n +0000115404 00000 n +0000115595 00000 n +0000115832 00000 n +0000116070 00000 n +0000116301 00000 n +0000116533 00000 n +0000116737 00000 n +0000116942 00000 n +0000117150 00000 n +0000117359 00000 n +0000117567 00000 n +0000117776 00000 n +0000117929 00000 n +0000118083 00000 n +0000118280 00000 n +0000118478 00000 n +0000118639 00000 n +0000118801 00000 n +0000118983 00000 n +0000119166 00000 n +0000119331 00000 n +0000119497 00000 n +0000119694 00000 n +0000119892 00000 n +0000120094 00000 n +0000120297 00000 n +0000120446 00000 n +0000120596 00000 n +0000120778 00000 n +0000120961 00000 n +0000124800 00000 n +0000125271 00000 n +0000125492 00000 n +0000125714 00000 n +0000125928 00000 n +0000126143 00000 n +0000126361 00000 n +0000126580 00000 n +0000126784 00000 n +0000126989 00000 n +0000127165 00000 n +0000127342 00000 n +0000127541 00000 n +0000127741 00000 n +0000127936 00000 n +0000128132 00000 n +0000128330 00000 n +0000128529 00000 n +0000128681 00000 n +0000128834 00000 n +0000129021 00000 n +0000129209 00000 n +0000129403 00000 n +0000129598 00000 n +0000129744 00000 n +0000129891 00000 n +0000130093 00000 n +0000130296 00000 n +0000130463 00000 n +0000130631 00000 n +0000130787 00000 n +0000130944 00000 n +0000131151 00000 n +0000131359 00000 n +0000133666 00000 n +0000133961 00000 n +0000134105 00000 n +0000134250 00000 n +0000134452 00000 n +0000134655 00000 n +0000134869 00000 n +0000135084 00000 n +0000135269 00000 n +0000135455 00000 n +0000135633 00000 n +0000135812 00000 n +0000140610 00000 n +0000140849 00000 n +0000141105 00000 n +0000141312 00000 n +0000141518 00000 n +0000145091 00000 n +0000145322 00000 n +0000145519 00000 n +0000145708 00000 n +0000149393 00000 n +0000149596 00000 n +0000153335 00000 n +0000153558 00000 n +0000153692 00000 n +0000157714 00000 n +0000157953 00000 n +0000158087 00000 n +0000158221 00000 n +0000158355 00000 n +0000161968 00000 n +0000162171 00000 n +0000166877 00000 n +0000167268 00000 n +0000167402 00000 n +0000167534 00000 n +0000167666 00000 n +0000167798 00000 n +0000167930 00000 n +0000168062 00000 n +0000168194 00000 n +0000168326 00000 n +0000168458 00000 n +0000168591 00000 n +0000168724 00000 n +0000168857 00000 n +0000168990 00000 n +0000169123 00000 n +0000169256 00000 n +0000169389 00000 n +0000169522 00000 n +0000169655 00000 n +0000169788 00000 n +0000169921 00000 n +0000170053 00000 n +0000170184 00000 n +0000175185 00000 n +0000175584 00000 n +0000175717 00000 n +0000175850 00000 n +0000175983 00000 n +0000176116 00000 n +0000176249 00000 n +0000176382 00000 n +0000176515 00000 n +0000176648 00000 n +0000176781 00000 n +0000176914 00000 n +0000177047 00000 n +0000177180 00000 n +0000177313 00000 n +0000177446 00000 n +0000177579 00000 n +0000177712 00000 n +0000177845 00000 n +0000177978 00000 n +0000178111 00000 n +0000178244 00000 n +0000178377 00000 n +0000178510 00000 n +0000178645 00000 n +0000183449 00000 n +0000183912 00000 n +0000184047 00000 n +0000184180 00000 n +0000184313 00000 n +0000184446 00000 n +0000184579 00000 n +0000184712 00000 n +0000184845 00000 n +0000184978 00000 n +0000185111 00000 n +0000185245 00000 n +0000185379 00000 n +0000185513 00000 n +0000185647 00000 n +0000185781 00000 n +0000185915 00000 n +0000186049 00000 n +0000186183 00000 n +0000186317 00000 n +0000186451 00000 n +0000186585 00000 n +0000186719 00000 n +0000186853 00000 n +0000186987 00000 n +0000187121 00000 n +0000187255 00000 n +0000187389 00000 n +0000187523 00000 n +0000187657 00000 n +0000187791 00000 n +0000187925 00000 n +0000188058 00000 n +0000193055 00000 n +0000193518 00000 n +0000193652 00000 n +0000193786 00000 n +0000193920 00000 n +0000194054 00000 n +0000194188 00000 n +0000194322 00000 n +0000194456 00000 n +0000194590 00000 n +0000194724 00000 n +0000194858 00000 n +0000194992 00000 n +0000195126 00000 n +0000195260 00000 n +0000195394 00000 n +0000195528 00000 n +0000195662 00000 n +0000195796 00000 n +0000195930 00000 n +0000196064 00000 n +0000196198 00000 n +0000196332 00000 n +0000196466 00000 n +0000196600 00000 n +0000196734 00000 n +0000196868 00000 n +0000197002 00000 n +0000197136 00000 n +0000197270 00000 n +0000197404 00000 n +0000197538 00000 n +0000197673 00000 n +0000202259 00000 n +0000202650 00000 n +0000202785 00000 n +0000202918 00000 n +0000203051 00000 n +0000203184 00000 n +0000203317 00000 n +0000203450 00000 n +0000203583 00000 n +0000203716 00000 n +0000203849 00000 n +0000203983 00000 n +0000204117 00000 n +0000204251 00000 n +0000204385 00000 n +0000204519 00000 n +0000204653 00000 n +0000204787 00000 n +0000204921 00000 n +0000205055 00000 n +0000205189 00000 n +0000205323 00000 n +0000205457 00000 n +0000205590 00000 n +0000210570 00000 n +0000211081 00000 n +0000211215 00000 n +0000211349 00000 n +0000211483 00000 n +0000211617 00000 n +0000211751 00000 n +0000211885 00000 n +0000212019 00000 n +0000212153 00000 n +0000212287 00000 n +0000212421 00000 n +0000212555 00000 n +0000212689 00000 n +0000212823 00000 n +0000212957 00000 n +0000213091 00000 n +0000213225 00000 n +0000213359 00000 n +0000213493 00000 n +0000213627 00000 n +0000213761 00000 n +0000213895 00000 n +0000214029 00000 n +0000214163 00000 n +0000214297 00000 n +0000214431 00000 n +0000214565 00000 n +0000214699 00000 n +0000214833 00000 n +0000214967 00000 n +0000215101 00000 n +0000215235 00000 n +0000215369 00000 n +0000215503 00000 n +0000215637 00000 n +0000215771 00000 n +0000215904 00000 n +0000216036 00000 n +0000219278 00000 n +0000219517 00000 n +0000219651 00000 n +0000219785 00000 n +0000219920 00000 n +0000224952 00000 n +0000225175 00000 n +0000225310 00000 n +0000230303 00000 n +0000230526 00000 n +0000230661 00000 n +0000235447 00000 n +0000235650 00000 n +0000240649 00000 n +0000240872 00000 n +0000241007 00000 n +0000245852 00000 n +0000246055 00000 n +0000250970 00000 n +0000251193 00000 n +0000251328 00000 n +0000256189 00000 n +0000256412 00000 n +0000256547 00000 n +0000261310 00000 n +0000261513 00000 n +0000266505 00000 n +0000266728 00000 n +0000266863 00000 n +0000271838 00000 n +0000272041 00000 n +0000276936 00000 n +0000277159 00000 n +0000277294 00000 n +0000282231 00000 n +0000282454 00000 n +0000282589 00000 n +0000287403 00000 n +0000287606 00000 n +0000292603 00000 n +0000292826 00000 n +0000292961 00000 n +0000297965 00000 n +0000298188 00000 n +0000298323 00000 n +0000303231 00000 n +0000303434 00000 n +0000308403 00000 n +0000308626 00000 n +0000308761 00000 n +0000313532 00000 n +0000313735 00000 n +0000318047 00000 n +0000318278 00000 n +0000318413 00000 n +0000318548 00000 n +0000323431 00000 n +0000323654 00000 n +0000323789 00000 n +0000328814 00000 n +0000329037 00000 n +0000329172 00000 n +0000334040 00000 n +0000334243 00000 n +0000339339 00000 n +0000339562 00000 n +0000339697 00000 n +0000344581 00000 n +0000344784 00000 n +0000349796 00000 n +0000350019 00000 n +0000350154 00000 n +0000355070 00000 n +0000355293 00000 n +0000355428 00000 n +0000360228 00000 n +0000360431 00000 n +0000365468 00000 n +0000365691 00000 n +0000365826 00000 n +0000370748 00000 n +0000370971 00000 n +0000371106 00000 n +0000375917 00000 n +0000376120 00000 n +0000381088 00000 n +0000381311 00000 n +0000381446 00000 n +0000386387 00000 n +0000386590 00000 n +0000391465 00000 n +0000391688 00000 n +0000391823 00000 n +0000396759 00000 n +0000396982 00000 n +0000397117 00000 n +0000401918 00000 n +0000402121 00000 n +0000407114 00000 n +0000407337 00000 n +0000407472 00000 n +0000412461 00000 n +0000412684 00000 n +0000412819 00000 n +0000417598 00000 n +0000417801 00000 n +0000422784 00000 n +0000423007 00000 n +0000423142 00000 n +0000427990 00000 n +0000428193 00000 n +0000433212 00000 n +0000433435 00000 n +0000433570 00000 n +0000438436 00000 n +0000438659 00000 n +0000438794 00000 n +0000443530 00000 n +0000443733 00000 n +0000448788 00000 n +0000449011 00000 n +0000449147 00000 n +0000454091 00000 n +0000454294 00000 n +0000459120 00000 n +0000459343 00000 n +0000459479 00000 n +0000464495 00000 n +0000464718 00000 n +0000464854 00000 n +0000469631 00000 n +0000469834 00000 n +0000474808 00000 n +0000475031 00000 n +0000475167 00000 n +0000480155 00000 n +0000480378 00000 n +0000480513 00000 n +0000485271 00000 n +0000485474 00000 n +0000490551 00000 n +0000490886 00000 n +0000491022 00000 n +0000491156 00000 n +0000491290 00000 n +0000491424 00000 n +0000491558 00000 n +0000491692 00000 n +0000491826 00000 n +0000491960 00000 n +0000492094 00000 n +0000492229 00000 n +0000492364 00000 n +0000492499 00000 n +0000492634 00000 n +0000492768 00000 n +0000492901 00000 n +0000497397 00000 n +0000497708 00000 n +0000497843 00000 n +0000497978 00000 n +0000498113 00000 n +0000498248 00000 n +0000498383 00000 n +0000498518 00000 n +0000498653 00000 n +0000498788 00000 n +0000498923 00000 n +0000499058 00000 n +0000499194 00000 n +0000499330 00000 n +0000504338 00000 n +0000504561 00000 n +0000504697 00000 n +0000509536 00000 n +0000509759 00000 n +0000509895 00000 n +0000514751 00000 n +0000514974 00000 n +0000515110 00000 n +0000519926 00000 n +0000520149 00000 n +0000520285 00000 n +0000525136 00000 n +0000525359 00000 n +0000525495 00000 n +0000530166 00000 n +0000530389 00000 n +0000530525 00000 n +0000534114 00000 n +0000534317 00000 n +0000538901 00000 n +0000539132 00000 n +0000539268 00000 n +0000539403 00000 n +0000542898 00000 n +0000543101 00000 n +0000547952 00000 n +0000548175 00000 n +0000548311 00000 n +0000553075 00000 n +0000553278 00000 n +0000558388 00000 n +0000558611 00000 n +0000558747 00000 n +0000563492 00000 n +0000563695 00000 n +0000568822 00000 n +0000569045 00000 n +0000569180 00000 n +0000573906 00000 n +0000574109 00000 n +0000579103 00000 n +0000579306 00000 n +0000584107 00000 n +0000584330 00000 n +0000584466 00000 n +0000589217 00000 n +0000589420 00000 n +0000594467 00000 n +0000594690 00000 n +0000594826 00000 n +0000599592 00000 n +0000599795 00000 n +0000604796 00000 n +0000605019 00000 n +0000605155 00000 n +0000609920 00000 n +0000610123 00000 n +0000614957 00000 n +0000615160 00000 n +0000619972 00000 n +0000620195 00000 n +0000620331 00000 n +0000625074 00000 n +0000625277 00000 n +0000628895 00000 n +0000629098 00000 n +0000632371 00000 n +0000632574 00000 n +0000637611 00000 n +0000637834 00000 n +0000637970 00000 n +0000642503 00000 n +0000642706 00000 n +0000646992 00000 n +0000647215 00000 n +0000647351 00000 n +0000651417 00000 n +0000651648 00000 n +0000651784 00000 n +0000651920 00000 n +0000656866 00000 n +0000657137 00000 n +0000657273 00000 n +0000657409 00000 n +0000657543 00000 n +0000657677 00000 n +0000657811 00000 n +0000657945 00000 n +0000658081 00000 n +0000662852 00000 n +0000663115 00000 n +0000663251 00000 n +0000663385 00000 n +0000663519 00000 n +0000663653 00000 n +0000663787 00000 n +0000663923 00000 n +0000666684 00000 n +0000666887 00000 n +0000671193 00000 n +0000671432 00000 n +0000671568 00000 n +0000671704 00000 n +0000671839 00000 n +0000675857 00000 n +0000676096 00000 n +0000676232 00000 n +0000676368 00000 n +0000676504 00000 n +0000681153 00000 n +0000681400 00000 n +0000681536 00000 n +0000681672 00000 n +0000681808 00000 n +0000681944 00000 n +0000686819 00000 n +0000687050 00000 n +0000687186 00000 n +0000687322 00000 n +0000691466 00000 n +0000691697 00000 n +0000691833 00000 n +0000691969 00000 n +0000696136 00000 n +0000696383 00000 n +0000696519 00000 n +0000696655 00000 n +0000696791 00000 n +0000696927 00000 n +0000701916 00000 n +0000702147 00000 n +0000702283 00000 n +0000702419 00000 n +0000706998 00000 n +0000707229 00000 n +0000707365 00000 n +0000707501 00000 n +0000710438 00000 n +0000710661 00000 n +0000710797 00000 n +0000714870 00000 n +0000715073 00000 n +0000720577 00000 n +0000720976 00000 n +0000721112 00000 n +0000721246 00000 n +0000721380 00000 n +0000721514 00000 n +0000721648 00000 n +0000721782 00000 n +0000721916 00000 n +0000722050 00000 n +0000722184 00000 n +0000722319 00000 n +0000722454 00000 n +0000722589 00000 n +0000722724 00000 n +0000722859 00000 n +0000722994 00000 n +0000723129 00000 n +0000723264 00000 n +0000723399 00000 n +0000723534 00000 n +0000723669 00000 n +0000723804 00000 n +0000723939 00000 n +0000724073 00000 n +0000727769 00000 n +0000728056 00000 n +0000728191 00000 n +0000728326 00000 n +0000728461 00000 n +0000728596 00000 n +0000728731 00000 n +0000728866 00000 n +0000729001 00000 n +0000729136 00000 n +0000729272 00000 n +0000733691 00000 n +0000733914 00000 n +0000734050 00000 n +0000738503 00000 n +0000738734 00000 n +0000738870 00000 n +0000739006 00000 n +0000743465 00000 n +0000743688 00000 n +0000743824 00000 n +0000748783 00000 n +0000749118 00000 n +0000749254 00000 n +0000749388 00000 n +0000749522 00000 n +0000749656 00000 n +0000749790 00000 n +0000749924 00000 n +0000750058 00000 n +0000750192 00000 n +0000750326 00000 n +0000750461 00000 n +0000750596 00000 n +0000750731 00000 n +0000750866 00000 n +0000751000 00000 n +0000751133 00000 n +0000754374 00000 n +0000754629 00000 n +0000754764 00000 n +0000754899 00000 n +0000755034 00000 n +0000755169 00000 n +0000755305 00000 n +0000758716 00000 n +0000758919 00000 n +0000762176 00000 n +0000762379 00000 n +0000766780 00000 n +0000766983 00000 n +0000771375 00000 n +0000771742 00000 n +0000771878 00000 n +0000772012 00000 n +0000772146 00000 n +0000772280 00000 n +0000772414 00000 n +0000772548 00000 n +0000772682 00000 n +0000772816 00000 n +0000772950 00000 n +0000773085 00000 n +0000773220 00000 n +0000773355 00000 n +0000773490 00000 n +0000773625 00000 n +0000773760 00000 n +0000773895 00000 n +0000774030 00000 n +0000774165 00000 n +0000774301 00000 n +0000774493 00000 n +0000774715 00000 n +0000774841 00000 n +0000774987 00000 n +0000775127 00000 n +0000775324 00000 n +0000775558 00000 n +0000775789 00000 n +0000776045 00000 n +0000776284 00000 n +0000776531 00000 n +0000776761 00000 n +0000777003 00000 n +0000777228 00000 n +0000777472 00000 n +0000777700 00000 n +0000777935 00000 n +0000778153 00000 n +0000778384 00000 n +0000778598 00000 n +0000778833 00000 n +0000779051 00000 n +0000779295 00000 n +0000779522 00000 n +0000779754 00000 n +0000780001 00000 n +0000780206 00000 n +0000780382 00000 n +0000780577 00000 n +0000780782 00000 n +0000780988 00000 n +0000781195 00000 n +0000781449 00000 n +0000781679 00000 n +0000781902 00000 n +0000782113 00000 n +0000782324 00000 n +0000782539 00000 n +0000782755 00000 n +0000782969 00000 n +0000783219 00000 n +0000783434 00000 n +0000783653 00000 n +0000783871 00000 n +0000784087 00000 n +0000784299 00000 n +0000784504 00000 n +0000784711 00000 n +0000784916 00000 n +0000785117 00000 n +0000785344 00000 n +0000785574 00000 n +0000785803 00000 n +0000786020 00000 n +0000786237 00000 n +0000786463 00000 n +0000786699 00000 n +0000786943 00000 n +0000787159 00000 n +0000787372 00000 n +0000787600 00000 n +0000787814 00000 n +0000788026 00000 n +0000788209 00000 n +0000788423 00000 n +0000788627 00000 n +0000788852 00000 n +0000789085 00000 n +0000789298 00000 n +0000789520 00000 n +0000789717 00000 n +0000789891 00000 n +0000790081 00000 n +0000790278 00000 n +0000790470 00000 n +0000790681 00000 n +0000790889 00000 n +0000791093 00000 n +0000791328 00000 n +0000791541 00000 n +0000791750 00000 n +0000791945 00000 n +0000792142 00000 n +0000792325 00000 n +0000792498 00000 n +0000792681 00000 n +0000792873 00000 n +0000793074 00000 n +0000793298 00000 n +0000793520 00000 n +0000793761 00000 n +0000793984 00000 n +0000794233 00000 n +0000794465 00000 n +0000794712 00000 n +0000794949 00000 n +0000795203 00000 n +0000795426 00000 n +0000795604 00000 n +0000795800 00000 n +0000796027 00000 n +0000796246 00000 n +0000796455 00000 n +0000796687 00000 n +0000796908 00000 n +0000797131 00000 n +0000797339 00000 n +0000797594 00000 n +0000797842 00000 n +0000798065 00000 n +0000798292 00000 n +0000798504 00000 n +0000798699 00000 n +0000798899 00000 n +0000799078 00000 n +0000799278 00000 n +0000799461 00000 n +0000799676 00000 n +0000799881 00000 n +0000800072 00000 n +0000800257 00000 n +0000800496 00000 n +0000800728 00000 n +0000800964 00000 n +0000801186 00000 n +0000801380 00000 n +0000801597 00000 n +0000801810 00000 n +0000802011 00000 n +0000802205 00000 n +0000802395 00000 n +0000802592 00000 n +0000802780 00000 n +0000802985 00000 n +0000803155 00000 n +0000803353 00000 n +0000803548 00000 n +0000803719 00000 n +0000803924 00000 n +0000804157 00000 n +0000804360 00000 n +0000804541 00000 n +0000804605 00000 n +0000812285 00000 n +0000817087 00000 n +0000828947 00000 n +0000841343 00000 n +0000841577 00000 n +0000841981 00000 n +0000842779 00000 n +0000842932 00000 n +0000843163 00000 n +0000843760 00000 n +0000845245 00000 n +0000845395 00000 n +0000845630 00000 n +0000846169 00000 n +0000847406 00000 n +0000847559 00000 n +0000847803 00000 n +0000848398 00000 n +0000850023 00000 n +0000850180 00000 n +trailer +<< +/Size 1077 +/Root 3 0 R +/Info 2 0 R +>> +startxref +850272 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md new file mode 100644 index 00000000000..b1eba5740d7 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md @@ -0,0 +1,3098 @@ +--- +title: CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6 +weight: 101 +--- + +### CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.21 + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf). + +#### Overview + +This document is a companion to the Rancher v2.6 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. + +This guide corresponds to specific versions of the hardening guide, Rancher, CIS Benchmark and Kubernetes: + +| Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version | +| ----------------------- | --------------- | --------------------- | ------------------- | +| Hardening Guide CIS v1.6 Benchmark | Rancher v2.6.3 | CIS v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark do not apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. + +This document is to be used by Rancher operators, security teams, auditors and decision makers. + +For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +#### Testing controls methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +> NOTE: Only `automated` tests (previously called `scored`) are covered in this guide. + +### Controls +## 1.1 Master Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod 644 + +**Audit:** + +```bash +stat -c permissions=%a +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown root:root + +**Audit:** + +```bash +stat -c %U:%G +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the below command: +ps -ef | grep etcd +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +A system service account is required for etcd data directory ownership. +Refer to Rancher's hardening guide for more details on how to configure this ownership. + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 644 /etc/kubernetes/pki/*.crt + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/!(*key).pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chmod -R 600 /etc/kubernetes/ssl/*key.pem + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh /node/etc/kubernetes/ssl/*key.pem +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.2 Ensure that the --basic-auth-file argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --basic-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--basic-auth-file' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.3 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is not present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'Node' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --authorization-mode parameter to a value that includes RBAC, +for example: +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'Node,RBAC' has 'RBAC' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is not present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create Pod Security Policy objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes PodSecurityPolicy: +--enable-admission-plugins=...,PodSecurityPolicy,... +Then restart the API Server. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and remove the --insecure-bind-address parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--insecure-bind-address' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--insecure-port=0 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'0' is equal to '0' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +6443 is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.21 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.22 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example: +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +30 is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +10 is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB: +--audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +100 is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, +--request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is not present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --service-account-key-file parameter +to the public key file for service accounts: +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 1.2.34 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit Script:** `check_encryption_provider_config.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to check the encrption provider config is set to aesbc +# +# outputs: +# true/false + +# TODO: Figure out the file location from the kube-apiserver commandline args +ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" + +if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then + echo "false" + exit +fi + +for provider in "$@" +do + if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then + echo "true" + exit + fi +done + +echo "false" +exit + +``` + +**Audit Execution:** + +```bash +./check_encryption_provider_config.sh aescbc +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +- aescbc: true +``` + +### 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the master node and set the below parameter. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM +_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM +_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM +_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example: +--terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'true' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --allocate-node-cidrs=true --configure-cloud-routes=false --leader-elect=true --pod-eviction-timeout=5m0s --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --bind-address=127.0.0.1 --enable-hostpath-provisioner=false --address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cloud-provider= --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --node-monitor-grace-period=40s --profiling=false --terminated-pod-gc-threshold=1000 --v=2 --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the master node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'false' is equal to 'false' +``` + +**Returned Value**: + +```console +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the master node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'127.0.0.1' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --address=127.0.0.1 --leader-elect=true --profiling=false --v=2 --bind-address=127.0.0.1 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +## 2 Etcd Node Configuration Files +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 2 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--auto-tls' is not present OR '--auto-tls' is not present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 1 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 5 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is present OR 'true' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-auto-tls' is not present OR '--peer-auto-tls' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 4 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 120679 120657 1 12:27 ? 00:01:17 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --heartbeat-interval=500 --election-timeout=5000 --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-=https://:2380 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --peer-client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://:2380 --initial-cluster-state=new --advertise-client-urls=https://:2379 --client-cert-auth=true --enable-v2=true --name=etcd- --listen-client-urls=https://:2379 --listen-peer-urls=https://:2380 --key-file=/etc/kubernetes/ssl/kube-etcd--key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 120728 120707 0 12:27 ? 00:00:00 /opt/rke-tools/rke-etcd-backup etcd-backup save --cacert /etc/kubernetes/ssl/kube-ca.pem --cert /etc/kubernetes/ssl/kube-node.pem --key /etc/kubernetes/ssl/kube-node-key.pem --name etcd-rolling-snapshots --endpoints=:2379 --retention=72h --creation=12h root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json root 214939 214868 3 13:56 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=5 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.6-hardened --json --log_dir /tmp/results/logs --outputfile /tmp/results/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --requestheader-username-headers=X-Remote-User --bind-address=0.0.0.0 --advertise-address= --requestheader-allowed-names=kube-apiserver-proxy-client --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --allow-privileged=true --requestheader-extra-headers-prefix=X-Remote-Extra- --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-lookup=true --runtime-config=policy/v1beta1/podsecuritypolicy=true --authorization-mode=Node,RBAC --audit-log-maxage=30 --profiling=false --storage-backend=etcd3 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-servers=https://:2379 --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --secure-port=6443 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --insecure-port=0 --api-audiences=unknown --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --service-account-issuer=rke --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --requestheader-group-headers=X-Remote-Group --cloud-provider= --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-node-port-range=30000-32767 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --anonymous-auth=false --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --audit-log-format=json +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Consider modification of the audit policy in use on the cluster to include these items, at a +minimum. + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 $proykubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is not present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 644 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +'permissions' is not present +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is not present +``` + +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 644 /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to +false. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--anonymous-auth=false +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set readOnlyPort to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set protectKernelDefaults: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present OR '' is not present +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set tlsCertFile to the location +of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present AND '' is not present +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line rotateCertificates: true or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--rotate-certificates' is not present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 121813 121792 4 12:27 ? 00:03:37 kubelet --fail-swap-on=false --resolv-conf=/etc/resolv.conf --authorization-mode=Webhook --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --v=2 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --make-iptables-util-chains=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --hostname-override= --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-.pem --network-plugin=cni --streaming-connection-idle-timeout=30m --root-dir=/var/lib/kubelet --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --protect-kernel-defaults=true --cloud-provider= --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet--key.pem --cgroups-per-qos=True --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --pod-infra-container-image=rancher/mirrored-pause:3.5 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --anonymous-auth=false --authentication-token-webhook=true --node-ip= --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --read-only-port=0 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set TLSCipherSuites: to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'' is not present +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +## 5.2 Pod Security Policies +### 5.2.1 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that +the .spec.privileged field is omitted or set to false. + +### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostPID field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostIPC field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.hostNetwork field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.allowPrivilegeEscalation field is omitted or set to false. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +1 is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.2.6 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of +UIDs not including 0. + +### 5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Create a PSP as described in the Kubernetes documentation, ensuring that the +.spec.requiredDropCapabilities is set to include either NET_RAW or ALL. + +### 5.2.8 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that allowedCapabilities is not present in PSPs for the cluster unless +it is set to an empty array. + +### 5.2.9 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications runnning on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do + policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') + if [[ ${policy_count} -eq 0 ]]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using secrets as files over secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +if possible, rewrite application code to read secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you +would need to enable alpha features in the apiserver by passing "--feature- +gates=AllAlpha=true" argument. +Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS +parameter to "--feature-gates=AllAlpha=true" +KUBE_API_ARGS="--feature-gates=AllAlpha=true" +Based on your system, restart the kube-apiserver service. For example: +systemctl restart kube-apiserver.service +Use annotations to enable the docker/default seccomp profile in your pod definitions. An +example is as below: +apiVersion: v1 +kind: Pod +metadata: + name: trustworthy-pod + annotations: + seccomp.security.alpha.kubernetes.io/pod: docker/default +spec: + containers: + - name: trustworthy-container + image: sotrustworthy:latest + +### 5.7.3 Apply Security Context to Your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply security contexts to your pods. For a +suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Automated) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + +**Audit Script:** `check_for_default_ns.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) +if [[ ${count} -gt 0 ]]; then + echo "false" + exit +fi + +echo "true" + + +``` + +**Audit Execution:** + +```bash +./check_for_default_ns.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf new file mode 100644 index 00000000000..c61b5c4abc1 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf @@ -0,0 +1,8259 @@ +%PDF-1.7 +%🖤 +1 0 obj +<< +/Type /Pages +/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 164 0 R 194 0 R 232 0 R 270 0 R 310 0 R 350 0 R 390 0 R 425 0 R 464 0 R 499 0 R 534 0 R 557 0 R 591 0 R ] +/Count 22 +>> +endobj +2 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Creator (pandoc) +/Producer (WeasyPrint 54.2) +>> +endobj +3 0 obj +<< +/Type /Catalog +/Pages 1 0 R +/Outlines 611 0 R +/Names << +/Dests << +/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 390 0 R /XYZ 84.259843 416.811778 0 ] (cb10-1) [ 390 0 R /XYZ 101.433071 415.114756 0 ] (cb10-10) [ 390 0 R /XYZ 99.933071 244.591563 0 ] (cb10-100) [ 499 0 R /XYZ 99.933071 590.755821 0 ] (cb10-101) [ 499 0 R /XYZ 99.933071 571.808799 0 ] (cb10-102) [ 499 0 R /XYZ 99.933071 552.861778 0 ] (cb10-103) [ 499 0 R /XYZ 99.933071 533.914756 0 ] (cb10-104) [ 499 0 R /XYZ 99.933071 514.967735 0 ] (cb10-105) [ 499 0 R /XYZ 99.933071 496.020714 0 ] (cb10-106) [ 499 0 R /XYZ 99.933071 477.073692 0 ] (cb10-107) [ 499 0 R /XYZ 99.933071 458.126671 0 ] (cb10-108) [ 499 0 R /XYZ 99.933071 439.179649 0 ] (cb10-109) [ 499 0 R /XYZ 99.933071 420.232628 0 ] (cb10-11) [ 390 0 R /XYZ 99.933071 225.644542 0 ] (cb10-110) [ 499 0 R /XYZ 99.933071 401.285606 0 ] (cb10-111) [ 499 0 R /XYZ 99.933071 382.338585 0 ] (cb10-112) [ 499 0 R /XYZ 99.933071 363.391563 0 ] (cb10-113) [ 499 0 R /XYZ 99.933071 344.444542 0 ] (cb10-114) [ 499 0 R /XYZ 99.933071 325.497520 0 ] (cb10-115) [ 499 0 R /XYZ 99.933071 306.550499 0 ] (cb10-116) [ 499 0 R /XYZ 99.933071 287.603477 0 ] (cb10-117) [ 499 0 R /XYZ 99.933071 173.921348 0 ] (cb10-118) [ 499 0 R /XYZ 99.933071 154.974327 0 ] (cb10-119) [ 499 0 R /XYZ 99.933071 136.027305 0 ] (cb10-12) [ 390 0 R /XYZ 99.933071 206.697520 0 ] (cb10-120) [ 499 0 R /XYZ 99.933071 117.080284 0 ] (cb10-121) [ 499 0 R /XYZ 99.933071 98.133262 0 ] (cb10-122) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb10-123) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb10-124) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb10-125) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb10-126) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb10-127) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb10-128) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb10-129) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb10-13) [ 390 0 R /XYZ 99.933071 187.750499 0 ] (cb10-14) [ 390 0 R /XYZ 99.933071 168.803477 0 ] (cb10-15) [ 390 0 R /XYZ 99.933071 149.856456 0 ] (cb10-16) [ 390 0 R /XYZ 99.933071 130.909434 0 ] (cb10-17) [ 390 0 R /XYZ 99.933071 111.962413 0 ] (cb10-18) [ 390 0 R /XYZ 99.933071 93.015391 0 ] (cb10-19) [ 425 0 R /XYZ 99.933071 799.173057 0 ] (cb10-2) [ 390 0 R /XYZ 99.933071 396.167735 0 ] (cb10-20) [ 425 0 R /XYZ 99.933071 780.226036 0 ] (cb10-21) [ 425 0 R /XYZ 99.933071 761.279014 0 ] (cb10-22) [ 425 0 R /XYZ 99.933071 742.331993 0 ] (cb10-23) [ 425 0 R /XYZ 99.933071 723.384971 0 ] (cb10-24) [ 425 0 R /XYZ 99.933071 704.437950 0 ] (cb10-25) [ 425 0 R /XYZ 99.933071 685.490928 0 ] (cb10-26) [ 425 0 R /XYZ 99.933071 666.543907 0 ] (cb10-27) [ 425 0 R /XYZ 99.933071 647.596885 0 ] (cb10-28) [ 425 0 R /XYZ 99.933071 628.649864 0 ] (cb10-29) [ 425 0 R /XYZ 99.933071 609.702842 0 ] (cb10-3) [ 390 0 R /XYZ 99.933071 377.220714 0 ] (cb10-30) [ 425 0 R /XYZ 99.933071 571.808799 0 ] (cb10-31) [ 425 0 R /XYZ 99.933071 552.861778 0 ] (cb10-32) [ 425 0 R /XYZ 99.933071 533.914756 0 ] (cb10-33) [ 425 0 R /XYZ 99.933071 514.967735 0 ] (cb10-34) [ 425 0 R /XYZ 99.933071 496.020714 0 ] (cb10-35) [ 425 0 R /XYZ 99.933071 477.073692 0 ] (cb10-36) [ 425 0 R /XYZ 99.933071 458.126671 0 ] (cb10-37) [ 425 0 R /XYZ 99.933071 439.179649 0 ] (cb10-38) [ 425 0 R /XYZ 99.933071 420.232628 0 ] (cb10-39) [ 425 0 R /XYZ 99.933071 401.285606 0 ] (cb10-4) [ 390 0 R /XYZ 99.933071 358.273692 0 ] (cb10-40) [ 425 0 R /XYZ 99.933071 382.338585 0 ] (cb10-41) [ 425 0 R /XYZ 99.933071 363.391563 0 ] (cb10-42) [ 425 0 R /XYZ 99.933071 344.444542 0 ] (cb10-43) [ 425 0 R /XYZ 99.933071 325.497520 0 ] (cb10-44) [ 425 0 R /XYZ 99.933071 306.550499 0 ] (cb10-45) [ 425 0 R /XYZ 99.933071 287.603477 0 ] (cb10-46) [ 425 0 R /XYZ 99.933071 268.656456 0 ] (cb10-47) [ 425 0 R /XYZ 99.933071 249.709434 0 ] (cb10-48) [ 425 0 R /XYZ 99.933071 230.762413 0 ] (cb10-49) [ 425 0 R /XYZ 99.933071 211.815391 0 ] (cb10-5) [ 390 0 R /XYZ 99.933071 339.326671 0 ] (cb10-50) [ 425 0 R /XYZ 99.933071 192.868370 0 ] (cb10-51) [ 425 0 R /XYZ 99.933071 173.921348 0 ] (cb10-52) [ 425 0 R /XYZ 99.933071 154.974327 0 ] (cb10-53) [ 425 0 R /XYZ 99.933071 136.027305 0 ] (cb10-54) [ 425 0 R /XYZ 99.933071 117.080284 0 ] (cb10-55) [ 425 0 R /XYZ 99.933071 98.133262 0 ] (cb10-56) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb10-57) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb10-58) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb10-59) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb10-6) [ 390 0 R /XYZ 99.933071 320.379649 0 ] (cb10-60) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb10-61) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb10-62) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb10-63) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb10-64) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb10-65) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb10-66) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb10-67) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb10-68) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb10-69) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb10-7) [ 390 0 R /XYZ 99.933071 301.432628 0 ] (cb10-70) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb10-71) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb10-72) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb10-73) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb10-74) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb10-75) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb10-76) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb10-77) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb10-78) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb10-79) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb10-8) [ 390 0 R /XYZ 99.933071 282.485606 0 ] (cb10-80) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb10-81) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb10-82) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb10-83) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb10-84) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb10-85) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb10-86) [ 464 0 R /XYZ 99.933071 230.762413 0 ] (cb10-87) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb10-88) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb10-89) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb10-9) [ 390 0 R /XYZ 99.933071 263.538585 0 ] (cb10-90) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb10-91) [ 499 0 R /XYZ 99.933071 761.279014 0 ] (cb10-92) [ 499 0 R /XYZ 99.933071 742.331993 0 ] (cb10-93) [ 499 0 R /XYZ 99.933071 723.384971 0 ] (cb10-94) [ 499 0 R /XYZ 99.933071 704.437950 0 ] (cb10-95) [ 499 0 R /XYZ 99.933071 685.490928 0 ] (cb10-96) [ 499 0 R /XYZ 99.933071 666.543907 0 ] (cb10-97) [ 499 0 R /XYZ 99.933071 647.596885 0 ] (cb10-98) [ 499 0 R /XYZ 99.933071 628.649864 0 ] (cb10-99) [ 499 0 R /XYZ 99.933071 609.702842 0 ] (cb11) [ 534 0 R /XYZ 84.259843 331.262799 0 ] (cb11-1) [ 534 0 R /XYZ 101.433071 329.565778 0 ] (cb11-10) [ 534 0 R /XYZ 99.933071 159.042585 0 ] (cb11-11) [ 534 0 R /XYZ 99.933071 140.095563 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 121.148542 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 102.201520 0 ] (cb11-14) [ 557 0 R /XYZ 99.933071 799.173057 0 ] (cb11-15) [ 557 0 R /XYZ 99.933071 780.226036 0 ] (cb11-16) [ 557 0 R /XYZ 99.933071 761.279014 0 ] (cb11-17) [ 557 0 R /XYZ 99.933071 742.331993 0 ] (cb11-18) [ 557 0 R /XYZ 99.933071 723.384971 0 ] (cb11-19) [ 557 0 R /XYZ 99.933071 704.437950 0 ] (cb11-2) [ 534 0 R /XYZ 99.933071 310.618756 0 ] (cb11-20) [ 557 0 R /XYZ 99.933071 685.490928 0 ] (cb11-21) [ 557 0 R /XYZ 99.933071 666.543907 0 ] (cb11-22) [ 557 0 R /XYZ 99.933071 647.596885 0 ] (cb11-23) [ 557 0 R /XYZ 99.933071 628.649864 0 ] (cb11-24) [ 557 0 R /XYZ 99.933071 609.702842 0 ] (cb11-25) [ 557 0 R /XYZ 99.933071 590.755821 0 ] (cb11-26) [ 557 0 R /XYZ 99.933071 571.808799 0 ] (cb11-3) [ 534 0 R /XYZ 99.933071 291.671735 0 ] (cb11-4) [ 534 0 R /XYZ 99.933071 272.724714 0 ] (cb11-5) [ 534 0 R /XYZ 99.933071 253.777692 0 ] (cb11-6) [ 534 0 R /XYZ 99.933071 234.830671 0 ] (cb11-7) [ 534 0 R /XYZ 99.933071 215.883649 0 ] (cb11-8) [ 534 0 R /XYZ 99.933071 196.936628 0 ] (cb11-9) [ 534 0 R /XYZ 99.933071 177.989606 0 ] (cb12) [ 557 0 R /XYZ 84.259843 446.115778 0 ] (cb12-1) [ 557 0 R /XYZ 101.433071 444.418756 0 ] (cb12-10) [ 557 0 R /XYZ 99.933071 273.895563 0 ] (cb12-11) [ 557 0 R /XYZ 99.933071 254.948542 0 ] (cb12-12) [ 557 0 R /XYZ 99.933071 236.001520 0 ] (cb12-13) [ 557 0 R /XYZ 99.933071 217.054499 0 ] (cb12-14) [ 557 0 R /XYZ 99.933071 198.107477 0 ] (cb12-15) [ 557 0 R /XYZ 99.933071 179.160456 0 ] (cb12-16) [ 557 0 R /XYZ 99.933071 160.213434 0 ] (cb12-17) [ 557 0 R /XYZ 99.933071 141.266413 0 ] (cb12-18) [ 557 0 R /XYZ 99.933071 122.319391 0 ] (cb12-19) [ 557 0 R /XYZ 99.933071 103.372370 0 ] (cb12-2) [ 557 0 R /XYZ 99.933071 425.471735 0 ] (cb12-20) [ 591 0 R /XYZ 99.933071 780.226036 0 ] (cb12-21) [ 591 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 591 0 R /XYZ 99.933071 723.384971 0 ] (cb12-23) [ 591 0 R /XYZ 99.933071 704.437950 0 ] (cb12-3) [ 557 0 R /XYZ 99.933071 406.524714 0 ] (cb12-4) [ 557 0 R /XYZ 99.933071 387.577692 0 ] (cb12-5) [ 557 0 R /XYZ 99.933071 368.630671 0 ] (cb12-6) [ 557 0 R /XYZ 99.933071 349.683649 0 ] (cb12-7) [ 557 0 R /XYZ 99.933071 330.736628 0 ] (cb12-8) [ 557 0 R /XYZ 99.933071 311.789606 0 ] (cb12-9) [ 557 0 R /XYZ 99.933071 292.842585 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 194 0 R /XYZ 99.933071 590.755821 0 ] (cb9-101) [ 194 0 R /XYZ 99.933071 571.808799 0 ] (cb9-102) [ 194 0 R /XYZ 99.933071 552.861778 0 ] (cb9-103) [ 194 0 R /XYZ 99.933071 533.914756 0 ] (cb9-104) [ 194 0 R /XYZ 99.933071 514.967735 0 ] (cb9-105) [ 194 0 R /XYZ 99.933071 496.020714 0 ] (cb9-106) [ 194 0 R /XYZ 99.933071 477.073692 0 ] (cb9-107) [ 194 0 R /XYZ 99.933071 458.126671 0 ] (cb9-108) [ 194 0 R /XYZ 99.933071 439.179649 0 ] (cb9-109) [ 194 0 R /XYZ 99.933071 420.232628 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 194 0 R /XYZ 99.933071 401.285606 0 ] (cb9-111) [ 194 0 R /XYZ 99.933071 344.444542 0 ] (cb9-112) [ 194 0 R /XYZ 99.933071 325.497520 0 ] (cb9-113) [ 194 0 R /XYZ 99.933071 306.550499 0 ] (cb9-114) [ 194 0 R /XYZ 99.933071 287.603477 0 ] (cb9-115) [ 194 0 R /XYZ 99.933071 268.656456 0 ] (cb9-116) [ 194 0 R /XYZ 99.933071 249.709434 0 ] (cb9-117) [ 194 0 R /XYZ 99.933071 230.762413 0 ] (cb9-118) [ 194 0 R /XYZ 99.933071 211.815391 0 ] (cb9-119) [ 194 0 R /XYZ 99.933071 192.868370 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 194 0 R /XYZ 99.933071 173.921348 0 ] (cb9-121) [ 194 0 R /XYZ 99.933071 154.974327 0 ] (cb9-122) [ 194 0 R /XYZ 99.933071 136.027305 0 ] (cb9-123) [ 194 0 R /XYZ 99.933071 117.080284 0 ] (cb9-124) [ 194 0 R /XYZ 99.933071 98.133262 0 ] (cb9-125) [ 232 0 R /XYZ 99.933071 799.173057 0 ] (cb9-126) [ 232 0 R /XYZ 99.933071 780.226036 0 ] (cb9-127) [ 232 0 R /XYZ 99.933071 761.279014 0 ] (cb9-128) [ 232 0 R /XYZ 99.933071 742.331993 0 ] (cb9-129) [ 232 0 R /XYZ 99.933071 704.437950 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 232 0 R /XYZ 99.933071 685.490928 0 ] (cb9-131) [ 232 0 R /XYZ 99.933071 666.543907 0 ] (cb9-132) [ 232 0 R /XYZ 99.933071 647.596885 0 ] (cb9-133) [ 232 0 R /XYZ 99.933071 628.649864 0 ] (cb9-134) [ 232 0 R /XYZ 99.933071 609.702842 0 ] (cb9-135) [ 232 0 R /XYZ 99.933071 590.755821 0 ] (cb9-136) [ 232 0 R /XYZ 99.933071 571.808799 0 ] (cb9-137) [ 232 0 R /XYZ 99.933071 552.861778 0 ] (cb9-138) [ 232 0 R /XYZ 99.933071 533.914756 0 ] (cb9-139) [ 232 0 R /XYZ 99.933071 514.967735 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 232 0 R /XYZ 99.933071 477.073692 0 ] (cb9-141) [ 232 0 R /XYZ 99.933071 458.126671 0 ] (cb9-142) [ 232 0 R /XYZ 99.933071 439.179649 0 ] (cb9-143) [ 232 0 R /XYZ 99.933071 420.232628 0 ] (cb9-144) [ 232 0 R /XYZ 99.933071 401.285606 0 ] (cb9-145) [ 232 0 R /XYZ 99.933071 382.338585 0 ] (cb9-146) [ 232 0 R /XYZ 99.933071 363.391563 0 ] (cb9-147) [ 232 0 R /XYZ 99.933071 344.444542 0 ] (cb9-148) [ 232 0 R /XYZ 99.933071 325.497520 0 ] (cb9-149) [ 232 0 R /XYZ 99.933071 306.550499 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 232 0 R /XYZ 99.933071 287.603477 0 ] (cb9-151) [ 232 0 R /XYZ 99.933071 268.656456 0 ] (cb9-152) [ 232 0 R /XYZ 99.933071 249.709434 0 ] (cb9-153) [ 232 0 R /XYZ 99.933071 230.762413 0 ] (cb9-154) [ 232 0 R /XYZ 99.933071 211.815391 0 ] (cb9-155) [ 232 0 R /XYZ 99.933071 192.868370 0 ] (cb9-156) [ 232 0 R /XYZ 99.933071 173.921348 0 ] (cb9-157) [ 232 0 R /XYZ 99.933071 154.974327 0 ] (cb9-158) [ 232 0 R /XYZ 99.933071 136.027305 0 ] (cb9-159) [ 232 0 R /XYZ 99.933071 117.080284 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 232 0 R /XYZ 99.933071 98.133262 0 ] (cb9-161) [ 270 0 R /XYZ 99.933071 799.173057 0 ] (cb9-162) [ 270 0 R /XYZ 99.933071 780.226036 0 ] (cb9-163) [ 270 0 R /XYZ 99.933071 761.279014 0 ] (cb9-164) [ 270 0 R /XYZ 99.933071 742.331993 0 ] (cb9-165) [ 270 0 R /XYZ 99.933071 723.384971 0 ] (cb9-166) [ 270 0 R /XYZ 99.933071 704.437950 0 ] (cb9-167) [ 270 0 R /XYZ 99.933071 685.490928 0 ] (cb9-168) [ 270 0 R /XYZ 99.933071 666.543907 0 ] (cb9-169) [ 270 0 R /XYZ 99.933071 647.596885 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 270 0 R /XYZ 99.933071 628.649864 0 ] (cb9-171) [ 270 0 R /XYZ 99.933071 609.702842 0 ] (cb9-172) [ 270 0 R /XYZ 99.933071 590.755821 0 ] (cb9-173) [ 270 0 R /XYZ 99.933071 571.808799 0 ] (cb9-174) [ 270 0 R /XYZ 99.933071 552.861778 0 ] (cb9-175) [ 270 0 R /XYZ 99.933071 533.914756 0 ] (cb9-176) [ 270 0 R /XYZ 99.933071 514.967735 0 ] (cb9-177) [ 270 0 R /XYZ 99.933071 496.020714 0 ] (cb9-178) [ 270 0 R /XYZ 99.933071 477.073692 0 ] (cb9-179) [ 270 0 R /XYZ 99.933071 458.126671 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 270 0 R /XYZ 99.933071 439.179649 0 ] (cb9-181) [ 270 0 R /XYZ 99.933071 420.232628 0 ] (cb9-182) [ 270 0 R /XYZ 99.933071 401.285606 0 ] (cb9-183) [ 270 0 R /XYZ 99.933071 382.338585 0 ] (cb9-184) [ 270 0 R /XYZ 99.933071 363.391563 0 ] (cb9-185) [ 270 0 R /XYZ 99.933071 344.444542 0 ] (cb9-186) [ 270 0 R /XYZ 99.933071 325.497520 0 ] (cb9-187) [ 270 0 R /XYZ 99.933071 306.550499 0 ] (cb9-188) [ 270 0 R /XYZ 99.933071 287.603477 0 ] (cb9-189) [ 270 0 R /XYZ 99.933071 268.656456 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 270 0 R /XYZ 99.933071 249.709434 0 ] (cb9-191) [ 270 0 R /XYZ 99.933071 230.762413 0 ] (cb9-192) [ 270 0 R /XYZ 99.933071 211.815391 0 ] (cb9-193) [ 270 0 R /XYZ 99.933071 192.868370 0 ] (cb9-194) [ 270 0 R /XYZ 99.933071 173.921348 0 ] (cb9-195) [ 270 0 R /XYZ 99.933071 154.974327 0 ] (cb9-196) [ 270 0 R /XYZ 99.933071 136.027305 0 ] (cb9-197) [ 270 0 R /XYZ 99.933071 117.080284 0 ] (cb9-198) [ 270 0 R /XYZ 99.933071 98.133262 0 ] (cb9-199) [ 310 0 R /XYZ 99.933071 799.173057 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 310 0 R /XYZ 99.933071 780.226036 0 ] (cb9-201) [ 310 0 R /XYZ 99.933071 761.279014 0 ] (cb9-202) [ 310 0 R /XYZ 99.933071 742.331993 0 ] (cb9-203) [ 310 0 R /XYZ 99.933071 723.384971 0 ] (cb9-204) [ 310 0 R /XYZ 99.933071 704.437950 0 ] (cb9-205) [ 310 0 R /XYZ 99.933071 685.490928 0 ] (cb9-206) [ 310 0 R /XYZ 99.933071 666.543907 0 ] (cb9-207) [ 310 0 R /XYZ 99.933071 647.596885 0 ] (cb9-208) [ 310 0 R /XYZ 99.933071 628.649864 0 ] (cb9-209) [ 310 0 R /XYZ 99.933071 609.702842 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 310 0 R /XYZ 99.933071 590.755821 0 ] (cb9-211) [ 310 0 R /XYZ 99.933071 571.808799 0 ] (cb9-212) [ 310 0 R /XYZ 99.933071 552.861778 0 ] (cb9-213) [ 310 0 R /XYZ 99.933071 533.914756 0 ] (cb9-214) [ 310 0 R /XYZ 99.933071 514.967735 0 ] (cb9-215) [ 310 0 R /XYZ 99.933071 496.020714 0 ] (cb9-216) [ 310 0 R /XYZ 99.933071 477.073692 0 ] (cb9-217) [ 310 0 R /XYZ 99.933071 458.126671 0 ] (cb9-218) [ 310 0 R /XYZ 99.933071 439.179649 0 ] (cb9-219) [ 310 0 R /XYZ 99.933071 420.232628 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 310 0 R /XYZ 99.933071 401.285606 0 ] (cb9-221) [ 310 0 R /XYZ 99.933071 382.338585 0 ] (cb9-222) [ 310 0 R /XYZ 99.933071 363.391563 0 ] (cb9-223) [ 310 0 R /XYZ 99.933071 344.444542 0 ] (cb9-224) [ 310 0 R /XYZ 99.933071 325.497520 0 ] (cb9-225) [ 310 0 R /XYZ 99.933071 306.550499 0 ] (cb9-226) [ 310 0 R /XYZ 99.933071 287.603477 0 ] (cb9-227) [ 310 0 R /XYZ 99.933071 268.656456 0 ] (cb9-228) [ 310 0 R /XYZ 99.933071 249.709434 0 ] (cb9-229) [ 310 0 R /XYZ 99.933071 230.762413 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 310 0 R /XYZ 99.933071 211.815391 0 ] (cb9-231) [ 310 0 R /XYZ 99.933071 192.868370 0 ] (cb9-232) [ 310 0 R /XYZ 99.933071 173.921348 0 ] (cb9-233) [ 310 0 R /XYZ 99.933071 154.974327 0 ] (cb9-234) [ 310 0 R /XYZ 99.933071 136.027305 0 ] (cb9-235) [ 310 0 R /XYZ 99.933071 117.080284 0 ] (cb9-236) [ 310 0 R /XYZ 99.933071 98.133262 0 ] (cb9-237) [ 350 0 R /XYZ 99.933071 799.173057 0 ] (cb9-238) [ 350 0 R /XYZ 99.933071 780.226036 0 ] (cb9-239) [ 350 0 R /XYZ 99.933071 761.279014 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 350 0 R /XYZ 99.933071 742.331993 0 ] (cb9-241) [ 350 0 R /XYZ 99.933071 723.384971 0 ] (cb9-242) [ 350 0 R /XYZ 99.933071 704.437950 0 ] (cb9-243) [ 350 0 R /XYZ 99.933071 685.490928 0 ] (cb9-244) [ 350 0 R /XYZ 99.933071 666.543907 0 ] (cb9-245) [ 350 0 R /XYZ 99.933071 647.596885 0 ] (cb9-246) [ 350 0 R /XYZ 99.933071 628.649864 0 ] (cb9-247) [ 350 0 R /XYZ 99.933071 609.702842 0 ] (cb9-248) [ 350 0 R /XYZ 99.933071 590.755821 0 ] (cb9-249) [ 350 0 R /XYZ 99.933071 571.808799 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 350 0 R /XYZ 99.933071 552.861778 0 ] (cb9-251) [ 350 0 R /XYZ 99.933071 533.914756 0 ] (cb9-252) [ 350 0 R /XYZ 99.933071 514.967735 0 ] (cb9-253) [ 350 0 R /XYZ 99.933071 496.020714 0 ] (cb9-254) [ 350 0 R /XYZ 99.933071 477.073692 0 ] (cb9-255) [ 350 0 R /XYZ 99.933071 458.126671 0 ] (cb9-256) [ 350 0 R /XYZ 99.933071 439.179649 0 ] (cb9-257) [ 350 0 R /XYZ 99.933071 420.232628 0 ] (cb9-258) [ 350 0 R /XYZ 99.933071 401.285606 0 ] (cb9-259) [ 350 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 350 0 R /XYZ 99.933071 363.391563 0 ] (cb9-261) [ 350 0 R /XYZ 99.933071 344.444542 0 ] (cb9-262) [ 350 0 R /XYZ 99.933071 325.497520 0 ] (cb9-263) [ 350 0 R /XYZ 99.933071 306.550499 0 ] (cb9-264) [ 350 0 R /XYZ 99.933071 287.603477 0 ] (cb9-265) [ 350 0 R /XYZ 99.933071 268.656456 0 ] (cb9-266) [ 350 0 R /XYZ 99.933071 249.709434 0 ] (cb9-267) [ 350 0 R /XYZ 99.933071 230.762413 0 ] (cb9-268) [ 350 0 R /XYZ 99.933071 211.815391 0 ] (cb9-269) [ 350 0 R /XYZ 99.933071 192.868370 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 350 0 R /XYZ 99.933071 173.921348 0 ] (cb9-271) [ 350 0 R /XYZ 99.933071 154.974327 0 ] (cb9-272) [ 350 0 R /XYZ 99.933071 136.027305 0 ] (cb9-273) [ 350 0 R /XYZ 99.933071 117.080284 0 ] (cb9-274) [ 350 0 R /XYZ 99.933071 98.133262 0 ] (cb9-275) [ 390 0 R /XYZ 99.933071 799.173057 0 ] (cb9-276) [ 390 0 R /XYZ 99.933071 780.226036 0 ] (cb9-277) [ 390 0 R /XYZ 99.933071 761.279014 0 ] (cb9-278) [ 390 0 R /XYZ 99.933071 742.331993 0 ] (cb9-279) [ 390 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 390 0 R /XYZ 99.933071 704.437950 0 ] (cb9-281) [ 390 0 R /XYZ 99.933071 685.490928 0 ] (cb9-282) [ 390 0 R /XYZ 99.933071 666.543907 0 ] (cb9-283) [ 390 0 R /XYZ 99.933071 647.596885 0 ] (cb9-284) [ 390 0 R /XYZ 99.933071 628.649864 0 ] (cb9-285) [ 390 0 R /XYZ 99.933071 609.702842 0 ] (cb9-286) [ 390 0 R /XYZ 99.933071 590.755821 0 ] (cb9-287) [ 390 0 R /XYZ 99.933071 571.808799 0 ] (cb9-288) [ 390 0 R /XYZ 99.933071 552.861778 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-61) [ 164 0 R /XYZ 99.933071 799.173057 0 ] (cb9-62) [ 164 0 R /XYZ 99.933071 780.226036 0 ] (cb9-63) [ 164 0 R /XYZ 99.933071 761.279014 0 ] (cb9-64) [ 164 0 R /XYZ 99.933071 742.331993 0 ] (cb9-65) [ 164 0 R /XYZ 99.933071 723.384971 0 ] (cb9-66) [ 164 0 R /XYZ 99.933071 704.437950 0 ] (cb9-67) [ 164 0 R /XYZ 99.933071 685.490928 0 ] (cb9-68) [ 164 0 R /XYZ 99.933071 571.808799 0 ] (cb9-69) [ 164 0 R /XYZ 99.933071 552.861778 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 164 0 R /XYZ 99.933071 533.914756 0 ] (cb9-71) [ 164 0 R /XYZ 99.933071 514.967735 0 ] (cb9-72) [ 164 0 R /XYZ 99.933071 496.020714 0 ] (cb9-73) [ 164 0 R /XYZ 99.933071 477.073692 0 ] (cb9-74) [ 164 0 R /XYZ 99.933071 458.126671 0 ] (cb9-75) [ 164 0 R /XYZ 99.933071 439.179649 0 ] (cb9-76) [ 164 0 R /XYZ 99.933071 420.232628 0 ] (cb9-77) [ 164 0 R /XYZ 99.933071 401.285606 0 ] (cb9-78) [ 164 0 R /XYZ 99.933071 382.338585 0 ] (cb9-79) [ 164 0 R /XYZ 99.933071 363.391563 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 164 0 R /XYZ 99.933071 249.709434 0 ] (cb9-81) [ 164 0 R /XYZ 99.933071 230.762413 0 ] (cb9-82) [ 164 0 R /XYZ 99.933071 211.815391 0 ] (cb9-83) [ 164 0 R /XYZ 99.933071 192.868370 0 ] (cb9-84) [ 164 0 R /XYZ 99.933071 173.921348 0 ] (cb9-85) [ 164 0 R /XYZ 99.933071 154.974327 0 ] (cb9-86) [ 164 0 R /XYZ 99.933071 136.027305 0 ] (cb9-87) [ 164 0 R /XYZ 99.933071 117.080284 0 ] (cb9-88) [ 164 0 R /XYZ 99.933071 98.133262 0 ] (cb9-89) [ 194 0 R /XYZ 99.933071 799.173057 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 194 0 R /XYZ 99.933071 780.226036 0 ] (cb9-91) [ 194 0 R /XYZ 99.933071 761.279014 0 ] (cb9-92) [ 194 0 R /XYZ 99.933071 742.331993 0 ] (cb9-93) [ 194 0 R /XYZ 99.933071 723.384971 0 ] (cb9-94) [ 194 0 R /XYZ 99.933071 704.437950 0 ] (cb9-95) [ 194 0 R /XYZ 99.933071 685.490928 0 ] (cb9-96) [ 194 0 R /XYZ 99.933071 666.543907 0 ] (cb9-97) [ 194 0 R /XYZ 99.933071 647.596885 0 ] (cb9-98) [ 194 0 R /XYZ 99.933071 628.649864 0 ] (cb9-99) [ 194 0 R /XYZ 99.933071 609.702842 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 534 0 R /XYZ 84.259843 537.158799 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 557 0 R /XYZ 84.259843 511.863778 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 534 0 R /XYZ 84.259843 397.010799 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 390 0 R /XYZ 84.259843 518.211778 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] +>> +>> +>> +endobj +4 0 obj +<< +/ExtGState << +/a1.0 << +/ca 1 +>> +/A1.0 << +/CA 1 +>> +>> +/XObject << +>> +/Pattern << +>> +/Shading << +>> +/Font 632 0 R +>> +endobj +5 0 obj +<< +/Filter /FlateDecode +/Length 2578 +>> +stream +xˎd 602%R^8 ;0 dad1.'8~~*]럋IDHGRU,x{Η7' 5 ~wCw|b5؊.j˩ ^4ϧ|v5Bk%|Ǯ2 kLT *JT9ZS.DUb#T0#WK0Úg Q`Fј +fĖ+QE1P 3MDs(t)-5ŚN5j1Gk &2lLze[PlI^*lIFt[]NuEDkrs3kЉW%!0]!7갣H]-Er:ؒU)l1ZnM}whd [RFu +lZBc@5XK \9@VeH-+2DRd P- +#FbعT[c&؂%2(hknMZd,P$pa0(^@\Rc,P0WNt+cKb,P`W cjQ UŕT[cX`Fb%jJHX`nr1wSEݔ,r)Kb,0p7Y*p] $t%e,BBZXȞBV 2Gu-Ċ'b) TX]  2ݘ0dpyCf,;-DR]  2 ,%D P] pXAXP]XP]ɪCCuE=1 ۖi$AHtD0Ӂ"1pMƂR 9c ȂcAq XP@J@;3T YT[cд9cAMESb, e`,@FZDMwd YfXPsA=YeWX jP PKǦg,CO `t j-*E2sI6c2]bd,[ 2xrTE QKbΤיXVBO MPiT[ O/3c(sh6Mg,p-Ic|כ lAXФ&3Љ071`_z +Mxd6-ެ`KFBuIS#LB :1]-cA+כX4&2zz$ެ db:pia,@&2[V +3^q:=17##{*=3HfBO VB E>fL>GTP3l~|췟OF=O'ej֥\ov~~\?$s;Qeц2=cb7 }᧞<<||tU_- }F8OTOoN}_bO?BEhc9m]n_}?U>uy~}e?" $ȴ|70f\'wqQ_7u~:q'L+W*ؑ{,'.ږKF+w}'ŗ*_O q0 ȋ/W}[Dzo;UIMX[:hvYRcz1!+|\zӥָ{, 6>"lƞ\ϲ#`bl`@\HqʼJBv9ExZ{޶ys-IYqY1Hhu_LGqzAx`zki +6놶]7\~PU6a~6'^?̩+K8Mߧ.n?-՗g*PVcvL7ڔs.u"ˉ_ɸa1~[_>f6DJץm2ex";&mW`57Ax9!)W;/VH u,YR䟷 WT)9ޠ(jf }oN$2clwX} ߡ;{nSkuHMx܋)3Y e8OW~/;ܪY`%n}Lv>:W҈ԥf[[7[mw?y{u\҉)}ޥtKh9zy {t&9kknR_:}PAGLlޱ1-;:s%e鼯ʜļJy;"̖t&@yw纞NVϙK:)Sql{D )+3uY~IClX:N00D7XoGq> +endobj +7 0 obj +<< +/Filter /FlateDecode +/Length 3519 +>> +stream +xMo$+l`e #6@ +!?Ş&iRZ$]k=d%(N?5[Oj^џ8n&zbN-'j]p>~/uźoN'iz|2U'Y|XC6Y˧hZC//m!5+Yk:x HA 2tkX'p$ :(ͅZ}Gm'CX-=H/?Vb<8JĵNj٣P6 ]ȑ[-eֱd'U3yզzDy2]XQ"zyPzH}&D-'< :fb":uED'r3Dt"FQ|FwDt":}n}DY(f_EQ? $%#\tT!ʷYiɵ5TQ DAP=6 ]F#Տ,iLCy.J&ረ̃`QKtQСPE F="ʑhQ ND'DobCgDщD݉Dt"j](E(׈Za7 '.rs KDW$ nG +?4X0&Gۦ`y#Տ7&[!;Bw":F7>Kػ(DQ:7@S-+>TQ DAP6ΣGD9Rx˒d< + dꎈJ @tˤM$p, Hp =>/?D4΍!(TM7x0=rd;Bw":F7>KꯢMII)u+M$p, vn4] +:jѶ3~eIcECuQ2HU p|;C!<% *y0bnT?/@F0@w"db":ZT *z.F:#ND'ohotGND'W:_EY(_EQF48NIGO10#\.vn"chGC[ 1qt%)vn GZm:<9Rx~cECuQ2HU #!n I"4{ȃActC~ <cE!щDע}h":};ND_t]֟>takX7K:$]OGo?|ӏ[PJ?s;_44_dԙ;2W/9-mH5dzE+(Y_wm:%۰KՐnB+s9ǐu]R?`טG/Bh +Pn?^Xϡj.'SDĢ՟Ab za΍<¼VXM9K.;sc$vBpR%Eu2T8@gdLpkXzBj;Uf 'I,aeǸ +=.?_Tt~IGDOmH,y1{#]~EgWS,0'/-ϻwܯ*+ {a2Ly=<[̷-/^s[ou*mK} +}tR~򉊕6UqYYt'x*$S㫷epa3\[IjڶcqoNTkL.H&gZG.WE_f6CWMmjiތ6_GS4|iߔb8tfG>ȔVjId۲A>IY[? +ܱLִu ׶&B:'rkjtLQMЩT_[TEwv>dͬiS-$ڮ#Ov52[ħy +M-mѮ4q<JjU1|*A?iyP69)Vc"4V˿7< ZIńG줰d$Cu\/En 1x:ˤZ Bz̵{eju&)Ƨ͕( rDzo|/doRWgACf{c˸ ׁ5_󶰹k~NX6v DM +,4zɕ6;KOeXor^7J_j=}:nT-L[+1I٘Ć ϲNjh10_;>]^[6.cikGUF楹rhȍK+ráY^0IG)/.]!83R褅a*l(s̢m&NN N,x8{C%mjo=m`Em^_amͱK9r- ٶa4xk(Oxt&օM5)հl#N(Ŷ`7Ǭ zJ8-vvKm> +endobj +9 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 671.061024 504.679134 638.361024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +10 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.361263 663.111024 496.429134 648.111024 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +11 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 626.361024 504.679134 593.661024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +12 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 618.411024 496.429134 603.411024 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +13 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 581.661024 504.679134 548.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +14 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 146.805601 573.711024 177.256773 554.961024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +15 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.881526 573.711024 496.429134 558.711024 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +16 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 536.961024 504.679134 504.261024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +17 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 146.805601 529.011024 197.845152 510.261024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +18 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.893245 529.011024 496.429134 514.011024 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +19 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 492.261024 504.679134 459.561024 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +20 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 488.809749 484.311024 496.429134 469.311024 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +21 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 447.561024 504.679134 414.861024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +22 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 234.738707 439.611024 313.229430 420.861024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +23 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 489.877620 439.611024 496.429134 424.611024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-cluster.yml-configuration) +>> +endobj +24 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 402.861024 504.679134 370.161024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +25 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 484.970394 394.911024 496.429134 379.911024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +26 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 76.423228 358.161024 504.679134 325.461024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +27 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 210.896178 350.211024 288.867613 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +28 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 481.993831 350.211024 496.429134 335.211024 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +29 0 obj +<< +/Filter /FlateDecode +/Length 4947 +>> +stream +x]K$qׯ#6l/5fJ#EV fFfUuw;`DazQdw<ְ8y$ 2r 0jX\\FlH%@ 55, 0A[.awaeB@Xs^ p,JM&K԰ wmFT^lǕ'cѰ wPy p5,OXQk=Vjܵ p}Cа0Y4`}Aꪼ2 Xr`L4!ɠհ w "p5,]Ch{TtiX 3FÂb34,@]~3kXP~[?^~3?)k], _Nh&]o%z[Y:&Izd`'uG3]H~ztBӹaیKٍ.칎fQxJBuԹsti>S57q|SXqLDh_@N|sBs5y:w[ v'8Z.,3r\;\@[lK6@r䂠7ŌS/_Tc)3\U/'^#ׁ^LK9>/0(ɻȟubwXvmò4݇buKY0nnfŨGZxhjv@vH9taK Sæ^c>={ -=s挶lNGM$G$`~>je9зª=W#0j|;`Cx6__ }/]+5a{tax(V]oנ_ =|z7|5ѷ|{=bwх&|5ix%-*/?/?A :dLO nB8fyadͿۘyO9<1e7,ןqA`&sG_?(qI^lzY2W|C/rK|gT[MFBv%V}T5՘}ZtXb^|y%?Ycw|7;-?5N2wRץj-վ5E_z>VZ=-Ɯ7 ~/84߬꫍kϏ;Tgdk՘ +zmӡ?tŦ'l6|ӕuz_g\Af4S<Ύhh(淈ITiAMc9m16&9$3ṡ#z٩%U-<6fX j]>+m⸉ϡ/5^2[ֈU<"[O +xW& < 5js;sY;kώ6qJ9Zw|޺ռ/&{ >SG֖Cŵzǭ.?ظe_֡FMP[$߷n9Ĝ{ĪZCuQfsxc3>?.;_?8}n}E%b$_f+%pbhͷJ-{t>aպouO6K.Go?mx%s_/G/}- +r/t0Dn =ȣFO_Pο_h{9X`8Iuh )n)21"+nlTI.P9_P~7O8~LlhPE]dO`_ a&"a@T^r>sTbL%3fغo<8DydJ9̺g*8U:NyWXh<ݫnVMխZYmjsVMMࣤ?_MlgA-i-" y +Jﲆ{7=b=|hQ<\I˞0 ZL$oA9DM/Κd3aDU%>S!' +Ɂ-BJȣo^9^x[j<6 Zx}kMݕn|F"A1D=&r61sCb&~ ObLlJ&_ȯ녽_^Q_T O;9.|$zh;M6 bmuڀt +¶2x6)kqCz|B=8vWssom>}693:_[/ l9|e^<͒So|fG/*kVx:# -%}J5gtL-UfwMk uC_ŵNylAayC2֢7x7F~aONk砋֙5}lq+tKҥ/,GyA~"B3*%_s;4<~X +Hҟ1~zZMɍ?aio8{MLo817&s '>+X 'rGګF!wk7f4v4;ƛ}Kߣ=V7$p|(pk6}徨҉ R9󻢲d{k9J#sK/Nf[~}9BS%MLή^to%LO[j,.'L+tOx|0TkPo7 ivn+D֛.d~+pr*!VAIwA [u5NlKY:%#izU.*zkeyTiPGPBw&En7bDm\夎[F~kT9^])hל1:#GƚHn'^NZ%v2:t0$z!ҩ)WW4+?ߠ"4*# / +W}IG'IzlC,>V˦rVfgmpRcj1m˺FfiX)*iR:j0mhE&cΫ$qO75}\x6Z9si]LbN0zɵZ:K믽ȴri^?ڎvewd3':~];5lr%㷳Jle#w}lq^St`#mCP۸ٵu τeȼ56}]jwh5B\}I> }IR(.ńk6 )'igI\B|;2+EWl ) (JEX+ *06ө~e[s/jv5Y^ԞoMN/Zp!sTPsmTiäuhp&1Ur[ulqVZOѩ2*͉AF%nƲܺnɷ(tN:G^2+(nT#}mqڞ35*{MGڨJ_zG!/*OőqlO2٣&Yt` ![FmŨ&=j+r.oߧf~~2;qsZP +endstream +endobj +30 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 29 0 R +/Resources 4 0 R +/Annots [ 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +31 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 445.281496 409.271317 430.281496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf) +>> +>> +endobj +32 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 418.281496 162.214732 403.281496 ] +/BS << +/W 0 +>> +/Dest (overview) +>> +endobj +33 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 403.281496 332.953990 388.281496 ] +/BS << +/W 0 +>> +/Dest (configure-kernel-runtime-parameters) +>> +endobj +34 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 386.659914 295.486949 371.659914 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +35 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 169.605601 388.281496 200.056773 369.531496 ] +/BS << +/W 0 +>> +/Dest (configure-etcd-user-and-group) +>> +endobj +36 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 367.909914 319.724254 352.909914 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +37 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 169.605601 369.531496 220.645152 350.781496 ] +/BS << +/W 0 +>> +/Dest (configure-default-service-account) +>> +endobj +38 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 350.781496 255.796275 335.781496 ] +/BS << +/W 0 +>> +/Dest (configure-network-policy) +>> +endobj +39 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 317.031496 400.593883 302.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-rke-template-configuration) +>> +endobj +40 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 107.173228 302.031496 397.449596 287.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +41 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 233.696178 302.031496 311.667613 287.031496 ] +/BS << +/W 0 +>> +/Dest (reference-hardened-cloud-config-configuration) +>> +endobj +42 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 293.575760 126.231496 442.798661 111.231496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +43 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 111.231496 285.368241 96.231496 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) +>> +>> +endobj +44 0 obj +<< +/Filter /FlateDecode +/Length 5107 +>> +stream +x\Y%7~?<#㥼I DEbar Bw>_u{݉h2m\Ujiwşw+L)5':_>u&G;6K7dzMt5xĄMt~9Ky?9sǝ5y(\rQih.(M1}LJSrKUk1cSTKԚy_6eMlHkƬ49 >Vm#(xE ygRmm.{-2贶jRJhm^bNk%:" +%km ^|AkC:Ui+U6buZ[ &BUْ˱hb jmΙ jvKm%뵶^6D ezE}& @^lN`% |Ά' | + |r  5֡; /UKaA7hXx4,@[hXdӰ oɺaAMaA→HÂȅ)U 07;5,]laAꆘ$ p7p7T X  pkXaҰb|)VbI e=4, ஏX湁>Zaw=a  w!Q V{a3a*ܟVƕ4,]W>!qeBƥT5,]8aA>x5,]ੵ6jX0hXfmZ X [$j[60$aXġ$.{հ wm AÂܵGm/x נ VV@ + k4wUÂeaALE0h{ R!SsNjцOmKQÂlA, P& XjѰ {װ {AD:Djz^`.j~@@2S*9&c֖)paAdȥLװo8\Ұl͑l L̵6^dkXHmiXPOJY`'!SWffK ]Xl:tVvc6pyp[3s,kH~ṋQ|7/H9߯__bO)w'7"5/_ Jo_lkUkEqMAqD<6:&a4cy a_c1QIqU1Y)`[ZD[I)xʒ>B4`%5~jElk mwyA%NR8:x+SaY2[/^-ݴj뙽)BF!7f YGY\Abqwb˴ ֚Dw|m)t_;W7)woo6>ܴ-j&bme!s&ϋ [MǹVznʯp$αv= 9trkPN;pWY|u_CmE_]`Kq |Wy1zيk-]쳮b!fw+/ۯ~Lw9̣fs=4]VѶǦ--tu`W=Pn`n9HÃj+?Ȋ4kxC< 1H [SGpODT@< 1%SLG{˵QԂbE8݀JpLunب Ǡ埄֘ibHE>U}^&ncj7r|襝޾?OoR~>+ľ_n5}/& IdL)kۦc^tKs#?Rf2;`Z +?4YssOy6@/sm޹E[jm}v}`kcW9N>K|r+J#sY*p,c/gL1n}k_{[p8a3LY'dלD]K!C|} #_%SXeP>oEwq^/YUǡqkeIP@3`>}޸$n}EbxF>Puɸt!~l PWpݯaDvHi|qcX/~۴u{;bOE:J ec}&IWk2*7^,J6 䎲;R :tC;(T`U TkEICl"MI|Rl~]{1=RXh;iDzg +|~'UnU1 q(:]l92#W#nZGcg"ĔtgkRB09U-nJ[v+5:5Qub7Gjn(*dzn8+7.|E=gTx7mxtvEis_ +d|_==߅SrPd[!F^ hyDM7w*GK:_l +^•->c-ziStݮ,mC=AYKc]+,m#!jSS< ;Q:qA:ʕ\`+[A7cзG)s݉?E7N\9󔳮&lk;Ҫ̊>nƝ{>o +bhYw-ׄ, ]U߅/> ۔9DJHjt39nGnIIVXU¬h[ǭOIoͳs>fᴌ}.o_lntq|VZ+VB88z//G t2B'OhCZo[FQFJ@7vek/D\R:ͽ3X}v߷;\(a=ѱrg1^<ːbȾ>2T3xmN\pm{ݣQՏYw;]󟴼tX/0˯Eb&n!Wz.2Ȯc7ŃEݿ'DdRpQم\|F +ӎ m?g}%s>ލ_G|:BDd^5nńv+1uAw8;%IGMΏO ѥIK9~B {JItvZLAΡzRHB|gev5cc*ݐhW} +rRkš<*k풟LSe^]D-7*ܒkxi7@"8/ +Ibr^&Lf +TAeY~t}y5'y+$IOuHqp*yج":~q؆*D&: ؒݰAfX)3&9S~ِ'qlhd scIN;_$9;w+l/c=MI&d8(Lїw@'bf97q/7Crci2:r➯':ݿαqoZd|Ǫ~_>[wSꋤ1uN e^E}N {a9skЂ6Fn('NLŀ ls)n],ˊ*> +endobj +46 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 191.048717 658.622079 244.661998 643.622079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/admin-settings/pod-security-policies/) +>> +>> +endobj +47 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 439.875057 101.433071 421.125057 ] +/BS << +/W 0 +>> +/Dest (cb1-1) +>> +endobj +48 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.928036 99.933071 402.178036 ] +/BS << +/W 0 +>> +/Dest (cb1-2) +>> +endobj +49 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.981014 99.933071 383.231014 ] +/BS << +/W 0 +>> +/Dest (cb1-3) +>> +endobj +50 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 383.033993 99.933071 364.283993 ] +/BS << +/W 0 +>> +/Dest (cb1-4) +>> +endobj +51 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 364.086971 99.933071 345.336971 ] +/BS << +/W 0 +>> +/Dest (cb1-5) +>> +endobj +52 0 obj +<< +/Filter /FlateDecode +/Length 4930 +>> +stream +x]K$9nDs0l/<^]`COkFYQzD33݀P HJhwOfgr.)˯kRWKl.*M,'\9\%J)^.]m븫7DodRNUV&%ŠKX#$|d%%12 N1|r +!),g!֪<b+<Lң\|Qy <#21 Nc Y1d : KpVA4^,ɪXaw=a  w!A V{ ɂY*pb XB%kXKT3s,(//+ecM? xej{\Wc∄s !`q]t!n˵q[!;MHƊ*uI֡#/yjYGS{һkvxhIJ'IbRq 4՞Jd}λ5݀ p^ SR{һkvx2?M+G^GG?_YIfd|"rDhu#_Aʄo\wYyeW6k[9-ˣ_?0߃,;E3AĖKjt RPͶ;zAvc9U.~ʯ0E"L㍀avɦ.C Alq9vd +_$l"d2X䘸eCKL@XiZvClJQ&ŇcR8h d1w7u-o1,yehz;ߜ. k,I#,QM#٨:7J뢒~(tye]eU_?TIu\&N=2Tle2%v~N3^r~q LP'4f/yA?Wk7"p7:}NAwyZӻۍ.]5a +49CdtRT''nSsN2t:ۗLSSTZr!d_e:WۙZ9 =ž p+h_i p2t~qg1 CuڔW/@9MAZjX w?7!;1]@-Y5K-uC䭉Tc۬26>Y`mۼ}Y g tYxMn6r)M?bzcAx{e异"C^GU y-9Z/$E@G*_z8ea7"'_-{:$v\ sbQ(nSU q4ѫW(]?oaˀ"[Gr =/M܃;Y:9:mwZwɡ Lm';~""?ӆΌmkÝ#pw#ݤHvl%9:W1)!''eCt2'aV2C'ģeX/bśkѩSszxD#e#xRO??O:i뫹Lu'N.)UyL6M) +*gWom?rzSgr1r]hC]) +݇ +6Pg|&ŗY +ntF3j柲7?=7[ޯNzmMf߲b^n|"56|WguSrGڱ~פǻ/[{v6}̰ 66l?R1|<م_\ǹ?o^璼"ߣm^58Jsf>.459vHLa'*z&8 ]6_0}3c[uMNF=ĘQo) &X ~өʍu$OzƎl6Dz{^" ,dyl7/=' iGӷdo*$9 YU©=ɐ:(@&'?2[l['|3h+=:@*;leB(%HsQjcTn}R.*ȅuțM icrbiam;85pN^t6n9gr<3&|3Pv?]yssTus; %G{NvD^AA'gyOhyϱ[s:p +h)]A/􇊻>,$[{|vOm#b4)3yDE[ cPʯ~uV;o+4di іޭR}jv{uz NJRوUrBdKuU!zf}᯽+UZ:0\eovwױBfa~-v=Sk< T% +8|C=Q?jNէꗎ"jFw$[Vz(!6A \v48*>$K0HSw}1]uq4,?E|[STu5մm$TJ>N +i`v4j~siĽ\iE-JTUKe:x2JBiXj_dy,C0 \8oa` f"Mvr^˪*LF7_*B +/II,5F'27;y;갦i%K`tlt؆:l%nu,ӱr&&MmCr>UE7{r6SqyqF|d1:d& 0F*֎Nr}L/^YoP煯?W,~ێc<{2yk>IcOyAvy UIu;tA]0t8}7]hLC|i2_:6a/nN%@M*\̷goJx2%TgosW&ӒuqW20MNg]70cT_ jŪ%sWSߺ/&z7 tsf/(f +endstream +endobj +53 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 52 0 R +/Resources 4 0 R +/Annots [ 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +54 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 751.923057 101.433071 733.173057 ] +/BS << +/W 0 +>> +/Dest (cb2-1) +>> +endobj +55 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 732.976036 99.933071 714.226036 ] +/BS << +/W 0 +>> +/Dest (cb2-2) +>> +endobj +56 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 653.081993 101.433071 634.331993 ] +/BS << +/W 0 +>> +/Dest (cb3-1) +>> +endobj +57 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.134971 99.933071 615.384971 ] +/BS << +/W 0 +>> +/Dest (cb3-2) +>> +endobj +58 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 615.187950 99.933071 596.437950 ] +/BS << +/W 0 +>> +/Dest (cb3-3) +>> +endobj +59 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 596.240928 99.933071 577.490928 ] +/BS << +/W 0 +>> +/Dest (cb3-4) +>> +endobj +60 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 280.647907 101.433071 261.897907 ] +/BS << +/W 0 +>> +/Dest (cb4-1) +>> +endobj +61 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 215.950885 101.433071 197.200885 ] +/BS << +/W 0 +>> +/Dest (cb5-1) +>> +endobj +62 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 197.003864 99.933071 178.253864 ] +/BS << +/W 0 +>> +/Dest (cb5-2) +>> +endobj +63 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 178.056842 99.933071 159.306842 ] +/BS << +/W 0 +>> +/Dest (cb5-3) +>> +endobj +64 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.109821 99.933071 140.359821 ] +/BS << +/W 0 +>> +/Dest (cb5-4) +>> +endobj +65 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.162799 99.933071 121.412799 ] +/BS << +/W 0 +>> +/Dest (cb5-5) +>> +endobj +66 0 obj +<< +/Filter /FlateDecode +/Length 4895 +>> +stream +x\[$~_Qφ1 ֻͮt9cB"34]RE(q3ԜzŚ-kgl?ǫMt5x !\v_CyuvzSk.^YL.9ۨ*XǤ3Xb bL 1 y_V GV>;X՘ykUD+<MғΤR}Uy< L.:WMJ)G%V4^,YY(d )XY|Ae⡝ +dwYlN`b-D*gK.GxΙ *#ʃ,0>A øaP/P/PA_T:Ӏ X)iHd!Dʃ,CaASа m ޢaAܒNÂ%뒆 1J"  T5,԰ tY 1y `7PIn g5, n X  pa5,U 0iX_1aw}aw}F +Py K27pG5, '4,U. $djX|`2QhX")1 2ԤaAj\ƕKjXHTAÂ| kX. SkhXP(.5,@` Ty0aÛa6?lb KaA)EÂR ^&7BT|T V +4,@\~hXP~[<%nkHT,%ʃ,($7N/A_IÂ7(3DE +7. +dx]TI`V[ǫtfgQ;[Ֆ"[eg`GR;˒Ԯ*Ϊm E=FLXOE9d^dEX瘧;- syU?(8^6܂Q8T~hǭm7 ^2L[m.͂Bҥ}BڣY*$H.~߿zӯH1ZK~7v+~7U̕9mS;7~w`bSWn,t3&+To[cvC>U؉ +(-,UÀRfwoO]18B_ѭaѡsNCW.Y>>pM4'_ iyucĵMq4wk|AkВז/.A=Փ3=/ @ -bm`8q?OleYbHwc?'.K5n*%:'݈e=+!񓍎аҏ=Ǒ_u18t!yQy7#0 +kfZ7/\ϳ+_]1K|zWw{TȌaǮ<$O +Spl16`V.拫c\ԑԶ,Np|*ƺyqߝ9]‾ݽ֜[)ݓwO7oms2}~E_9.Wi-]y=~}(qmr,Q.<i9_~+CXg@>)\5 p>r|`wrwSZ]?sg)/DM:ltiڿIJ~ٹJ.Dⷤws7fAU@.&.phMM6 UxߵCwQ7S_RX׋4;8J +`_*G9{e=o{d-۰ۣ>WYĺݟϯ(MHѕ'/Xьf + 9ZwbԊRG@PMzO더0 0j ?mp||#ύH QMx +B6n +ಛ.eΕ?mOxe?̕P.$F7 +YN}!ת UP4.޴g궇TRܭq`ݮz=cW֮ #~r=/Lzd.>սCy(Gm2ںX=S!n7nBcykF\!Ҝ'V"lҧIIq|q m[ O:߮ +B;_zTgq?J? !jUΧd|}|u{'q)u,Xc{}I񛎥97Q s#[l꺻xw{t$[9x'#㯎S=6zo\>7OHtOuH䩇OV(걡]zL{=>kW)Lݮi +ӷ6~w7mN49OuX} +KlZx7k_}z*/{ ;M^a`iȇ1rf"VxKڬ\b*mCy֌_\P\|_4b|w֦9cPp&o]Oj^ЭrqFB'E̩&=_]^н?;N=YE>Tߙ󙺋N{zv{MLmz^Wvo7VMO +쾣tU~¦ǹ^{Id7pOU1xo/zmK>Cy ?鞢SW>8}gQo1kz 8?+e~'= ܘQplw;{z{&\cn<\kF}ΛOto;K]`oEJkkUddow=|)kwiNvV/ऽyLRлC{nE e ֗r#vŸX"5xʃP?t so\6o*?ӧvЂjgаB]7OM0 p :j?O!.ylqX*Z(CWh7`S*bĆsKNlnk[v4"q.1+glj(ļ\Iͥ +i8@ETFr}y4/±9[%IzCyPy} G3ʩ;B8919yѺGv_EN=:}P$u,tjhi{8rNAީ1WF3Cc9>*e[OiD14iceJ밮j)bR&5UJ:70 +(9y%BKr<3tڴv϶W Y9,}$vvV:o!Q >Aے0~hi{y=y%P6;.1CL?V]p&uˮom[Esࢷ'uz׳nZ'Ƥ +endstream +endobj +67 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 66 0 R +/Resources 4 0 R +/Annots [ 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +68 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 748.173057 101.433071 729.423057 ] +/BS << +/W 0 +>> +/Dest (cb6-1) +>> +endobj +69 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 729.226036 99.933071 710.476036 ] +/BS << +/W 0 +>> +/Dest (cb6-2) +>> +endobj +70 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 710.279014 99.933071 691.529014 ] +/BS << +/W 0 +>> +/Dest (cb6-3) +>> +endobj +71 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 672.384971 99.933071 653.634971 ] +/BS << +/W 0 +>> +/Dest (cb6-4) +>> +endobj +72 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 634.490928 99.933071 615.740928 ] +/BS << +/W 0 +>> +/Dest (cb6-5) +>> +endobj +73 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 287.395585 321.344928 323.513505 306.344928 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://github.com/projectcalico/canal) +>> +>> +endobj +74 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 291.344928 111.294999 276.344928 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) +>> +>> +endobj +75 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 308.171464 172.723346 401.561844 157.723346 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (https://kubernetes.io/docs/concepts/services-networking/network-policies/) +>> +>> +endobj +76 0 obj +<< +/Filter /FlateDecode +/Length 5546 +>> +stream +x]K9rׯC2/`0x<^c@CFŢe`}L>23Ju &x| l{6RϗϧNfOybuSƿp!g!Pb. mnǟO_:즜R4JQFy?|P9kE`Gv/`sZ`Rq/`EZذGa1j12)ZQfʈz)Vgc2^e6ZxaJQ+  I+A:Y)K֕2bZYĬeӾ?Dd2k'$ %9jxdVFW+Nx))Ļɐ$f4-}^^;+B *tF#VlOW0uGr.$UΗ/ofZ!UNVx)V*Ԙ-eSy+ĵ!cnB% ^1QfKw$:um> " iOWԕn_} IuOG8l$:U:c H6 +ߢ?vy՟G&+ +:W"&7(N)!QFx*{+]Lc]L*Wz n%Y 켐^1ـ  2w?O~@wNC .]>wr3E$2q{#A)+r]V9?E +39Ime'dv;,vĸr׻?q!Q]h/f#hO8&Φdvv@SF-W\^)4Ƶ]BZZ?q߶˫ř}ݲd a᱈"-~W)}./Eq~?^ޯwV2đHM21jj ru~ + ̚Z7vSU`9d:-Ư`&]2QYmiwUy;Ѱujb/XGvozjH0ƻc%L/FߏP^#}׼0^vR*oGT&e *p^R$Wl}1B%2m-W9KO1WBk˪G{mq tGȞ4|W$[P/ǫFw+kN/BYx|W|_7N/{WSrѼ:׍>}tf9{䋁 +°԰V~,ke*,+Y~iX JsNtj6 ɾgh^|vY]Y/>^(-Rp߭j固E˂ckK*6EV5`b/_<)6y> In6e18u5c'vY>L\3Ole[h5Y7Sz㼆߬ya|`d}>TXڄHu$L&$}uB݋P9}}/^˰?D A0K0:=,PϫflDܗgwe<,nCjOע A4x|?pQ_!u/ LEA-:/ge#4b Y+{Cnw__].ۮpXN+n )dي)c‡I ˱1;Mu!-mv?S9!ݒ~y{ [pUZ kz9x/rIS/=,mgˢ֯#k _'#^Uب5]M_2_?73t\37iA!1|:Eeǣ!N9pZ; |D< &K#OY>qgc,X9֍xXxG%wW^_mw _6.Iq;c"8cTצݑ"Lmh'U8RDDzį~qOf)P)fGۓe}6CO)8aOПC0F\t)|[u^{6~\dc/^J iO/3T^kN'}&l%5S!KfTBjۋybf2}6|h'+mLE؍u)99_G9y]vrJ/=$u +1LmШEVA|o^ݎ„RAu1"wÛ?aLZW|wM{J`w›njWDYvh$[|˿8R#& +^PQ~M]c6jFPք +*[@85 mlh#1DYZG@ "FrE(Rw%A}Y}NWX79&,99[<_iFF>+۫y|5aϭ4{N=LYU^w +4vWp 4] gM|m,?\畗G~AY>];,_WP"8:;*z^=ۗk=\5ʚi;fF x\} gFNO1^MOZ'J TrUgHC`fnhKgHm+9ʩmֵP2?ueC{(a|-ϖnmauٹx7phIF(s&i1BzS?HF#Ǜ9|Cur~)dYߒOr~:+dd!.ŶQ]N)o$?'ԓ _FZMεcӦns +5ݓdA&ZBc`xHd]'gY.s9QtvP}A-Y׵*] ֕FSQ}})1i2[59?t&jHܞ9t9-؞JjtS.TJp} _a$@յIݸr*OW4t{T9dkV(PU\Xn&%w"k!P5 wvGE16eQmO7:pӚ aT,nsvO8ywkغ"#.t'Y~7H%6dZC儙IuӁ>iV:}@vtA2b dV7}o!9r%H62CyhwhQnQيM1ȱ&zGU5 aR/>̎MWZy4ތ Eo+Qbj/,Bmި#PT*a}*GUjm{Ԃ=h5j~+mi(\f*+OaVR8R-ԿV{Vڭ#^@~4'[,Zk7*'}:ڞH葩/¿/uBY{-361PiGw0bDNÔunqg211V~;3 +qTyzlWzLN?3BDN*oC# zh:cVS'zB +endstream +endobj +77 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 76 0 R +/Resources 4 0 R +/Annots [ 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +78 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 715.084475 101.433071 696.334475 ] +/BS << +/W 0 +>> +/Dest (cb7-1) +>> +endobj +79 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 696.137453 99.933071 677.387453 ] +/BS << +/W 0 +>> +/Dest (cb7-2) +>> +endobj +80 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 677.190432 99.933071 658.440432 ] +/BS << +/W 0 +>> +/Dest (cb7-3) +>> +endobj +81 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 658.243410 99.933071 639.493410 ] +/BS << +/W 0 +>> +/Dest (cb7-4) +>> +endobj +82 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 639.296389 99.933071 620.546389 ] +/BS << +/W 0 +>> +/Dest (cb7-5) +>> +endobj +83 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 620.349367 99.933071 601.599367 ] +/BS << +/W 0 +>> +/Dest (cb7-6) +>> +endobj +84 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 601.402346 99.933071 582.652346 ] +/BS << +/W 0 +>> +/Dest (cb7-7) +>> +endobj +85 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 582.455324 99.933071 563.705324 ] +/BS << +/W 0 +>> +/Dest (cb7-8) +>> +endobj +86 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 563.508303 99.933071 544.758303 ] +/BS << +/W 0 +>> +/Dest (cb7-9) +>> +endobj +87 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 544.561281 99.933071 525.811281 ] +/BS << +/W 0 +>> +/Dest (cb7-10) +>> +endobj +88 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 525.614260 99.933071 506.864260 ] +/BS << +/W 0 +>> +/Dest (cb7-11) +>> +endobj +89 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 506.667238 99.933071 487.917238 ] +/BS << +/W 0 +>> +/Dest (cb7-12) +>> +endobj +90 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 487.720217 99.933071 468.970217 ] +/BS << +/W 0 +>> +/Dest (cb7-13) +>> +endobj +91 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 468.773195 99.933071 450.023195 ] +/BS << +/W 0 +>> +/Dest (cb7-14) +>> +endobj +92 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 370.326174 101.433071 351.576174 ] +/BS << +/W 0 +>> +/Dest (cb8-1) +>> +endobj +93 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 351.379152 99.933071 332.629152 ] +/BS << +/W 0 +>> +/Dest (cb8-2) +>> +endobj +94 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 332.432131 99.933071 313.682131 ] +/BS << +/W 0 +>> +/Dest (cb8-3) +>> +endobj +95 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 294.538088 99.933071 275.788088 ] +/BS << +/W 0 +>> +/Dest (cb8-4) +>> +endobj +96 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 275.591066 99.933071 256.841066 ] +/BS << +/W 0 +>> +/Dest (cb8-5) +>> +endobj +97 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 298.350419 124.541066 391.740800 109.541066 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/installation/) +>> +>> +endobj +98 0 obj +<< +/Filter /FlateDecode +/Length 5338 +>> +stream +x]]$;r}_Q WW/0 6 |0vfc}P>232kN3ݕ!)8 +)*sW"R1UJEI MQyCׯ,pQm ~.쯗??Ks*`3'S1ŨW1Z`n1g) fHIfPN^Jdmp&ea!) f죐d40Vk1 h"g4U@)RYLH3JiΩx#eBIJ#6R-i) KQJ 4bStRZ-[$ҲS>'"1-#MiV{sZJ3Fy`Ӊi(tRB-A,ﴕl!Hi bJZnO '5LAW4IKȳ1>c&rm :y2įcO.F>]FxghlzC!$0~z/_P/b4&_3ncⳝ|$>Ϻp\S +sY|hmY?}.mv"mQn?i6oڮ !iN ^Z>4vyu@Os+~?Ϙq" E^$LBį083Ɂ_ +3n ,!O빝 >OmZۺ̟+ o_ e֍:ͻn#a"( jY +:V>SG0aaqnٟۈ6@>v]?#Z!it>4yJy"]yxy" xOK #Z8썼 + ̈ҥ~ᔧUhM7-ӧ.,T9UqYf+kԙ 2lH;6i2eua,{@/19LxQ9]a79<xa DnȾ4?ʼ ǃVN<5'u;c_}ᔺ?~YupIZ6ʼgݕ}i/'yj-*wIX\к) xq9.Đ;)4aEoU.>虢_Tonszޞƕi5<< 1lX+8F\ qZEe4;{Y:?/yQ9nk:+i1YN;u +dVrٴzǻYp) P(`9&o2O(v.w6AkJƮ4 :VC0 Őg0X.l˖R<;kcj[Q(g"9&D!,;tD,{`;o[So}L?/ N;`a@|+s'u#dG,x'<ums]bs?'_7a1A;s*OcoZ:5%ygpz[5> ͏5Y/ihe_?ҙ_AfegJWtq6ż(wվG3N;VŬҲN~a]w=c8<1Yu9tjp:*tB\n)TiztFD}uveH]U|zDw{fC +V+/%AX[^~3 (3=~ +GSΓ:"-{hQɂд$}͡JN'=Z1uO @>hs1Ѻ90cKi5 7&G;<weE%VT<M } 03KIjI^PPW|zUfa$ʻ!Cl`č ߅X*o4i}ykɼ<-+)CɋYT^ilm8^F}Mb L#Z7)p:r.3txJ~x?8PtH3@4^qNFпǀ|#2y%G@<<@l$ƇoE%?ćam8A7gQ[Pv9^D`7ޢNܬJ +z< 7pZ*tV('o'uIsА{O[Vq\2&/a:b#3AZ\B,e}Rye#ݷ֢R-H}Ix}jQ- + 2BgݞSyy~cV0ZTR`zr_v+~8-B7g 4@pBTss:D]hQI jǧ@)!h?B[{Jv(/G(N:4ʚj> @h{rmYpV1jyUc^ Z*Lrr; :+/m  )!HmԶ!EQl?<<pZT2p}N}nv}f>ivVjƋ2􀝨1O+O<")weE%jk뭮灴[Ǟ[ +w"\(n\9EgZ'ul|ԃ2~Gj*C3P#T'?uRK6>f2>ytd?OA07Ev*GyEJ̑46q{պUԢjZdn0*79[P'AtŸt-Й-}5>} +$jr'n1\o=[UsmnJKYiYѮ~\@k؍vCG!\(on(xҘjS5U&e) 5HW¾F塱I-QHQv c{fL-wkthARC#451SXmƕPW#& ʯ q7WUwиuㆿ0_2ZO.Ս +V 솁kWom۷d҈{R9;8_3FGwSܧqqB`Oj.eiסH\q>#절P\nLXIkzƮG&Fiԇٱ*+w1dAƋ`2cya`wlrFM:Jۍ,u2,/ۘʤ:ooV|ϵ F-hq1bt6gcTeJ@2]eXm +ZmrIlb.~ֈ~앰EK@~sw{K&AF&UٶnZ]Gp =2]or~}gtKOY0 j2|6e*[BY4,i> +endobj +100 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 289.074296 784.370079 316.109452 769.370079 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/config-options/nodes/) +>> +>> +endobj +101 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 650.584475 101.433071 631.834475 ] +/BS << +/W 0 +>> +/Dest (cb9-1) +>> +endobj +102 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 612.690432 99.933071 593.940432 ] +/BS << +/W 0 +>> +/Dest (cb9-2) +>> +endobj +103 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 574.796389 99.933071 556.046389 ] +/BS << +/W 0 +>> +/Dest (cb9-3) +>> +endobj +104 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 555.849367 99.933071 537.099367 ] +/BS << +/W 0 +>> +/Dest (cb9-4) +>> +endobj +105 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 536.902346 99.933071 518.152346 ] +/BS << +/W 0 +>> +/Dest (cb9-5) +>> +endobj +106 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 499.008303 99.933071 480.258303 ] +/BS << +/W 0 +>> +/Dest (cb9-6) +>> +endobj +107 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 480.061281 99.933071 461.311281 ] +/BS << +/W 0 +>> +/Dest (cb9-7) +>> +endobj +108 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 461.114260 99.933071 442.364260 ] +/BS << +/W 0 +>> +/Dest (cb9-8) +>> +endobj +109 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 442.167238 99.933071 423.417238 ] +/BS << +/W 0 +>> +/Dest (cb9-9) +>> +endobj +110 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 423.220217 99.933071 404.470217 ] +/BS << +/W 0 +>> +/Dest (cb9-10) +>> +endobj +111 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 404.273195 99.933071 385.523195 ] +/BS << +/W 0 +>> +/Dest (cb9-11) +>> +endobj +112 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 385.326174 99.933071 366.576174 ] +/BS << +/W 0 +>> +/Dest (cb9-12) +>> +endobj +113 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 366.379152 99.933071 347.629152 ] +/BS << +/W 0 +>> +/Dest (cb9-13) +>> +endobj +114 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 347.432131 99.933071 328.682131 ] +/BS << +/W 0 +>> +/Dest (cb9-14) +>> +endobj +115 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 328.485109 99.933071 309.735109 ] +/BS << +/W 0 +>> +/Dest (cb9-15) +>> +endobj +116 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 309.538088 99.933071 290.788088 ] +/BS << +/W 0 +>> +/Dest (cb9-16) +>> +endobj +117 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 290.591066 99.933071 271.841066 ] +/BS << +/W 0 +>> +/Dest (cb9-17) +>> +endobj +118 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 271.644045 99.933071 252.894045 ] +/BS << +/W 0 +>> +/Dest (cb9-18) +>> +endobj +119 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 252.697023 99.933071 233.947023 ] +/BS << +/W 0 +>> +/Dest (cb9-19) +>> +endobj +120 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 233.750002 99.933071 215.000002 ] +/BS << +/W 0 +>> +/Dest (cb9-20) +>> +endobj +121 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 214.802980 99.933071 196.052980 ] +/BS << +/W 0 +>> +/Dest (cb9-21) +>> +endobj +122 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 195.855959 99.933071 177.105959 ] +/BS << +/W 0 +>> +/Dest (cb9-22) +>> +endobj +123 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 176.908937 99.933071 158.158937 ] +/BS << +/W 0 +>> +/Dest (cb9-23) +>> +endobj +124 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 157.961916 99.933071 139.211916 ] +/BS << +/W 0 +>> +/Dest (cb9-24) +>> +endobj +125 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 139.014895 99.933071 120.264895 ] +/BS << +/W 0 +>> +/Dest (cb9-25) +>> +endobj +126 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 120.067873 99.933071 101.317873 ] +/BS << +/W 0 +>> +/Dest (cb9-26) +>> +endobj +127 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 101.120852 99.933071 82.370852 ] +/BS << +/W 0 +>> +/Dest (cb9-27) +>> +endobj +128 0 obj +<< +/Filter /FlateDecode +/Length 5039 +>> +stream +x]]}_ρUQ,$0$!p7C~N-YnU۳a^Wtt$˶9kDFc'3XL?_g)*orH \T1{no﵍9[sƟUTL1j/2T8A彊 QĜ%,7('/YUq*  I*aha֢h"g*уFmu:sNHIU'IGgm$/iI_ȥ(|qiQ_lNEb:Y%t%Q_tFe|ND.CSLj|rNK:c6ÈB'(,| gQ_V9B+Ŕjyt;팤H%$ +RKeK %J ؔ$+ +9J<ഁ/ueY8_,9 ؖ t68-i$.p \%.p`\I\@RsSp8J\@Rw-qw/`GLrx%. . qlJZڤIڈ txz\k+qw- q?Z/+q=tI\)D5O`+eRxI>Qhqaܢ !K\TN}& +J\!RK:YK\2H$.@|SF.+SwAKVDaDE  @J# w޳s&=d%.@^0*m zXҁwY)qA,I8[ B"c C'± j<(K$qk]ND _D _2H\@e[E|A(qLL$qA1 Vu :%.Bs)0%.+N$. f"qBJ3It3Fd A Me-q"4hjIGIDAq(q f`JQ_@x%.MLsD|q$.Ht3I\|J\l|3J\5|A'qAAq,qh:%.&aiIKo& Әob'7G" ,[p`'I$qAIo"7\$L8|4 ^3$hPGl 4*ks$qnbfj +ⲁ"OU"bf|Â9R)v]?N{O_~5wxby،]t6j!|ƆyqҀE7v6/f2 yV[!HcO ;MSTĹ@@)-s'^M¿p0oDsBZ}~?~rN?<96уVui_OE)̿iEv{;4s<ߧ; 1<Mi|b4EC)`^.\4}i~N݇5ΒWyi@S|1xx"AcuΏ*c|N8lAA%|$ ɝHLA&f: ;˧_7z^u6 ۦ{ӄ J|)rT&%Bјq@l3zѪ /οTv&]|?Wmߝ"af\LtۜSuw2&[9"YWlUJT4YO)72]ۀkYnɸz{=%enS;Fo2ژagyB+\ї4otSm-[@lxob$ 5PSmm1_iJPI,t>lo- 6- Zxqtaa8|$xJ +x_d(u>mRg=Dgd n",i- I!WqUWqw]2ދ=ZU!R{ |ƤL][9 xW2 c6 yF.UǺZ\c,W-w7tۼ92z73)x-n*7mȊ229x-dsJoIګ2o@pCT9PIm6G\ڴӮf9p=D_ U%pBj$P3PA`|$Γz=}[0uu4%oc6ǁn"2WBwUɴ DM/y+-P.nSdB26r%`) T-V-6!h^JS4==a Kj~u]W" }vzU&E[k;B+wS \wbm*~Po@zsSj4,}`ܞ+/}]{{}PφK#c`iKcCho UlfN^G6eQhjfoo5߿S +'RԨv[Ax8`M>Yz/ǃ𪒒7Jl?5[*ӘM5,x7(26va:kqߞD4#+}mP{}A=ΚAZƃq &̪؂<W wBp'ao?z$lHcaǑt80, νr麒R8C0+P wk>nnس|[[ퟀ47؃6ǁ4Fg~ !dpgZ"}iN ZOf6A@!h~:zzη J_u{}y`o/ &`<o mAǏo Ul'偽(#6ǁgޢ1["[tcdwۻ7Lv{a38-~A!q+7c+gy ``oIe7{p6Zm9+7+y3h}]8)?"9N;~fyͺnPeO,lޟ=Mo]Z5z(xk?]8m]hC|Vdl1G*xGHrܯ;ߦ]nl4+%8|>{[[M] v2_KaY>UGB(qx UG .*݆c3wguL&`AsK!fql^.)+ &~_Wooc8HĖA.x|Mӵh-mӵY3M÷Ȳc;:o_>V7׵k?;Bw.ez}Kj/p{$8LGol +1r˺o=*GV['g36gAs|ںWm>z>!C~/車mO) ^ U%̻zvzg[P@wΏh0^m"%zZ"=w{}[Y淞cV8 %E67)ln +u!8ş;gۈ\@~^pJ?^lvڴ4ߒ˱*w$w0aLi3creS箹>f*Sžy)|`$ЋsAǟk)"͟ Ssd*|H젘󯺞@.ྨmI畞Η_/W1QvrXV,aL/ט_ؤ|+>!\NHm儋ᦘwr,B uS"kCX]o4_t#jݭMWʩJZ]eq*W/%kP'At9 t955VU +˥ r|XK4_\YRmxA6,fhW~]yslkNx9P/\}^+ty8/_Lv CK*|2L,GK%<6xH> +endobj +130 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-28) +>> +endobj +131 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-29) +>> +endobj +132 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-30) +>> +endobj +133 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-31) +>> +endobj +134 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-32) +>> +endobj +135 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-33) +>> +endobj +136 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-34) +>> +endobj +137 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-35) +>> +endobj +138 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-36) +>> +endobj +139 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-37) +>> +endobj +140 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-38) +>> +endobj +141 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-39) +>> +endobj +142 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-40) +>> +endobj +143 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-41) +>> +endobj +144 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-42) +>> +endobj +145 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-43) +>> +endobj +146 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-44) +>> +endobj +147 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-45) +>> +endobj +148 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-46) +>> +endobj +149 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-47) +>> +endobj +150 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-48) +>> +endobj +151 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-49) +>> +endobj +152 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-50) +>> +endobj +153 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-51) +>> +endobj +154 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-52) +>> +endobj +155 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-53) +>> +endobj +156 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-54) +>> +endobj +157 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-55) +>> +endobj +158 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-56) +>> +endobj +159 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-57) +>> +endobj +160 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-58) +>> +endobj +161 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-59) +>> +endobj +162 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-60) +>> +endobj +163 0 obj +<< +/Filter /FlateDecode +/Length 4884 +>> +stream +x]]8}_/haahh؁bf؇;U3,apZ̔oUVt +KGG!9lşL%E>|dM +M%V/YN&s8,J&S[TpH3s,辭9bte{iq?qu! te1:ڙIȓp-6D*8o1ݖs.c!zRp*mT8m{\i5ݏwOￗܭݟԁº :4n6;@W&;A1jqex<vmsn #cZ \|c&o304KaOܪ9-ggT,򊷆0c..XGDL2֑5nGpvk.;A-l:iһ9 u%; +eԕnX>ʛ_?_% uo!t/.H`hEb^OxKtPh͐c6/Vo>+fY'Nki +O; 0PjtnDD#x.;nslӹInQ3iU9cW=ܰ|sŗ٭CdYֲ5,[l"/)'h]~ +y>0˃.`~J]8BP;l"vKvq)0,o-+ +]pWWGF>#ZE3+< ͸~#)eeuknr'&1#P q }nc6ǁѕ[ YAQ3\l_||=ñT˹s]lky? +{>qZva8p 3pVݵ N]}nZ[4&?2_KeY/:jp[|9lIKyl`)e%y*JvUz3 Mvkk(;2X쓤p{tm8ɛ|ᙀ[U2w9N1*=ز X]dWG+Yp +bc6ǁX@Q[UE;wwÞwkoUZqvS^7fsIbgoU 'JMw@Xn (1ߑ7hs 3SA֕Vo[/m%mA/|)y.Ly&V#KjӞD[}YR[ \o4Kj0@,V#bU%U֋=YR[}YR[{+ݢw7hs<S|fRͺ/zOXcKhgXVCiӞxk][-WVi6\R9H<%o&HW|.u{nKodYޖ H*?rzk=FbE(/{mU.1oA[ײʊYuk1)%=*y)b>G p.jՅs˫y +75՛_qG0LC={/pϟYL\d/32r""88)72+^l\;[16NFb$ ڼnjwa9}VJʇz$Yaj`.1?EQ Zv˪Zz/"F"v.I +\`S?}W# ]HzX2X"+t|+!V!\N}儋C$/°ڮE,_e}YZC\u_u= ҵUʷjzd9U4ԒC"z9)l=5(^/\[R)Zn>[h=Z+ )WdS$ƈs-mp7—<BRJ+lԝ]Hԗ_U&_/TTgAJ2Mn^rm8wJ }{lBtkkNJuOHZX(O^hnוx3l,wƝ8wAo;o*|&6 sd{fN8RX N:Z;I^.Lq_N> +endobj +165 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-61) +>> +endobj +166 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-62) +>> +endobj +167 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-63) +>> +endobj +168 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-64) +>> +endobj +169 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-65) +>> +endobj +170 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-66) +>> +endobj +171 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-67) +>> +endobj +172 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-68) +>> +endobj +173 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-69) +>> +endobj +174 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-70) +>> +endobj +175 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-71) +>> +endobj +176 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-72) +>> +endobj +177 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-73) +>> +endobj +178 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-74) +>> +endobj +179 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-75) +>> +endobj +180 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-76) +>> +endobj +181 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-77) +>> +endobj +182 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-78) +>> +endobj +183 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-79) +>> +endobj +184 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-80) +>> +endobj +185 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-81) +>> +endobj +186 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-82) +>> +endobj +187 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-83) +>> +endobj +188 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-84) +>> +endobj +189 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-85) +>> +endobj +190 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-86) +>> +endobj +191 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-87) +>> +endobj +192 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-88) +>> +endobj +193 0 obj +<< +/Filter /FlateDecode +/Length 5023 +>> +stream +x]ߋ$~ +K/X` 3 w=kXEVJ̌T@ݕ!}T2;sI^~Xſb* ~R:Wb_@ɤ|׷ ~m.okw])b2)dRTPd)E!|JQtXV1Bb1A >+Eb'G1|rA WBR[AL^)sD zʼ31_Բ2VFdbbVVL1d!K(iel2”V! Ejd9V ,CXWV ieL(Y-+(9}Ld2LmZ%Ťym(jd dVF_+NJ9+&KN+ jd55 2K L3g |.S" | cIu(N%pԐda\ Pa CTаx& h˰ p˶8 xE  1ĥY”%`tOPB`8G K쬆 %ZY` L0pM0pkXa԰b|VlY%9H0p܂湁>Xaw=a  w!A V{yҰDÂuO@+rPZVKqebhXpTaA>x5,]GZpb5,] Aq4,3tղblYÂ,y @,Ӱ`l,P "phX6iXeװq 0m9`XʀAZpT4,]q$5,Qװ f6%aA,eԲhp4,HR 'ְ)TC^Â! B }dCDL.aTMNk,% RbW4,@.e2&x#ᒆe5,H`hXWdGd9Ȃ [D(sNÂ! A 2հ$Z+c+yfְ s4*jXiLHAЏ$A$?H6ekXt3kX3dkX۔|3iXP,dAħaAHa`ejXP\FYK7,Mxʼ-%L,!ZY4eoY|a Jof f DD. d7\ ȤwF p|[oH,gVW ,7K o5 I]4,sTW VQ謺l`x է~*|fNrӂݷcFw_|M+eGIL_nc(ڙȓ=<"D*8/pp>ȐXdvf;_d +4GJ_L?ސZ 0cO O|HbZT`'&^˫t4жNnxsz{+G ~??1u)V}H|k*vM3uvV\ϵǷHa;r?0  ߱[n9oo珟֖a0!occyG`A߱4bH6cWmN621XOQ4U'CV}S7zי̮c f=bp:@a5~=˒+bs="i ˊ +-;ܺ! PJo& {?21IvuPTG yLiiN&W`xgŘI +RC~fu8S/Ol"O(|<41˪՞{hݩ[)֝q?dtr<qjs?ix4ҙîg1-b*w ,&$rKc9)%F})vxFgsqJ[BqI7lbQG$yNc.leח>\֍HEx[]](E/+{ɞYs?<bxk٠3|#o.Z"jzxO6s}{^۩'3ӞI:Mdy,0RqG&9s %@INɧT[K$۸kx{- ^my&X⑺xΣ.2G"Ȫ?~<*,𾯁𹅿{T yIu?GSi4,ǧm$n7ɄƳ.޷yF/a{l=6J5Q1sÑW2ŏTntUs'5>^}_Ϥ{xNNC>f ZOG4r# BD:: C oYPf(Ɗ]@,/P[:w7s+Cϊt"s(v<؁?"hq-Oߗ*Gbn߸|nPcumkgDE^奒,i(Zy/r:CY#`{Xn=dQjHUAwlі' y!uFu-s'ȢAlA\R DHbv:R9wf0 R8իF1]φ0N0n?MYkr_tP"sS:ZJ׾_s[#|G xO5~0YN]HѺۆ!D(9ay$9or=|Ksvb*~l0Lx,cCwJY5C?D0>Q('A(?.nG}D63c=\o keZx1.h1p0r+w f{4Wb\Lr(QgI6qjl]Se:*7wt(i5A(;CͧQWˋ9 <,`4]9RGvAJ DO2sLڹęqNпR1Ib?t|T{%Y.]k +8r0]t78h0E釜=yӟa@ܮĺLRlF<\O=s^;Q +;ՙǝ=&ꄮx#nK:uy6NFr<19g*fKi@5"Z$+4\I1^dܣX[DՕ-" +n8-yb'S5);,q +n?T69"F=+[ +r9ȍ, W\*4}ݥ,[bmBj]>sйNO:_/薶7*צzh U5ԚM!^/ +[hwZSo\ [R)׋Zon-4MV+/"b+ifj戥qMk?"vKHJ` z"u6r,ԔPajV!+oPUgน,-WK'27y=H==6am`$픚U mVn:z*U<kkVau|VD[@w 94S~[9C΢=vrl֓SӸC+url%B|Zgq }u6tei</i$'QGGgן7?mC ߰uE=|Q$7Ub6s n^n`5]CPJ{bXư#fQ72u3-V,vI9NJvp2Z\kWRuq(e1o]el%dIz{U]ta\RƋ훮.*fwZV(B{z}gcBmިo=ݘPT.{wusZL%Eo5/lswʕ:Jk-*SLwQJ-XG:Ziz]]iz-Q Boi;ldVhnT^jRu^EDva ¿̝f@UO+./_#G.!m>s45JF]{: ;>uPP l_@YY`Vp/yÿy!]&I;I,_EStzas81 +endstream +endobj +194 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 193 0 R +/Resources 4 0 R +/Annots [ 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +195 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-89) +>> +endobj +196 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-90) +>> +endobj +197 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-91) +>> +endobj +198 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-92) +>> +endobj +199 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-93) +>> +endobj +200 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-94) +>> +endobj +201 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-95) +>> +endobj +202 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-96) +>> +endobj +203 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-97) +>> +endobj +204 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-98) +>> +endobj +205 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-99) +>> +endobj +206 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-100) +>> +endobj +207 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-101) +>> +endobj +208 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-102) +>> +endobj +209 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-103) +>> +endobj +210 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-104) +>> +endobj +211 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-105) +>> +endobj +212 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-106) +>> +endobj +213 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-107) +>> +endobj +214 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-108) +>> +endobj +215 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-109) +>> +endobj +216 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-110) +>> +endobj +217 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-111) +>> +endobj +218 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-112) +>> +endobj +219 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-113) +>> +endobj +220 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-114) +>> +endobj +221 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-115) +>> +endobj +222 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-116) +>> +endobj +223 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-117) +>> +endobj +224 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-118) +>> +endobj +225 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-119) +>> +endobj +226 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-120) +>> +endobj +227 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-121) +>> +endobj +228 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-122) +>> +endobj +229 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-123) +>> +endobj +230 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-124) +>> +endobj +231 0 obj +<< +/Filter /FlateDecode +/Length 4449 +>> +stream +x]ߋ$~bU/~ÑB>?_Ꞛ^Inٛ*I]]%}U%t_rԜɻ=M%V;x&/E'%pvƐ6cӟ~s5_~P%g V]!&kX#f rCj bH`YbLb ՘ yA{AG%(=Y@.Q٥,UR dՓŋ%xEd '&ej +dA*&UvW%k^-l0` ^,j Kd,CNDΥ5fd"d !Ƀ,0!AANq€PIb@(Il@I^ C(B&"&p 8@a h+-0V|% x+ rIbarѕ e` p0Pc +0`$ B2Ƀ,Sa 䳅0 +0YXB) `d "}@AB w! {[X\@XbaAR34Q‚ܥ(CƸT-,]8* w`G D.1<R‚E-,@wp7G]Uk)D.`)XX/|БC-,H]jaAlaAzAc `a0l1`x]Oz n‚! +",,HՃ%haA D@Ƀ,֮r-Y8 r,,,@D*!6ȂbY)ZX$sXXcB>Z\ɀkWlaAR`[Xw.YX1# WȂba\+#Ȃ DYXPdA4haA YfC#-x3EP d@JY>lG Dc Gf|}SlaA'aq𼷰RAK7=MxƸ4T,!Ƀ,1nI7N/AP‚7ћSElNwc2Y<."da.o"r{,qsz#|9eVٜ3_͑I̲$snL洁"+L>ST !gY1,}9b|e~O_=L3eY&QH07M Mn"$!|M"EH,Γn*$\1m=/̄`fz2L`*N/Vr/og9 risUBRHcR\b'^/¿{w0o헃~廯?>[ ^I~C77\h=~=]>c=_߭\u#Uy>]m"C6:o ->$_+4@ %?0:u$,R賙u6D*d4tg qL; nvƯ Ip;GQ3FJ71\NAcsQtף@MoaFngØLosh(I*e_㘅u'q׎C\s47,X0[})TJGXIJ>zf_=*4-w6[}ڪK-i +l쾫}uΈ1#Bk16Kc?^,\ Yi>߬iYmmݖz/Ȧ+[{{-snQ~-4"|mqWEFx]iJ)(qjF~`}Ucr)}K qi>o]U LU1v9j7}b^W7,]&Av$4{~sd]7s-z=ྍwU9Ӣ;Kf*]9qa99AY[Qfc,µ,<,X"g9+a>Hp +4+,bHDgܗ5fz%[Kʬfg.e=cS^Ns)ѐ5Nep4X~+u|J9C45#ԢG9ݲY6*ziRoԜOzПNjO/?Ot"}F홗8D^ݐOzdmԆ]ݖ9!UӓqtFҾzADDd}zh&)|(15A\R!xMʆvEUG[ِs#>p[RMٚj xvjl%A = 5:@v!֑Az:bTR6/,]KWAt4S=뚜HZ~O'AtE~>l VغHN.~/ 5* F TNU䙾.g-WMtlvZI#=uK$y);r}voWVAe=&T5zd#7!p{W~^9c%{.Աy$nqݡ7dK֮_Mr-7`Dn( <ǠgbaDom]x-BydzxIdLe)~<e`o%#(uHr]7wO-@fqؗKn۰eפ8, |ĕ]\:púHS;xz_FSk'n)"yoZWBzxj"6ڡSGj0v<]e9<c{ %GjYxSiMpobn2ZSR1BitҕGnx=Zű;RǒŠvR޲w1d$-_ū¿׌KlUL3T#<ᨅ2*/)CDR)׹?q=8;N}&:`njwjx)Y`_L`扜~5UԿogO4W'Ͽ2 +endstream +endobj +232 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 231 0 R +/Resources 4 0 R +/Annots [ 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +233 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-125) +>> +endobj +234 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-126) +>> +endobj +235 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-127) +>> +endobj +236 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-128) +>> +endobj +237 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-129) +>> +endobj +238 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-130) +>> +endobj +239 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-131) +>> +endobj +240 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-132) +>> +endobj +241 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-133) +>> +endobj +242 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-134) +>> +endobj +243 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-135) +>> +endobj +244 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-136) +>> +endobj +245 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-137) +>> +endobj +246 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-138) +>> +endobj +247 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-139) +>> +endobj +248 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-140) +>> +endobj +249 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-141) +>> +endobj +250 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-142) +>> +endobj +251 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-143) +>> +endobj +252 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-144) +>> +endobj +253 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-145) +>> +endobj +254 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-146) +>> +endobj +255 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-147) +>> +endobj +256 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-148) +>> +endobj +257 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-149) +>> +endobj +258 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-150) +>> +endobj +259 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-151) +>> +endobj +260 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-152) +>> +endobj +261 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-153) +>> +endobj +262 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-154) +>> +endobj +263 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-155) +>> +endobj +264 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-156) +>> +endobj +265 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-157) +>> +endobj +266 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-158) +>> +endobj +267 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-159) +>> +endobj +268 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-160) +>> +endobj +269 0 obj +<< +/Filter /FlateDecode +/Length 4154 +>> +stream +x]ߋ$ ~￢-ٖ!C `H!w^SuL{" 3%U*,ׄW%<~J:ťPg%PqX_c_~wN8FWk!,&W V2X)Rb+WbAT85@ ,` .YbbAPS1XC7y3S4x! gRc5yP#rpHUsNbK%fo ! e&D)d +dN5xYкA}x\l*x^\O. x!I&#b"d>UYh0-p"Q15w`dɃ,01C_ da@,ql@r,, +DK! bMs-`yȒ8[H@0 rAj w|&Pqoer$.:* wba0ޡG$n b$.da ,,@G5y*baA腝 + )XX0vqZX>YXkkW2yk:k^a{ߘ3"4eDQtA&"ӑq7qDe=t.{vk9xFGno~(2EMAJ%S˨;-Y˪nOǷZU ]h{}Z;":)m# R-WeNUٍ ffx,2jTS9I*$HW"pn)v~ SobZ;,H>tf/v~T3:d'SmU=peD;>Yg?+ДpNxIR>\ti_0-zyg|8-/<F^hu+):j#bWB|YMi f|wQeSk6}k{ aWycy>cM vXW]ƁnXp~ SܤM<(:r"-<p|+Ø&TCXɼ7I_Љ429ќEiΓL`6/$rNQLuٹ:Q-u'뺹{g @⻋+[}a6*uFoEu" t_# Pq'&P ]?ס prx:Rqs.F:~0F.FXtyX:QsOs +W3l^҅WER-8F 8}޳ x͘.# ع:Q}Rj&oRo'kxq}js/w9#ĄyOd]9We7j^W¯1(8F䏄 $Ip5v ]oob_j"UN`ԕE#zj÷|XLFSctӐ3)=;-l>yfKeOSe|,TC^NII>/}o=)zԓ9ް($@:I*N\?^Y N䧃]D$+{LZ\,IoN}OJ5s&{d=Qr%&3 y,px+1]𸕬;[?ns`V6/x,]RLnմ} TJvpAz<į|F6?XM95$j+gfRTdZWQ֦NoE|S%g@5+Aל\ӊ>7io'_J9OpFG *R*,&'WC7;y;갥e-;+쨯 (KwmzM<[r譮š~:VD߄VrMiC^LUahw%玝O#t=;F|\:6$kӗ}և U0J^ai!7o複CY=EJQLAO7p7|};NԏG"vlݐǞL•IۈmbWrlj1xku{+:i@@f -@fO^!=Iup)+.8WZt8TxS\d1AWy4鳆!KZyvmyB`/sZ7B^gsvhԧ_Ll*-y{Zv7]5EQrVXC \mtZ\ F5x$_w=ss1Z`jF:t +EZ!aHu^hc`DO`یV?GtuJS1œYy _M!e%oO! +endstream +endobj +270 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 269 0 R +/Resources 4 0 R +/Annots [ 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +271 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-161) +>> +endobj +272 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-162) +>> +endobj +273 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-163) +>> +endobj +274 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-164) +>> +endobj +275 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-165) +>> +endobj +276 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-166) +>> +endobj +277 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-167) +>> +endobj +278 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-168) +>> +endobj +279 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-169) +>> +endobj +280 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-170) +>> +endobj +281 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-171) +>> +endobj +282 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-172) +>> +endobj +283 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-173) +>> +endobj +284 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-174) +>> +endobj +285 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-175) +>> +endobj +286 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-176) +>> +endobj +287 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-177) +>> +endobj +288 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-178) +>> +endobj +289 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-179) +>> +endobj +290 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-180) +>> +endobj +291 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-181) +>> +endobj +292 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-182) +>> +endobj +293 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-183) +>> +endobj +294 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-184) +>> +endobj +295 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-185) +>> +endobj +296 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-186) +>> +endobj +297 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-187) +>> +endobj +298 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-188) +>> +endobj +299 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-189) +>> +endobj +300 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-190) +>> +endobj +301 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-191) +>> +endobj +302 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-192) +>> +endobj +303 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-193) +>> +endobj +304 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-194) +>> +endobj +305 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-195) +>> +endobj +306 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-196) +>> +endobj +307 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-197) +>> +endobj +308 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-198) +>> +endobj +309 0 obj +<< +/Filter /FlateDecode +/Length 4927 +>> +stream +x]߫帑~?y"<,@``B=73 ˝d߯t%٪o{%T>}e5~3'9R1/_oZEX]ow]TPT1{6}[s'9R1Ũ IޫBR0 +3|t֍If3IHJ0\44&eaqR0G!hab ΑҌW4kTHf1-"D+FJ*`Hix㜖`[(`M[,Z' i ]IL-:h#eR>'Ĵ4bӬ'"- CJiAbZBb#qb)0%.+v$.H3Nₘa T̥4[dK\OiH\,l7(qA Qf`F,Ҝ83I\\P*J\aHL)Є~l"` y'qAJ$qAJj+qf kO€b7Y8Ҵ x: 0.9Ld҈7 6Sx3J\lpQ4) x$b fnMx@x3]LRxi7JLNLq&q@z=Vq@{1[Eq@|9F `&"ULH4Z\6_cnSD93EɌaטed{o{~]Y)[~ O.p`y،]RCGUX?F܌4m_dX683\_/" zX,[i +0{|B]0;Sa)*b_ e܉WUt0zVXݘ_nOO?>3oW7zȽ̃4orᙸϷ?~Z"n bf[:‹SP(kg[8)M_䇎[䙆ɞ׾J>\KpKt&#T.K)T7am؆~2GsVbhÄ߲s:iZ+֑s#`hj5ihLsYd?D9_N|ûwƜu:#8> *-iˎ-OMH:PT0vȠH`frrP^9ˀrTj\ +bۂlnE3W#4W Ž bac~]9 4^#"m'܁%3yZud^gR:A 1m B pp_\(BՃd"^]!<ÈD%n)t?Eg@:!4[ȸuΣݏ&;^X/hόn= z B &^,PnWؙӹx"1B3*N/@cbzp(u ީ= IPWVWg=Iw7$1{u<Ǵ *Χm2%MO)cռQ{XowNQ)H&ٲǽb&u,Y8YLgkU~#e3eN_9ҵW@J3z{s0Lef``HI[Z~|9";||& W~;yf#¬ϼޛ_Bx} ibϕgzD[;v(YAɔy0GJ +7sHGޤ]8YW@2k0ɍǍS~`@@ +^(΃jN2j]篁fY^pݵ +Z@i>%AJXȸߤu1dgBiUiF x~1O߃!^ՠ !0+\z΄o{tF8.t`'tA寽8?qFОh7&IpO:ׁ'o Lx + ++7uhNhq8ws:p,~1 uԿFpݨ}hzQ-o9%z rR:Wc%\/2׵g]m}ƺ_s뜸 nA`iCz~uYNUCe5: 3@kOE=[罶IOЙ_>hB 买Xmk:ⵍǼ6AP篓:Tv]9<@ -lͳhő''Ԃ WBmR:P#~9s&w ]=U mh 6hڨ4oǀ8a59@[zhy`cG|Q&+fms_ԹO>sҺkzY6ղ[m>1j[ *Miޛӹ 0~g޺3vf#7jc>A`p>0"AIṀBlX,lcҊ_mxZĎ3kb=9m6syvbgn9Z^Na~K1P!f2ۨ[D':XӚe<`Bgv_$g>rɆWO\VF|yZzV}m m}"cԞ Z!2Gu7s@85 UӀ<C[y͂ {s|i6pA7syvݜh]A BCn\%6Sޚ &uܪвˆDpaH0j =Yrfl0seo9P.t`.5 FcႠl2!1|2=Owa5sX b8sѺ+h{(Kn.D'Bof3['>Z:`hF홀J& +Z߃C6gw`Ѥu yꇹ2ݪo`euh{XǑFFS">gtI)[d|@ZzH WN +8sGێ5j{K`fgeӟdO{7r1Y,$ g2'XhX3o߷DZ%O9Q<+o+)sDބ~ꮺ&rkCXMtݿ䵱= V.J;IKQK\d/9kO&KkaZjDo71߳4_{*\) j FOiO0vcDZ֩Ío7~d|r/ԕ[I74iLKSah.2>}PRfqRv*YF塲Zw~Ac$-gҭk]u*yŦ–\ bkb_7;}^ʂkM*wX{SLln+f觥& :a3 čFߋxkdҌvLse?ׄڙHN +#ѥnIǸq5;#eޑ_'tE-Y=Xᖎ5hN+8c\ȩCEv6/PğڈK:e%O +endstream +endobj +310 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 309 0 R +/Resources 4 0 R +/Annots [ 311 0 R 312 0 R 313 0 R 314 0 R 315 0 R 316 0 R 317 0 R 318 0 R 319 0 R 320 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +311 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-199) +>> +endobj +312 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-200) +>> +endobj +313 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-201) +>> +endobj +314 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-202) +>> +endobj +315 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-203) +>> +endobj +316 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-204) +>> +endobj +317 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-205) +>> +endobj +318 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-206) +>> +endobj +319 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-207) +>> +endobj +320 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-208) +>> +endobj +321 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-209) +>> +endobj +322 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-210) +>> +endobj +323 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-211) +>> +endobj +324 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-212) +>> +endobj +325 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-213) +>> +endobj +326 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-214) +>> +endobj +327 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-215) +>> +endobj +328 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-216) +>> +endobj +329 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-217) +>> +endobj +330 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-218) +>> +endobj +331 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-219) +>> +endobj +332 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-220) +>> +endobj +333 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-221) +>> +endobj +334 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-222) +>> +endobj +335 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-223) +>> +endobj +336 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-224) +>> +endobj +337 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-225) +>> +endobj +338 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-226) +>> +endobj +339 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-227) +>> +endobj +340 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-228) +>> +endobj +341 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-229) +>> +endobj +342 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-230) +>> +endobj +343 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-231) +>> +endobj +344 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-232) +>> +endobj +345 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-233) +>> +endobj +346 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-234) +>> +endobj +347 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-235) +>> +endobj +348 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-236) +>> +endobj +349 0 obj +<< +/Filter /FlateDecode +/Length 4954 +>> +stream +x]]6}_ρ(J >$,w}ؿܖ,[nΐѩ*IU%gTJ9w}rUM%VSO?.*orH(z_˶_]1Wr8ˑ)F텬,mH^h}QŜ,ᣳϊP,MBV䢡>+C > +YFCcvg + YB6yy&Z)H7R^V!<]|F純](B]l$Eb;YKJbtA)/99'eSgW>i)M00H! +y] 2&spYGV!lm\ƧMC4Rm *Pw#PAAvNy/݁(K6 +#ɜDw|V ACW^6N8ˬj O)aW&9X^f@9>]W:1N@h:wNeiAzdWuY1 ;YR ʜ8 kx"pVoڙj 'z%vyl-2k8(sangoU}8$3gy:KkwE|d9h>Z6 1Øg|&Voke '&>/!umX'}`.:paP<3|>!}&V1v3fC *h@{b20coֺ`M@ڰW6ւKz=yԑ'L"mP<`㧗"_`sc&JM^&J/ Jؐ>.he{P<ʀJ߷&J.Ke?u 'uz=femaeu]Zs|o,g_9$:O҉'[~ <7D=9շfKl.2ZiL4p +^<8+݃ӽ(uV 06Ah. +Q$c2/LX*mMB}l=.;s;p(N#p{cpExA)ʛaCFr958'pj652ĦwmhYz=oS+v+lZ==&rְ^˳*]jE9K;-P0\<{P">k,,Z뾽u_A~&򫼮nB4!Ldħ"5 3RժoY4q?7oԞҍg]6a\)}t>T&~7؜^)K6} /Cd1(kɄ5&ƇhP}VD<8]IN/my 1@'k~c Jo Ӽ_ru4Æoꥏ.A~Lde]AL0*= oR748K `P8"0(syPtf^4<][Gꥏ=%mWD. ʜPr?PJ7sW>G{cˁ2S `CiC"SV'.r͋,,w{6:lVn~ߺJ_ a㮗axXAO:$;@{|Olnu: ŷۏ_z~l3IqVmL^3uޑ>6[-#I')xvb.40_.u=2oߊS2nzo9!Lu)M Ty[\+'_~Z_}w8rX5,$B2>kN7%EU5qеe +ɼw$>Q7-FR֟9mיfKYK|YڦRU]XIF\S})Yq^.B׺TqoFߕKLH˥r͵:RJh.=@Rx!m959\'2u.§׋Bipzm"5,1,iqF2L?,WK#<7kPYI=5]*ꎱb/PI=JmI$Ucl*j2SXʕm.J%W(=}^ƂikKr&:?P6//asd~*,ɼtXSk@ +KBSrsd}z̜%oE dKFwdC/cyu͎[]Vn]%{;x%N&Ѻdqkv^4AMm҇Mе;/^`.х.eZh1צJ\qŤ#Fml̋f+5m#Yq[EF%-yn1m%m\`j/ڊi+}<*28R{M}mSqj%<9˰62yuQ3:9X\ h1ڤEl.F]I[5Z E VkE0n8OoGvoG%tebD-rwz)Y}$V$mnXksnQ$,^|WMs٬Hʟiäc30D4}?X!?]j4q+em á-8|%ZǸ[:Bs[>慜z9T/;?XtZ>yP۷ +endstream +endobj +350 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 349 0 R +/Resources 4 0 R +/Annots [ 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +351 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-237) +>> +endobj +352 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-238) +>> +endobj +353 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-239) +>> +endobj +354 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-240) +>> +endobj +355 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-241) +>> +endobj +356 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-242) +>> +endobj +357 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-243) +>> +endobj +358 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-244) +>> +endobj +359 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-245) +>> +endobj +360 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-246) +>> +endobj +361 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-247) +>> +endobj +362 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-248) +>> +endobj +363 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-249) +>> +endobj +364 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-250) +>> +endobj +365 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb9-251) +>> +endobj +366 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb9-252) +>> +endobj +367 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb9-253) +>> +endobj +368 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb9-254) +>> +endobj +369 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb9-255) +>> +endobj +370 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb9-256) +>> +endobj +371 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb9-257) +>> +endobj +372 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb9-258) +>> +endobj +373 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb9-259) +>> +endobj +374 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb9-260) +>> +endobj +375 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb9-261) +>> +endobj +376 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb9-262) +>> +endobj +377 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb9-263) +>> +endobj +378 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb9-264) +>> +endobj +379 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb9-265) +>> +endobj +380 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb9-266) +>> +endobj +381 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb9-267) +>> +endobj +382 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb9-268) +>> +endobj +383 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb9-269) +>> +endobj +384 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb9-270) +>> +endobj +385 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb9-271) +>> +endobj +386 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb9-272) +>> +endobj +387 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb9-273) +>> +endobj +388 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb9-274) +>> +endobj +389 0 obj +<< +/Filter /FlateDecode +/Length 5112 +>> +stream +x]]$9r}_Q `20{a]ۆY?GfFU05wʐB"$e=|gN9E:_~>)9OMl )9)RJ4.[\5 iʸ'!;iiL%d f ބG. ěI]. fL@ V 7$gz"Kꊁ̭ꒁbJꚁJ.LDULHF]60_cSD9dư x5hl&_wJY(u!2t5HJB1"f-.nb$bL\?صɰXlpf;^D +]n:Oo#do$ +|aǔ~mfR}\YR1 y08^1VeJ1>LuE7]yJՊJ_gnyYEReun10\ttP qhr`S~ e 6a}"Ve*,\:]=i,z Bp<-~1uf ֳbPu^G9v'.) r,DnAQ/^ + +Lpb1<{5>Fx~.d͝Lx1ׁ@ +<.tnfnDVG)00 7Avywv DF6eJ$@g3ÚxArLu dS{&$WT`ò41 Mzqڏh]>1P=[ Y"Ry9YB9[攷9`&7٤Tc⩱'i|N8r~_}=8{<>Ve||9fgduԹy޷l3a*Z6| ;/m16Wzo#^1WZѿ\MBt!ׁZbdB8D6uC]m#OweVܫpd'cޥ$>,G@@Nԫ*zkqͽPY1Pk#!G'NΎY2hoPuaBc9ĺй}ee .xpc5FyS|//p8fC$M{,͚){ϫM9mePud V~&Zy8Xdَi]Mȕz mǰl+{푉Y_k{^,ojewP-(XBWP#r][;^ Z}^fɓ6*|R_.%)Q~VrtKUSp`GPZ|s luK;\]0ݱE/vtP\mKhp7cVGɏNM;c0.]sg'-Y{m.ΈrW*Zyk;k?/ݫEoI{ܶݴ>}V[mמsk5鿥b.r헥ftޯnwi7.}b +v++uWu%9`/ſcYv%5[7M;70~i_)Wol/Qz{v~ӛ?ʣzmZ[ g?pqm[{6۟!_ ?.76cpܥX`pP@+ɖEo0>0Ѿ= oG2=fs{c[:mCh=S;9nPu(S&K[~K SI~!PvX>c'k2"ZAPR= rO2vf~0>(t^q~S%\ӽQ6`2"8=#y< 9u_!I,Ks:;ِD~]å?] '㰁(-;ȗ!o+=7n񜔳ߺЇYl`߮mz^{ǘq)29(t G?۝\>vjk\MU_An,1<: Xy73 gI + thڝ9 Ns<^YHbg7)WpяAd66?u }j\axgoCdxbo-HRv~t>""2v$t5VWu"EZV> !}eA+e2kga mjejPFVsQuXgyTiy=Ńڡ)YZ-$Y,ʑS/0=t=f!!Ϧ=q]R6ϧ8/;6ҨN ጀIΜ|k y |Csk. 7MK87vr27]h|)bv@,壩eJSa2vY\]?M?5ӕ+bEhb{3E,__b54H}V`S<bt5~̵!Mg/y]rB~+}WRTi]gwF* %g.'E)E:w& +j\)IͷjOj.-LiP\^]I#Ɨkq(}mÍ /@u$6)$%wh\aB^/]U̦IeK CJJy*%U"c׍ceZ@f*f¼ҭk]uyBR8qwdD?':Xވ{ǝl*L&_gÃbz"æ:h-u|MM4b/9meP[S{ahm؉]kpGxٴbud~iߴ zI( R.Vᢿ\rKmJ>wEJ):E\ⲫ07Vf + JjӋw!Qfl. \`_++{?<~q/&2DZJ{i1Vӥ~:9,P-wcW' Zh'妶d}TdJDQ2SdTlZiYmT}&[ҡڈ+zK:@sjwgZK"vRl_7. j晚v9?;TZ3`XnD-u[qw8Fp7$nIakׄ{|n;qBWTG]M[z%FsoBNL*[=DXuIg^jɫ]@_ +endstream +endobj +390 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 389 0 R +/Resources 4 0 R +/Annots [ 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +391 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb9-275) +>> +endobj +392 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb9-276) +>> +endobj +393 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb9-277) +>> +endobj +394 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb9-278) +>> +endobj +395 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb9-279) +>> +endobj +396 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb9-280) +>> +endobj +397 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb9-281) +>> +endobj +398 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb9-282) +>> +endobj +399 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb9-283) +>> +endobj +400 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb9-284) +>> +endobj +401 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb9-285) +>> +endobj +402 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb9-286) +>> +endobj +403 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb9-287) +>> +endobj +404 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb9-288) +>> +endobj +405 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 84.259843 443.811778 177.650223 428.811778 ] +/BS << +/W 0 +>> +/A << +/Type /Action +/S /URI +/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/installation) +>> +>> +endobj +406 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 415.114756 101.433071 396.364756 ] +/BS << +/W 0 +>> +/Dest (cb10-1) +>> +endobj +407 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 396.167735 99.933071 377.417735 ] +/BS << +/W 0 +>> +/Dest (cb10-2) +>> +endobj +408 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 377.220714 99.933071 358.470714 ] +/BS << +/W 0 +>> +/Dest (cb10-3) +>> +endobj +409 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 358.273692 99.933071 339.523692 ] +/BS << +/W 0 +>> +/Dest (cb10-4) +>> +endobj +410 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 339.326671 99.933071 320.576671 ] +/BS << +/W 0 +>> +/Dest (cb10-5) +>> +endobj +411 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 320.379649 99.933071 301.629649 ] +/BS << +/W 0 +>> +/Dest (cb10-6) +>> +endobj +412 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 301.432628 99.933071 282.682628 ] +/BS << +/W 0 +>> +/Dest (cb10-7) +>> +endobj +413 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 282.485606 99.933071 263.735606 ] +/BS << +/W 0 +>> +/Dest (cb10-8) +>> +endobj +414 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 263.538585 99.933071 244.788585 ] +/BS << +/W 0 +>> +/Dest (cb10-9) +>> +endobj +415 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 244.591563 99.933071 225.841563 ] +/BS << +/W 0 +>> +/Dest (cb10-10) +>> +endobj +416 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 225.644542 99.933071 206.894542 ] +/BS << +/W 0 +>> +/Dest (cb10-11) +>> +endobj +417 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 206.697520 99.933071 187.947520 ] +/BS << +/W 0 +>> +/Dest (cb10-12) +>> +endobj +418 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 187.750499 99.933071 169.000499 ] +/BS << +/W 0 +>> +/Dest (cb10-13) +>> +endobj +419 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 168.803477 99.933071 150.053477 ] +/BS << +/W 0 +>> +/Dest (cb10-14) +>> +endobj +420 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 149.856456 99.933071 131.106456 ] +/BS << +/W 0 +>> +/Dest (cb10-15) +>> +endobj +421 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 130.909434 99.933071 112.159434 ] +/BS << +/W 0 +>> +/Dest (cb10-16) +>> +endobj +422 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 111.962413 99.933071 93.212413 ] +/BS << +/W 0 +>> +/Dest (cb10-17) +>> +endobj +423 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 93.015391 99.933071 74.265391 ] +/BS << +/W 0 +>> +/Dest (cb10-18) +>> +endobj +424 0 obj +<< +/Filter /FlateDecode +/Length 4783 +>> +stream +x]ߋ8~Ͽ"F+)B`eaazjw9jfiɲ.+wQ]V>²-~~p/395)XJ.&_YN&s*J&S/zqwoJޅ?I9%V:RX!| ++:[,EcA󞕠4`P89ڳ +ɱƂ[e&\05w&K5]pcK(i]c0"tHVAi]`&9*P` r ]7e4,( Ӱh$Lְ0aƥ7,֛X)PfҰ0t QTtATq Lz"t5,(1z3kX0MDjJ z3n(@&Ed5,֛lLgfYqf5c`s2^VIXԤ2G5kiLgմ"&JWba 6iG%4}N#D; D91Z^O7 G~]vjc.gtO~OB>Ap?:`IaUR G5yu2!\-n_돓?M5;#\CGH:2YD/jc"2V[I!޳.Ͻo& ?y4"i#KR׉&L'F2 7ƗQ`˄jt/,EE BXvLجhQJΗu$io/b9ziֽQfDW!lS"C]6_2;I,ed.|)ESGif7[ͷ8N6]iwT_Ni&=pI?(&G/j7$vA븠DB4,Q\قkm>upCH<ϡ\$IXo}\s`P;O4(Ss\leǑ6wEG,I6OgP:U»ͳ;33n ݯR]I\0[:-`Ȼ-tgi1tla +󁇾+3y9yA|Q8y4i9aS+\ƌ=>>u#66tӴ.7]sݳŽ<[K?lQwălF^d0*䳍72qYy"#[o֍|>PB.[sLfEzĥc_JE.WncvzJu\95}W]5yN4cԿ"5:ml"h#]afAk0 "C N`NR;͹ \ǽ]v[^FrfE\!iX{َnN'oeSj kള˝LfzW?ve8/)6y)!*<ۘ3(s B鼫J'=_^hzw-e$K0r|;1tM))hmhp[Ox=ul]Pn9ڶQ/>ʦ69hxDH\Y6Y9!aJ>h4;(sӹ:$~n]`ET%)"Gz;Ng\II_}~ݶXVOGE7YnE4(snD)Û_R3yu>n{V~f%wdx,Y NC1f?wH`j/yƟP䓎Nא)g>xqŞj|!m-@:d96ȉE.TO͹Sql7r?vu3?}. kl\G9@h*s e.1v㶻 F7k4,Ǧ%,7sC@rzZ)$+ Kxb.d_oNQ|q:Ȳܒ_or:=+dL#~,mu ؐLٖ`)ԏ>ԻP@:rC?n|ǽmhL&ߴ+؆MGBvy)7yy ג!kܞ>ȾwLx|m qIٲ[E; )U+)LqWˮhRSouϽ)H.0B.i2UWt]_-+}=ʱ6hoמnL t*Mq}.PG-YZю@J[5Z'Jk5SjLw^J-X{:Viz]Yx-Zޝrwv)bɬb/ݨJ۷l{nEE,J 3v2lVL 1QKi:c|Hܥ4y;DZdGa&'= +F9gtU%drKuY`28ӗOߜiI]s$AoI֩))e>~A +endstream +endobj +425 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 424 0 R +/Resources 4 0 R +/Annots [ 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +426 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-19) +>> +endobj +427 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-20) +>> +endobj +428 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-21) +>> +endobj +429 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-22) +>> +endobj +430 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-23) +>> +endobj +431 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-24) +>> +endobj +432 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-25) +>> +endobj +433 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-26) +>> +endobj +434 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-27) +>> +endobj +435 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-28) +>> +endobj +436 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-29) +>> +endobj +437 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-30) +>> +endobj +438 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-31) +>> +endobj +439 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-32) +>> +endobj +440 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-33) +>> +endobj +441 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-34) +>> +endobj +442 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-35) +>> +endobj +443 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-36) +>> +endobj +444 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-37) +>> +endobj +445 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-38) +>> +endobj +446 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-39) +>> +endobj +447 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-40) +>> +endobj +448 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-41) +>> +endobj +449 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-42) +>> +endobj +450 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-43) +>> +endobj +451 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-44) +>> +endobj +452 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-45) +>> +endobj +453 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-46) +>> +endobj +454 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-47) +>> +endobj +455 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-48) +>> +endobj +456 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 211.815391 99.933071 193.065391 ] +/BS << +/W 0 +>> +/Dest (cb10-49) +>> +endobj +457 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 192.868370 99.933071 174.118370 ] +/BS << +/W 0 +>> +/Dest (cb10-50) +>> +endobj +458 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-51) +>> +endobj +459 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-52) +>> +endobj +460 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-53) +>> +endobj +461 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-54) +>> +endobj +462 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-55) +>> +endobj +463 0 obj +<< +/Filter /FlateDecode +/Length 4628 +>> +stream +x]ߋ$ ~￢g[/8,I`N6!.yȿOeZ=Cv..,dD# FH 4`89ec1\ Ia9 9VAL^`":=j'x xNQxʃ,6Z +P2+ٜ-`B&9`0,ц K 5AƏNJ9+&KN}bY| |,6E 0>%ų>YCH_Xdxi@@, ְ4 z G `(ch  z8Y߃Ix%+pʘZK԰ w]T^1.Ǖq^6.ƢaAQ  <װ wSk#ˌVxhjV̬aAh$T԰&RAЏ$A$?H6 x;`'GQuo\O' ~rޔ񷼐Ϗ?ѳsWƇc P79k!gzBce,; +. =#{E@qztF{ڕ蔟g]zl) Už*jFU EvdsA.㙼;6+-(&Zn|>z#UѲmGƋ2M1=L U֏|!9Rnq+"۸R$oŘJ~ckah{{=o,KUHϓD RN;;]>X8]LŒ%G9auʯLH`<,3V8u ˏvpe9Z 9ĘajZIfgdm18jd;Bވӻ 2 w;=$Xttf;u$mnz[9#/J[ (UaeU92L }eQ1#LISh޿Wac,w*ʻzM*m'MVx"2*S#9$.~ o>FOt}iQ0s2X, ΋hvaTVVb |jߨjDܦѧw|HA y~^oRҥK_ +0o]Yy]b%r*ZH!JO& eal5vsuc| ϺቬW'Ir}gmвΥha9`Ks-M佩S&PjDu~85'7gl}B8hgG += zЃ!et>mM8Gҡ1_*;hw'!,oO8F*/D$SuXtMp\-^)a3-2:k:uwyMz u${?):r웑|^OWLapMXFv6/f>kВsc>{y_sut:|6KTۙ>o rW~TOv+޲ᶶ>eltrT@~wxq/+1 ox>?{?_t)g y|ÊTs[\ 0?y\w(ʫNv6XCݢRכ̩koۮiԝeRVyO;rȸy9y+F}a#n6\vMyɖ2-<+$ `ߘh@gLΥ0:ԗa| gq#3:zC=V2->2Bi:uuՎ9j쮕bҺnt2e )OlSIm oeZNjl3rd2'yz5̏m26%MAHwaw:%|gu!3lVV, cgrnJ,#x\4[dGcI?g9YG4gb.Yfܯ"߯#6dy =ԭ:e1?s27'.R&tmkݺ(8_Oq:gMg8E%ѐF\O*g9.[bWMwjNGJo*zSs_'r7*'0ۉ/l/'92?Hն{f HlKR0vZ)ԯ>ԧV&aݒ-,gCUlXeq!e.wɲb![[rM-tb:שSk ҖRzڻ6uBF dS7=)I!~k+&'P^rSHZn[hJT^(SnЦ>I,C7F,կkr T]#cX/'ف{C~9 VPM'RwFv*]ahV'PUg⸙lg\Fdl6zzlZ")5 R^@n=v]S H5X]FӰ'*[ȡˊP 5]gw!dž/=95;9P|%^&[~,d :"@a!/02hm$[eirirs6ȝ2??N|Hy6 [Wޓ_ȃd؆MGBvy)54?}׼T ג!kܞ>ȾwLxxb d>W7þ^R}84Cri +2/jF}OtחtSK{Q79XB ^]6QRm.FVVG4[i펩j['j/S,Կ=zN VMYox-Zޜtv)bɬb_Qy)Iv6ۮ=/%2KpS]s-J՟ig8jvdL#0+$ݔƛ>q;Q8D69j/`}Fwj^Hoe +g9{33'reTQIЛπ$)iy5}2 b +endstream +endobj +464 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 463 0 R +/Resources 4 0 R +/Annots [ 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +465 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-56) +>> +endobj +466 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-57) +>> +endobj +467 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-58) +>> +endobj +468 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-59) +>> +endobj +469 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-60) +>> +endobj +470 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-61) +>> +endobj +471 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-62) +>> +endobj +472 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-63) +>> +endobj +473 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-64) +>> +endobj +474 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-65) +>> +endobj +475 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-66) +>> +endobj +476 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-67) +>> +endobj +477 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-68) +>> +endobj +478 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-69) +>> +endobj +479 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-70) +>> +endobj +480 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-71) +>> +endobj +481 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-72) +>> +endobj +482 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-73) +>> +endobj +483 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-74) +>> +endobj +484 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-75) +>> +endobj +485 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-76) +>> +endobj +486 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-77) +>> +endobj +487 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-78) +>> +endobj +488 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-79) +>> +endobj +489 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-80) +>> +endobj +490 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-81) +>> +endobj +491 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-82) +>> +endobj +492 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-83) +>> +endobj +493 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 268.656456 99.933071 249.906456 ] +/BS << +/W 0 +>> +/Dest (cb10-84) +>> +endobj +494 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 249.709434 99.933071 230.959434 ] +/BS << +/W 0 +>> +/Dest (cb10-85) +>> +endobj +495 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 230.762413 99.933071 212.012413 ] +/BS << +/W 0 +>> +/Dest (cb10-86) +>> +endobj +496 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-87) +>> +endobj +497 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-88) +>> +endobj +498 0 obj +<< +/Filter /FlateDecode +/Length 5118 +>> +stream +x]ߋ庑~?y\G?JR }XX >IX.!~dٮӖ{z ;LK*,}Jm{5Lv`)巋R03XP͑W4\ [՟/-u 9Gg_8%"cR Q)v%Ѷ( "AαR0S~[aK"asHJ5:c2bSl":=jejYBMN+~lZYb2-!,` yNZY->zke 8NV]ʲBf",pm3aʬ2( RLJ-фTи{k\h\AdոoبqLqzqJYN DqzqzFzM ok\@]oMҸFNF 1 ؐu .@-K׸.4 u8 E ch + z8[@ߣy p!,Ѹ wmS4jkç&2o˃1k\pT^}i\Ske]Ѹ w7 "иmU`2 Zr $jY$qx0C5.]qAkaZ[<; נ VVZxXV5&e "xWܦ10p@4.LCN)j\AB>,8$Aeei\z>  "EpQ-5. 4.H!"Cje @j& Rj\\j`Lz @K YҸ e؂q\Vfa l Z Dcdh\\]<5.`` Se4qGq$Hs2i\$d a3N`SͤqA6Ad @(3Fl# 0/%d 77)6(fҸ l Q2؂)+|줕E2i\c|5.@|$o&u2I+"2&"[-7 ސ,'+[%JꚁJ.LdUUZ./1p}]C$1-}9jAz|ݸRVZS:q F aktĈg#-hqZt#nb&b"v)X uV_C)o0ݮ +7Ty Kѐ|vz -*ۧ }6vÛ:י_/OO. ?ޟ}DNMMi4RO,rsypO;=1AY~kZ؏p݌l\>WG`.>Gߏc@b49 #6x5sCi)Y%"ۦ?V>1V25E=2 T, +Yrvةs4"KBqǥ'~)X,V1*'l +g}iwm0p*֣;-\e4vGO ȶuԱA'K4)+cB;uPdގ3ɗK#>O\t ʑvض}1 +=W=;m$Glښ42 >1-H .X"9j3YqBӀ4@Jخʍ5r}+7P籛gIg#,ڧs:YB9} xFk7~(ܶs$j :'ZT(J +z n:灢<ڝ /_G|rHP\ ;odݕƲP2xt-7=ht.Y攣q+hg֣G%``4ؽ9p'#t[ #߬c5p&&ں!MҴ{"q$k8bFIv!ݧsH3!4b D +捛,p>` piȑRִ{.$0+o&:灱C;:e?zfɶI(5{z9xztHAn" E2J{Dnvq#Ӂm[Gҁv7n$r_}|fكbyaD]9m&v@ ?1ysC͙f@V{Ml@:̲ŒDf}:hYٲё^y@l} bJ!FDzEKv[D{*:u1tC8HEݪR$͎n{ңEy¦h$ ;u3n5F?㇧&jb +7ERE}YڛT݋[,~l-~(=H s'=N@Xv +~z=vWSS2pSm޷->-ko,ܟufЃu#-[߶mY6j?-9Mq:灤]$ӿ6ݩsfyG kK#>~mzkϑߵiސC@6OcPi +m0?r?ʊ!Q܃ײIuĉ+Vg|O8-vuR.pwV<MgA=\tg oШb`G7_Mނ8]iD3G)?$Ͽ|r٪z$*(Yĝz%$0D&S=r_~d$3Nui5Tꄦx-č|yݿ]] ;~1ϲ 1_ʷ4xԽv{}9~2ZKȇdTq`~Xp\0ofv"_#EPuE8jdSJv!k0\OCՅr5|Ag(G{ÊnrsXȃb5%b3 ;pV[oa +M,CXMo6_ KYʷʩJۊ7F* f㤈nE) 7&_ j\)E7-ԑJϪl uϵG4g`9b|u)2e 7q"}lϗa + +Zo[lfR" S{!*B +XoGs#27xITm0_ѱZ,,h6g@ +xQ\fke'y:O2.n z+#l#{' B_p~ܙrBz2z-wkEXM#t,<  Տ;5f&RVu7=^VXa}8yi|:Xrps]9%QJQA{R6 ٲȶb?Cᥭ #e4E6^ES!om {_={'c"^ϭ^H+R?a9~|'KssfSc-hqb6UmTdFt)zTlZYTcYC;*C;*qSW[<^| B 4_kXYl暾ȶmӲmelH#S3MWk]gZ* '&/$!$rM͒a8+em 1&Y (ͩjrI:@Y™ilVpzϴS!]5d3.'v +endstream +endobj +499 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 498 0 R +/Resources 4 0 R +/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +500 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-89) +>> +endobj +501 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb10-90) +>> +endobj +502 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb10-91) +>> +endobj +503 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb10-92) +>> +endobj +504 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb10-93) +>> +endobj +505 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb10-94) +>> +endobj +506 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-95) +>> +endobj +507 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-96) +>> +endobj +508 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-97) +>> +endobj +509 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-98) +>> +endobj +510 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-99) +>> +endobj +511 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-100) +>> +endobj +512 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-101) +>> +endobj +513 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 552.861778 99.933071 534.111778 ] +/BS << +/W 0 +>> +/Dest (cb10-102) +>> +endobj +514 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 533.914756 99.933071 515.164756 ] +/BS << +/W 0 +>> +/Dest (cb10-103) +>> +endobj +515 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 514.967735 99.933071 496.217735 ] +/BS << +/W 0 +>> +/Dest (cb10-104) +>> +endobj +516 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 496.020714 99.933071 477.270714 ] +/BS << +/W 0 +>> +/Dest (cb10-105) +>> +endobj +517 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 477.073692 99.933071 458.323692 ] +/BS << +/W 0 +>> +/Dest (cb10-106) +>> +endobj +518 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 458.126671 99.933071 439.376671 ] +/BS << +/W 0 +>> +/Dest (cb10-107) +>> +endobj +519 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 439.179649 99.933071 420.429649 ] +/BS << +/W 0 +>> +/Dest (cb10-108) +>> +endobj +520 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 420.232628 99.933071 401.482628 ] +/BS << +/W 0 +>> +/Dest (cb10-109) +>> +endobj +521 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 401.285606 99.933071 382.535606 ] +/BS << +/W 0 +>> +/Dest (cb10-110) +>> +endobj +522 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 382.338585 99.933071 363.588585 ] +/BS << +/W 0 +>> +/Dest (cb10-111) +>> +endobj +523 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 363.391563 99.933071 344.641563 ] +/BS << +/W 0 +>> +/Dest (cb10-112) +>> +endobj +524 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 344.444542 99.933071 325.694542 ] +/BS << +/W 0 +>> +/Dest (cb10-113) +>> +endobj +525 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 325.497520 99.933071 306.747520 ] +/BS << +/W 0 +>> +/Dest (cb10-114) +>> +endobj +526 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 306.550499 99.933071 287.800499 ] +/BS << +/W 0 +>> +/Dest (cb10-115) +>> +endobj +527 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 287.603477 99.933071 268.853477 ] +/BS << +/W 0 +>> +/Dest (cb10-116) +>> +endobj +528 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 173.921348 99.933071 155.171348 ] +/BS << +/W 0 +>> +/Dest (cb10-117) +>> +endobj +529 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 154.974327 99.933071 136.224327 ] +/BS << +/W 0 +>> +/Dest (cb10-118) +>> +endobj +530 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 136.027305 99.933071 117.277305 ] +/BS << +/W 0 +>> +/Dest (cb10-119) +>> +endobj +531 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 117.080284 99.933071 98.330284 ] +/BS << +/W 0 +>> +/Dest (cb10-120) +>> +endobj +532 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 98.133262 99.933071 79.383262 ] +/BS << +/W 0 +>> +/Dest (cb10-121) +>> +endobj +533 0 obj +<< +/Filter /FlateDecode +/Length 5065 +>> +stream +x][,~_Qφu Â1p]8CcB[fFUfxJ.!EI6W ~$2*]o?]~hƿcPwW)*orH'b6?6sus*`G&S1Ũ@ i*F@ +F9K$#Yړ"ؠDdmH l8IlhH" }HFci`D9+ЌW$5*lHh%s*D2HB>I4/>k#X `Q +8#%, s() Xr&9 댎pJX*alJZڤI ҢtpztA]뵕l?Z/+a=hIXʔ["a 'i2) OQ JH‚1D Vi 4%,LJK IX3xTH% \'[x#aAޠ&DAKX XC-Hs$,H` R4`KX&^' Rn& R/V[ oF /$,:(v%,$ě$,x3IXFO7" ,[`MD f fnMx@x3]L 4HXěl^x}&GI\1Ѐ^*.h`/U 4c$ql"LA\5Yhq@էy*@"lfɌiA{1;ٖR־ Q\R!8<,s ~ 3`3 S sY ggv)w$^c] S4~V@.-% " +M/qap~/?zv|_>0C^TCoFL7&7|׏|OSVw<> +*)%q4u\QK8h67/1rhy7=s,>2#Z C c?ް xiPLKYB^F0V9RY F!6C&f+>{7sG߄l%̒Փ7"Q!#X\QOpTUE@/Sk6*g՝\V˒ۤ$)}$x}<P( Q*}bB|Eu:T`M9*)T\Q'ܱ6tb*:/4`]j&IcCmp2l>2#z !Yx 7B4RTAWqV<[KՔn=F~Ym\y[d7n]80zs&je,e/>crʿ,~.rdž(dQn[{pܫF~Mn!RWn~ =5!(ftLw/8o\QD +2wFMaRWET#oU`\XOw[T">۴ɝm/}&yWjLQNi[޳Xd?|ӴZƞ_~g^*\TMaQǚ3|fakkuҦ зjK/-)sOZ.{Xݵsaja%` pZe>bSG &ٗcmdždmwPTGAgik%_))yB4f4?%_i'g~1O񻍾OK_ N}nE?ƠF峭9Ʈ<_&nȍ"=o%-`켖t+GZ˩gʓM啗͗HF{csjҐ /To½N}i[ n}{8ӵ;/Xc;?ЏI?(Sǫɂ^Gzim\W5uKÇq۔+1s[<\EL&{9s+,Z7>̞em1gm[yɽ:YF3|}0'C>^rۆvO2Xw4Kф6 =Z.I0|S2#>m')^_Wu^J.;LD}Me 5al+`VsEG19F&z>o8$ny MBwیseFI1H䣽#u#_;(ϯ7> Yޝ/>Y,<" N>x*l\m皙G/ȯ]'QCVLy[hΕyx0 *Esf .N.cO6w_޷Ӿ%yI7%|/KKBy>i7ר\Jںu*IH^S[fmXܴs1{h7 _db;XLsegJKV|cүпlDpֽ}WIIw[Wݨ_eIo Os[n('oQ'-sjg_ +5xDTeB;" lH6dYd|:M'kܜ69e\t2O#ް(Mރ:LTR/]'ג2>yt|Eq`)WGx=Jm%8 r Ew76[nϗшt9&7ڶkhgMcp| B,S.E{q&SxF⨐漣Q0[F'꩹̷#]HCg&pͺmꛘʗZT.'!vӭj0;})|n1_wIŞ+`e:Ә iHb9dhiK].⣐оޜz{rC_F*:T-/ TS>*ŗ͞9=t!i őw.cyLB~ݞ*u)=TuZדtuc͍dUm<}z fRwɡcۜ N:oŰ6U?FF2X5M1H0Vlį[cIv9e/58ޑsŎ[vl]%ϖO'ا͔hil6t;n4-j:uNc dU7xیbwd~l^]C׮P0wi0שJ~Jzޒ9鑳IH sJ#kiivש4 3գ}d,e6RUV0LwPκt +B||4-i5JF[[89?%B>&LU?%Z@X0w+8/_]鏑CE?|3%{QqI^W6/ +endstream +endobj +534 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 533 0 R +/Resources 4 0 R +/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +535 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb10-122) +>> +endobj +536 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb10-123) +>> +endobj +537 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb10-124) +>> +endobj +538 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb10-125) +>> +endobj +539 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb10-126) +>> +endobj +540 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb10-127) +>> +endobj +541 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb10-128) +>> +endobj +542 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb10-129) +>> +endobj +543 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 329.565778 101.433071 310.815778 ] +/BS << +/W 0 +>> +/Dest (cb11-1) +>> +endobj +544 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 310.618756 99.933071 291.868756 ] +/BS << +/W 0 +>> +/Dest (cb11-2) +>> +endobj +545 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 291.671735 99.933071 272.921735 ] +/BS << +/W 0 +>> +/Dest (cb11-3) +>> +endobj +546 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 272.724714 99.933071 253.974714 ] +/BS << +/W 0 +>> +/Dest (cb11-4) +>> +endobj +547 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 253.777692 99.933071 235.027692 ] +/BS << +/W 0 +>> +/Dest (cb11-5) +>> +endobj +548 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 234.830671 99.933071 216.080671 ] +/BS << +/W 0 +>> +/Dest (cb11-6) +>> +endobj +549 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 215.883649 99.933071 197.133649 ] +/BS << +/W 0 +>> +/Dest (cb11-7) +>> +endobj +550 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 196.936628 99.933071 178.186628 ] +/BS << +/W 0 +>> +/Dest (cb11-8) +>> +endobj +551 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 177.989606 99.933071 159.239606 ] +/BS << +/W 0 +>> +/Dest (cb11-9) +>> +endobj +552 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 159.042585 99.933071 140.292585 ] +/BS << +/W 0 +>> +/Dest (cb11-10) +>> +endobj +553 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 140.095563 99.933071 121.345563 ] +/BS << +/W 0 +>> +/Dest (cb11-11) +>> +endobj +554 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 121.148542 99.933071 102.398542 ] +/BS << +/W 0 +>> +/Dest (cb11-12) +>> +endobj +555 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 102.201520 99.933071 83.451520 ] +/BS << +/W 0 +>> +/Dest (cb11-13) +>> +endobj +556 0 obj +<< +/Filter /FlateDecode +/Length 4901 +>> +stream +x]]$IѾ_¦_ 00xqףYa¿ՕUU}ۊ3tWD~DeD>l+2;sIϗO?Iϔb0)d+1BdR > ooH0p湁>Xaw=a  w!A V{ ɂY*pb XB%kXcK5[gf 2G#&i)UdLhX`;hXH֡dΪȀsl*af*ͤJxjŀ6 ?!*dـ+~u,!)*8+"/~ `E_}:꯳qq=O~z=}ZBorw>Og~('%_nc$bEqAs:|/#yߞ~i #Y?l&/yUfDNfXJcFyN}HH֙\zHJ煎eySIx }j>vFjqa_2ZT6Ŧ Ͳ,@d 'MlvoxYFK=dwazwÈoV1vϲyh{.T{y#H=;qTZ@$bt{]*ZJv @A]W68l{6醟ʢ)h y4VY9ϠGe,fnl׆T ,l]psT[O9e=eW @zkdZk .1(:Xݷ~ە(-<^NC|}FLI Ji^jz7V>,t8FI9+5ɻHIS 546sY +4fZ5}}Y??헫"+24Y0wI͟AIfH0}u$ߥ<ޥ;{4_r[~>iThB?MRr0m{os;ww`LRng<<0\;|wckgQhqI\}8]^Riq6{/>A&jos$9{(bxv0atƙI-jBƎ꜓cCѥ0g8m7ԋ!є_4V~Ypeik\60-A+Atr;8yT4ϱ8gg\䦓Dyw <ϣ\ї݇RoE4q;y)oN?Y)YRzhȝ4ſm[ǽmh.ȣ'Cغ@<~'ӆj ͏{?5{M@teeՊ-Hd/V0sQwHy{ h{Ԃ5zhFja+mQiu .@JLU8g2qV[)S2t1ZRnx-ZќS;SX2+8nT)Ҷumkp$la]sͳ-Rտ 6j8jv> +endobj +558 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 799.173057 99.933071 780.423057 ] +/BS << +/W 0 +>> +/Dest (cb11-14) +>> +endobj +559 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb11-15) +>> +endobj +560 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 761.279014 99.933071 742.529014 ] +/BS << +/W 0 +>> +/Dest (cb11-16) +>> +endobj +561 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb11-17) +>> +endobj +562 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb11-18) +>> +endobj +563 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb11-19) +>> +endobj +564 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 685.490928 99.933071 666.740928 ] +/BS << +/W 0 +>> +/Dest (cb11-20) +>> +endobj +565 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 666.543907 99.933071 647.793907 ] +/BS << +/W 0 +>> +/Dest (cb11-21) +>> +endobj +566 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 647.596885 99.933071 628.846885 ] +/BS << +/W 0 +>> +/Dest (cb11-22) +>> +endobj +567 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 628.649864 99.933071 609.899864 ] +/BS << +/W 0 +>> +/Dest (cb11-23) +>> +endobj +568 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 609.702842 99.933071 590.952842 ] +/BS << +/W 0 +>> +/Dest (cb11-24) +>> +endobj +569 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 590.755821 99.933071 572.005821 ] +/BS << +/W 0 +>> +/Dest (cb11-25) +>> +endobj +570 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 571.808799 99.933071 553.058799 ] +/BS << +/W 0 +>> +/Dest (cb11-26) +>> +endobj +571 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 101.433071 444.418756 101.433071 425.668756 ] +/BS << +/W 0 +>> +/Dest (cb12-1) +>> +endobj +572 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 425.471735 99.933071 406.721735 ] +/BS << +/W 0 +>> +/Dest (cb12-2) +>> +endobj +573 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 406.524714 99.933071 387.774714 ] +/BS << +/W 0 +>> +/Dest (cb12-3) +>> +endobj +574 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 387.577692 99.933071 368.827692 ] +/BS << +/W 0 +>> +/Dest (cb12-4) +>> +endobj +575 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 368.630671 99.933071 349.880671 ] +/BS << +/W 0 +>> +/Dest (cb12-5) +>> +endobj +576 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 349.683649 99.933071 330.933649 ] +/BS << +/W 0 +>> +/Dest (cb12-6) +>> +endobj +577 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 330.736628 99.933071 311.986628 ] +/BS << +/W 0 +>> +/Dest (cb12-7) +>> +endobj +578 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 311.789606 99.933071 293.039606 ] +/BS << +/W 0 +>> +/Dest (cb12-8) +>> +endobj +579 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 292.842585 99.933071 274.092585 ] +/BS << +/W 0 +>> +/Dest (cb12-9) +>> +endobj +580 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 273.895563 99.933071 255.145563 ] +/BS << +/W 0 +>> +/Dest (cb12-10) +>> +endobj +581 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 254.948542 99.933071 236.198542 ] +/BS << +/W 0 +>> +/Dest (cb12-11) +>> +endobj +582 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 236.001520 99.933071 217.251520 ] +/BS << +/W 0 +>> +/Dest (cb12-12) +>> +endobj +583 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 217.054499 99.933071 198.304499 ] +/BS << +/W 0 +>> +/Dest (cb12-13) +>> +endobj +584 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 198.107477 99.933071 179.357477 ] +/BS << +/W 0 +>> +/Dest (cb12-14) +>> +endobj +585 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 179.160456 99.933071 160.410456 ] +/BS << +/W 0 +>> +/Dest (cb12-15) +>> +endobj +586 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 160.213434 99.933071 141.463434 ] +/BS << +/W 0 +>> +/Dest (cb12-16) +>> +endobj +587 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 141.266413 99.933071 122.516413 ] +/BS << +/W 0 +>> +/Dest (cb12-17) +>> +endobj +588 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 122.319391 99.933071 103.569391 ] +/BS << +/W 0 +>> +/Dest (cb12-18) +>> +endobj +589 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 103.372370 99.933071 84.622370 ] +/BS << +/W 0 +>> +/Dest (cb12-19) +>> +endobj +590 0 obj +<< +/Filter /FlateDecode +/Length 3157 +>> +stream +x͛[% ϧ8a`00$kfvWKήװ;̞n.*կ:=|%|*Z[z}|B$¿fSߒLZBk7PZ%_.t5rtGSRKTR +ĔUGlST4꽪 m5y*1VGUahaW5 RqTL#!*q +=]kDO'rQNZ9FlIJ2l,`KE<]-]-` ebO$VU]]jH)*B9$:(LR..–L:ؒآtDRZn!aO`KE]l{Pqc@,%hA V Zz-E< ĖV<1t=#0lQ\W[<@@[x,Vo8{,fqfX @.\y,0WNbJc5{,pWc"` cx,PpWwjfk% +J@Xc1܍wrpI~8[XcAwas4h \1}.qgb<$px,H.Y=;jX]ԞcAw7$p<` Lp]WZ=$pX  + @C=dp{X]J" 2Kcl5`5P)<Kt.Qi 2kۦǂ\LGjhdt\]O +A,W[֡I J-ǂa BBcDnz[.n~,Ԧ걠| r ׮BcA)Rb{,K `t J-X* {:-= ҅cAѠǂ+L C#P{:%3ǂ9X&H` 0cvX&W[$ǂZcA%RXߴ|x,h[y,h q<47z,|z,hB79I|x,h +[BW[45g݂I7A'OaKl걠lfX0&"zHZYp75ӁL DdWV8{b@@o؋ݪgZLd5Vdr EGTPgbٰ,9f1y|ן._{鿗wNE%ɖHln*l+B5 a1#JF2؊ݶɰlf3ۓ/2TIm:Vb!}@Lv+rs1#|KёEc'^C?=\o'vbp#]_~>DWl?ɼg'z~;Z{Zg^~s/zi/GF??7>|{q+B> ep {ʼn]Oc"C6<rHd7ڲ$'WXO(Ü)s_nTS?u7熯pEk9> ;YZsz_"¤rضXE]/laUb9d>m;N(sЈX]?4B RȨs@JJOz^='RctxZ- G9V~9{}>WyS|Rg ,RH[CΗžIpCcm c$ɎrtC'أrr9֞ Q6K^vb m38Nº~88ɽJpptùtѝm|ζsr߾ŮlAUqV8~D loS9d$'(>mutӶ7wK"%a(%&Ot?gkO"TT7 aT3.Z#>n}^a'8ۻbiX[Blgtp|L +endstream +endobj +591 0 obj +<< +/Type /Page +/Parent 1 0 R +/MediaBox [ 0 0 595.275591 841.889764 ] +/Contents 590 0 R +/Resources 4 0 R +/Annots [ 592 0 R 593 0 R 594 0 R 595 0 R ] +/TrimBox [ 0 0 595.275591 841.889764 ] +/BleedBox [ 0 0 595.275591 841.889764 ] +>> +endobj +592 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 780.226036 99.933071 761.476036 ] +/BS << +/W 0 +>> +/Dest (cb12-20) +>> +endobj +593 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 742.331993 99.933071 723.581993 ] +/BS << +/W 0 +>> +/Dest (cb12-21) +>> +endobj +594 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 723.384971 99.933071 704.634971 ] +/BS << +/W 0 +>> +/Dest (cb12-22) +>> +endobj +595 0 obj +<< +/Type /Annot +/Subtype /Link +/Rect [ 99.933071 704.437950 99.933071 685.687950 ] +/BS << +/W 0 +>> +/Dest (cb12-23) +>> +endobj +596 0 obj +<< +/Title (Hardening Guide with CIS v1.6 Benchmark) +/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] +/Count 14 +/First 597 0 R +/Last 608 0 R +/Parent 611 0 R +>> +endobj +597 0 obj +<< +/Title (Overview) +/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] +/Count 1 +/First 598 0 R +/Last 598 0 R +/Parent 596 0 R +/Next 599 0 R +>> +endobj +598 0 obj +<< +/Title (Known Issues) +/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] +/Count 0 +/Parent 597 0 R +>> +endobj +599 0 obj +<< +/Title (Configure Kernel Runtime Parameters) +/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] +/Count 0 +/Prev 597 0 R +/Parent 596 0 R +/Next 600 0 R +>> +endobj +600 0 obj +<< +/Title (Configure etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] +/Count 1 +/Prev 599 0 R +/First 601 0 R +/Last 601 0 R +/Parent 596 0 R +/Next 602 0 R +>> +endobj +601 0 obj +<< +/Title (Create etcd user and group) +/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] +/Count 0 +/Parent 600 0 R +>> +endobj +602 0 obj +<< +/Title (Configure default Service Account) +/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] +/Count 1 +/Prev 600 0 R +/First 603 0 R +/Last 603 0 R +/Parent 596 0 R +/Next 604 0 R +>> +endobj +603 0 obj +<< +/Title (Set automountServiceAccountToken to false for default service accounts) +/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] +/Count 0 +/Parent 602 0 R +>> +endobj +604 0 obj +<< +/Title (Configure Network Policy) +/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] +/Count 1 +/Prev 602 0 R +/First 605 0 R +/Last 605 0 R +/Parent 596 0 R +/Next 606 0 R +>> +endobj +605 0 obj +<< +/Title (Ensure that all Namespaces have Network Policies defined) +/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] +/Count 0 +/Parent 604 0 R +>> +endobj +606 0 obj +<< +/Title (Reference Hardened RKE cluster.yml Configuration) +/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] +/Count 0 +/Prev 604 0 R +/Parent 596 0 R +/Next 607 0 R +>> +endobj +607 0 obj +<< +/Title (Reference Hardened RKE Template Configuration) +/Dest [ 390 0 R /XYZ 84.259843 518.211778 0 ] +/Count 0 +/Prev 606 0 R +/Parent 596 0 R +/Next 608 0 R +>> +endobj +608 0 obj +<< +/Title (Reference Hardened cloud-config Configuration) +/Dest [ 534 0 R /XYZ 84.259843 537.158799 0 ] +/Count 2 +/Prev 607 0 R +/First 609 0 R +/Last 610 0 R +/Parent 596 0 R +>> +endobj +609 0 obj +<< +/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) +/Dest [ 534 0 R /XYZ 84.259843 397.010799 0 ] +/Count 0 +/Parent 608 0 R +/Next 610 0 R +>> +endobj +610 0 obj +<< +/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) +/Dest [ 557 0 R /XYZ 84.259843 511.863778 0 ] +/Count 0 +/Prev 609 0 R +/Parent 608 0 R +>> +endobj +611 0 obj +<< +/Count 15 +/First 596 0 R +/Last 596 0 R +>> +endobj +612 0 obj +<< +/Length1 9900 +/Filter /FlateDecode +/Length 6559 +>> +stream +x:{\UU^py? 8Tt|:)HZj +>2%S35#sdy5Ԛ;cnh6ך{0m{݋z|[{}lU2$g>6g694<4mH+?uh/@/бL= GfLMZNCc{'W`^ꏟ67g=iop~8 I0E/>w^]R*E}97DnGgfe熝߾3hzRI|GϘ;'H͙S8-;zs+WK&d͋~q0]**,!L=|Qq^@÷Ԕ d'MpG}}a*h׷Uj?xC⤮ +_0WP}QcL8@/ 6];':fꆶ?/9hYATeI ES8\v5 X'mڬ|;!UO]6O#&ׁowQ)N;$ GP? +1 +U0@MNo i}!c!`&̆BXԦisv0 gt mmmW^[:bP:=<3zB;#zQ7f:޶ rXǃЭO={̘^:$됬4;Zi|H>mZ7<.|ڌlOE xʖ7'xrOmNO7G"wo w7ŊM7~ԃ7jz 65o_kHkzYoT~r5Rr (xP~y)^/ +] +|_{/ssn"xzƷE o |SqolxLQ;Wy@c+)1ȷs[l@b&$pc(iQu nXoz+>ی]3=k5ϸ)#?Ƨ^Ջ>El> V4*'4c% TbI+\Ire=m^Zҥ$K3]ԍ \,1+.B.8K5cBDl8S8: +&0G`jƩ"pI'N08Lc 28q?>Z`!p#6>J#6|XH)ppC|pkpH |Hj*'?ȗA} O/S__ľf׆fI>x' +ό <{WO#eÞF쑈<>9xw79[w{c6_t1Z`H_ >#aJ,b5cH@]r1$ ПKS@8ډW`-E\ +sYɆF* NTrQI,4K=2/]4p5’ 稜#̣Z 4rcURO 7"AV9+I4 +pKpe!‘œ,@$5<%9K.aIN)9 aePp$ld+|p/|NhY9*vi'+2TC#gB/m"Qw= a0._{x32:| @@ 23ir:{z es&TEhN&e=E +9J#5,XChk|xJ]Z$ge!okў1\^؈lVl\0{z`XJ\0ZpBO5IWǿ[O5i{iu7|֚(92N9ӅYĎ}_Fe2$۩,_Wh* %U/ nCalJʥGIBtnJE!rTy &x\Vj5aJ0B3.͜PON#It)r/Ҕ~vNG"!6wو{aa͗Rη\C6chSJm.[*r]j%aAn"VS}`kh#%$d xA>)C)l +T\Nľ}b+&&*R¾}儨p "_ڹrt3=E߁gʸh7X z9xt ǎ㨴#"_cO, +ղX& +vLDBXxU^ U/05؟2BC [HMĤFJAHF,#t4D˩"zϿ(Xu6$_k._RKܼtUWHyEzj3ܦw> 5]層@^:`}uWC$8m]5t}#oPXDiRd~.E#VmY`ٵYחW㬂s.?:UWę^6mg }hUHbT:^pU[שC%mD[Kc˩;ԉK7)) n{Dr];T>)KZC,`ge!3?昽2[l8el?<%*~'sk>tmZ-"&ŀliWl"tP#5fB-I(ξ+w[#[Jҙhn^GUICG>;Φyާ/$pY|  ;a%|J$XgEаP(LRXX`94Lv1pХ.W7)[dȠ@kOC3SM-Mmj4:5;#z"Dƀp#"cb;|366&&OtR<^_ >f}S^TJCe|_޿Kº|k퍲Ig 3rRoW WX Us!1jBtZ 2)-$$&%'D$DzB<0O'["2222bE؛K;u. + + +ϊ( +- ++ +/(-+/rOKgJ&$IM"AbH™tOnzSV?zI/m:w|ҿߔKsJ{'vlU^{cc[4v!llYi^-8|`s `nؾ1قʃqv:AdG0kx3Ȯ)'S퐓_pj|h6 4HTɓ' {փYV/ۈ2P<$tvTyCSMS7gֆ<:&m< LxmɹsK^k=ҳ/ai6fiL-\];G7tUFrByŌJzz ;֥ᵬrIKwHN)rv\OԐڐ߆ ᩐRTWja60B!+ +]A)4Gߑ,3B7e--:3-qŵ| ^i-Vig9нLx6'1^D<3btTb}L7XFא@P-C#|HTO5 ^\8J!w/^]~!&w$ ]vP+Dsѣ͡Kkiyot;}Ι>Z|& + }G7ޜ<- `d6 g^͒K6}ݢY-( xώJ[o?S*]?Mܣq?x +vb&q큒 +(%7)`ĸ t'gYYʜ ]Fha,T**riSRh$+vUqr ltHgq·)u3|.Kqe`UXE1BQڂM|ԩomS(GMeSO_5Y-v-Ih< $da_{q +78Ǚ&ifb7NSU&8 A,Mt)$2YgϜ<ΡU~Zen&W6B>ڰh? ~RwMMm\y)4\Mdi2g0H<ߴtJio05H = CdDE6sj6_ʃ 첸͢XFcP3M I0Og) ltKu,`[^orlgiZiJfIڗ>HN ޖ@emk\͡ V!("X 0 N8z&B$jD8 &PBw1A6̅4: +9Ta\%z/yf!չik&~, hlZFYn<, icWd&$pZ_Hgs?3VRB;̦Qm-1%ItܽsMyh?yIڗ6RAe6c‡/v*Le;j n;錑tRFA: z-yT/.˧R{zqlX>#`flX>'0\͞?F +gυ +r~~tghϻegdڠ\8 _nw_}6=g(Jx k]8tWYڍ4 P +endstream +endobj +613 0 obj +<< +/Length1 6944 +/Filter /FlateDecode +/Length 4153 +>> +stream +xYyxSו>Y2/l%['ɻ,[vWɋŘLiI&MB)kMJ/4!Mffi&I6i:COsmBso=w߽{s9OF!!LEBQmr6+3Ij]ޘ-ΑDB'ۚ=M^6(61{`(Gii՗`G.Cu*OY&OgZ}O ^FJ9:.,,xB {A9ZT^n2!DqGP@軁sJ|e< eB_0 +R }6kG~3i,BD1z@4BOLj5Κ}u^ߛ>(P Zϯ:XHbIJ!Ch Y&(1HJQـ,=?.rQ#@<* /=/t +xzgCd%!Gc(Don1X̯x҉I1}A,!Ў?QDQo&)h!B oQafJ4c&:8vZAaDB-`Xg-JdbTFWF|Qdl"O +:v[WZ]j ܇)tGd܀S6aIΜ~>Wp_svSF&fpLiaN⭷`gOCYP$QRY#$b%o_{]o΍cOxϼv:L)̬ϔ5ajQ0q%zzgu}{8Q-g('?ۛmCj6ď'nhViXe8B(+ˣd˄(9-th&r¦Ic8YP(dZz{p/> 1 &dЛ$dk<*F֑Vj!lS. j6TwMS 1bQ0 )DZr4BT,U?Hc`c*cͭ# [}j\[wcp=COP|@HWT˫@ԬF3O?bhdMvU"hij,uvQiKq!AKj.UOKݒa˳LZ~ǐJr͇R՘ e2Lkp]WSSn|;N^t02[ ~ KŚi*% Òj-ASھ}QUSWT\\. ++/ףwe:uuezFyhɧr,,&1S/*#%E`/*ě׺I&b;=(. >3tGqOGc2kVQ Cw;4Xj)}Q(<<5HvRwV|,daJ\䌄*MP(uOk{SE7dZؘ_;>uTm,MVh2*u\ZׇM3䧝&/QEQPF{rসgBTW,ZG7d۳6?ܗivN;FGinw_=V]a+͖Jzr +Z +E4'> dy z#+paɴwKGG'/Mnz20~ֈB2X-4tC,̉մMMJ}*=3~t^aQZשRDRR[VgM}Kߢ{M~M^G+驣Hds\F*/}ke27hë~A7>ݜc0lq:9M]#-? e> +D$e'N_w?ػktL= Sn۾o*Vo@ ~0\L%Px +n7&=F<gK;nȄVMk[osc/"s 5+-!~Ҳsv?9yV?뷔nol:@8$BaIZ\ 7&ŽA& 43hq%ekiy4 ac =s{z빣ܱ?9!;Z+b hIe8%}.n"S3S:xWh5|>Bg`kxp݇(rV O:Jqim=*2:[x5e5_`@ EF^,kBVodæ?ܵ ?>}H&eo0R2 Ӈ=KpZ-]x%wLhܙ0*ndk N:h'c=y"LۆP%ō.- yǐvCÖ kv9>'=YYRe( r+Jdg㒗- -c@ؤ۠Z3GƷϹ^KzX@J w`Ӟ72[`<+32+˰B$}X!p}v+ϕ+~:A /0F11n92|xˡ'9)SvN[$44P$?Q7 [Qnrɲ'e,T*,[m[ڤ-9lwJ[SR-xӼfe1=7xљo`&rA`E))ϵƭNv6\>t'dk)25&xOHaq⬠; G T +e3Ml6CB-{%a ?d35kpyK1t۟>扄1Rp֠fsfPpѰĢ|W㐕%ĢF㶲|ðdSTR֓|t3K#~e2յg ˜_)e$g+6]Zm~9G3٨ϏiD7eT䛜rwDI:rg*~3]yQ|6+C@?:|v45@6? ~y!>2'>E~{,|2ZX8jUCR2۹-?l8ѝNHp Jxl]5I~Ĭi@-]vGu9Mw퉺}bVbY_V> rV.9-|_@.@o + +dSS+OSeJwWbr)2uRUyʵD\D^g\.WY.,YU&(F~v/2Rq!"RBfx6fn7\{㼲FZ`,z۞=44.x]X4]K&ISWK%\5@XR,56ex.u\jpI@4ަcl:*ݹdwkr/pDΩۓDק٠!UJRY&{o;}uN_#/ǑX#}8Fbv~|"&8> _.>pY*+2R +_vhjGŊF$s5>l%<F.jfyL&Ve6ޅdR&Jkf|?F dj|ÏV@d }ǐ x._\]Vہ 4/ *ԏQ+jC (/ =PT@Ӎv?tX#?# A}~A12 v%<j@0uA/k!X @\^kkVDFT2 \JJp@A?C;.>:p^yP `;Q09ÏG45oPUp7Fe +endstream +endobj +614 0 obj +<< +/Length1 7204 +/Filter /FlateDecode +/Length 4875 +>> +stream +x9kXUוku}.y\^ jA#H-QV1iK'!CljhjR4k6~Ik-vZ˜~68:1t:c컟k^{`BKKVV>QD +,W@ˊ*.ܱ>꟣gYEY[>br~KcE fl-;=k6qWR۸=;o+|4 چΚ߅~`win*р1+_E]T,XƊ-b"{`*gEKsKs[e֏W--+u^L}j+)a,nfσ"eLEhMt6C@=v@4i)V![ Z^H\DA:$xW ֔z~!6-/3ECNtQ7 !jDo_(* [R8CuIy!RS0/)TaʢCKC-u?hOaaO5ϜW' |e32(9{$D@|&9e)\ᓋ ?߆OqyNc2>_b"?2T[yO>|vᑇh~؏3g@_}? Ypo> c7v +w>/.ˏ_$/Ӎ;i`gvȸC6o3at*tl!hK6 o7=bC7aC@ܶ RgL{Ua-UUXC+Dcd"c]X.U$= i!| K]x7e\u2x v5EVƅEVKի>\U+e\!>\n/L \څK +|I7.2B?.3/c</0<>̛kyGk1wbnsw3 +tJƴTO a!Љ)ja2S,2Qo8{ -&$ &x7OG/UOwcgE:,?zyи'c"<&1Pp;J:1<)Lka6 Sx[t;0tE;yfsZ j\-]hMDF`A=k5F6C PcDC(q( i3b`M%2B GX׎bY,bGe4V&؅ H9<[ bm1 , A%d +&%H>шTU!ׅ-51%8YKo0/˄~# .1=˃J| 8|;$h_7`ކq~? +Ǩįv*QҰΚaֳ*_Ȗ T#մf ]QI*9hpiW!+cDIG0v)\=X 3kIf4MqEԿV&M͔ hoYM(bx]Γ+C)EOM?Y<.\hL"bY1uH*_!\L@/C +X&ƂUY+&F3Zł12bpӹD+K + %H7÷(V(pQɒpס^K/ݏU:j$5z`bH[bHfcD-0wXhPpmr,$/bUڜG6bT7 ,Cdh5,z1 m\e c%$f9VϾ"Io'pD +.(tד%BK`):!lBNjӀjm wM-RSxkRV]R+4YIɑɱk<(1fh:SԜhk 9Y~W-!!ntBC].Chssr|zH}O$jݎ+ ;V +=wtWw,]_`MfNjN6,YeQ^);\U͐-d##t*73!L(o3AUyAɗI,/d$N'>k)1$ zO'AXL(6TPYwqneHA#9:91ʵAZH_F -;:#&Ó{lu젾6Пpp8\nWSH4k͑Y$9Y$a&gΜ,K8{8JΉ^ǵUVf"KjVn| ;~șes'~Hx aUNk]Fȕri5$K yfՁw_-<ўu_]2s٩y/W俑G +0'f:Nj>1T෹ QČ"l0\S0S@`2njBo_V};?#7lԴys.yDE%fn2d˱c6_]88 :[St+%%Gwctf\U M#x-eUN.rԈk.+â>cGRӐ;{6@BVޱk;'.U9!;{ܮcf&;.^re,?IRPSL9kYYNbGxʃe:^UNv?z|4DI<"uL0;4=+ =6 A1+K*k*6si{XuWB0)Fy0|Y,QON juZ.qzzz\@vwc.)r9(Rcf M#M+ɥ{\y9"sY*<Ϻ{ r%ZJke=خk :%YG0I5my2ҾHd^a#^foc'4sZ4l|5P( Qiࡈ0lHw~|6_oɷY/*Y1d(MRtOIє 棂q-XQl9 zDHGysB}n_/,.-/4,4.- Yh_X(cdf.-Φ#, +^ ~I~KaM-x}Y +w5)ߵk*S,o_j yڻn@L2\839cʞf|ETFD|eOޙJN~ve5o+wt3jP إ:'Y9[:WH:nou:&ګӋzCtȜ:#$y'E 1X2j\Y9c c L,3ʼˠ,ɺd}!٘lJ6}3ՕIOtn.FP!$*"ʪ5 |k+޼v#kOCvN"?:7-p1$f:LO7#3fz'Mbŭ!Zt>3W9c{AD‹lܽ|G/ʿG{ѩFzOGZs@6YQt%8nS$Ir [x]Kݩκ~2p"YD5%x%"gTJd)hFzD<㐉> ZFj( hK%.븠(׉$o+Ѷ.vˏ_gq],dMn%ɥē:=X$bd4Qd6h0& +ރ VɨIZh4ꆬ7+YQP=q`\Xǎ%).y=*'"2qQC> +&MXi3P/@ i#̦i-f֙ , ]lNhz:h'IC,jUN;w *^XMNE@C>&6WMu5AeaꡐZ[z0nQU1=V{J-SIt Ci +tU* +UDy1<0׫fuu?psifc?s 7u唄iSwY? 1ޚa b(J )1C<1Zw1,`#uMjzK +,!>DuI'TVTBƖȨm lo"l/3} +endstream +endobj +615 0 obj +<< +/Length1 16324 +/Filter /FlateDecode +/Length 11653 +>> +stream +x{y|TEo-w{;4!d# K a¾*/$@D0M%2bQ1ЀD@ 9:;uo||^ԽUw9uS|OB6 (`Ġ}~8շw|P^ 2ҁK= ڱ}??4cmhv)s>0!#Λ~^ـ"Θ7̹߂{gL^ɰ?@0ck.dDB9s @#\Ϛ ' ^bh9oSGe MousB~88oS ŏp?iQ-Y0 -9 ȯ/|bܓGa&Br$"1E7&Q]R~rd=XpNMEc9y:x=륝r jQ!ObX MWH?AӉ K:~ ާyQ,Z)ٙo+tRmwrsDA@i%[|-q [CPJ܂ r(k +܏,z[h{˃4N@iۧ'PF] ^ K%/G|6x6vD%tVCՠyP_z<57dw]_DPQ@+ +P4 +V޻ǭ Dаىݻ؋{SD:ZOa>EKfE݇3.woh)'Feq_;Z[}zN/*oi8ߧvO_}SgnlpnLM>HVcŞQ؁j$`;bP6dU[mIWFZP#z{UR V{D.hvhgw4֕]Fӟ+O*ğphVZْ MozSߡ?fFO7* ,63\m_zZx^+b#o:~9 +w_0^}?cӍzSd%86A)gG]ѳ(PW3 =IFevqF1GQ;=b o}ۇ۫{ķӷa=*Z_S|:8ݡo^Lӿ>}WѽFk}eI|%1їw[ŗV?/%?2.ӝ/Xĝ }^;}:yFZXNhճ*Fz0}viu<0 0}C+A=&&;ݨp=tgRFוXuX1?X? k]]*Ft1D3$K] .1%y/ tQa. +O08 ]0Ο^?kO2:'ftV:y8L3:bFNqS,$F'2:a^`Xh1z +]dcct+PF`Fdqi06-e h>ab?FBo1-Va'i|F{W'4V_OzzMbO3YB˛g&ǫgЉyWb݁wh7F怀sihV]b4s!v@3h:ܘh\N4j)a.Tt&w 4n;Zbڑ[%$=}|C;\Md4L=mgnFf1Ѹd1n%M1 zv1h6HJd8`40F@Y@Cbh>u-#-4 SGғ8juJC{~pPPx%^(t+h-1xz +W@ *G2 (P)l[Kh9gk*G-h@8@ J;jvP"A(gDBSI&PT/e7m7~ #x~ADp Ok : Fg&Ɏ*e7e$m[G&Zt hNF2L,dA; ̈́~B̓++hO&dZ@3h1Zؒō +k;ArHs퍲h*o$D&'%~0zC#s6H;CS"l{?19J.π,V+ǔugtoV۩^FOO}C>uRvƻ&){syE̳n}`m[a{3uN`r䎤SΙYbZcmIXi0D4->sU٪e#je!;).}9NQ"%Esn@D641yp{֍buB([LAAǘTbb;Q!nJAqa5dd@YYčk(~ڦ}<=_z-躲䅹Yƾ#:F-\Z9}576zq }^ s;뚳;4; % wQ~E]JPHCЕ q-.l0I;s&MBa Jorp&t'ζldڒ֭>vu+ |pc3tʜ + +lzoNnFa';˖ٙq.ٚYKYw\ݤvcE-F=)h5,*o-~QZx\:G{,2@^WK-Ǿpɟc.M'p}CVn~Z']ܓ/`o{ 9rnO)sWIՎW: jw%X\4>Ʈ盭hɡ7 %g*[vooxw޿;60sۅ$|o&;ٹjw/hEbc?cK1V}xLBDdrQi:䲥Lmv6k1')@*&J\~}U/g֮C_^vSWl|f=z,\xwX=laGᯣ>j|ݰUꈐtJR#8k6TXdΠh#+[Hk,̎<=vנ#O46(z0C\Cݽ2>`cz׃Ć%|23KȬi!MvYRmg{ҳ85$Kw=4Ľ[}}RLa[j@1B?/7T)>*ui2 ʸoK[GMO#'y,)maBP֡vސ e0!4$F#Z;ma((uƅGPzHOpeK..FN<,v>tј՝' }Rv5b/w裵O8ni>W }xW\fA,kÛws I#P*X4Ԁ5*TRCr{3Ù3UN9ٚåx +JUS.d3|2@b'NqN,ﮪ֠ 4>o)0e@KE$׵$ 㖣WS;͓w@Y JdrqBg"veID7%$9AɥWKGERnU` +}'ILGC|D: 獒n>}ebd+JU\Fߜtb' ;<\V$`X*(<ϔx>na.>~1t7CN dK`kN!:U0nȒmaSm0"efB۫KK~Sk뭟\_Å8}dk r22\W;jK4?agfQ" 1Ŋ\ {`F%g"pW^x~F6 wi1֒-|~{x_@!v@LUC*zKrP/ 5T'QZQ5ͮ YXh8k|-g +.:WmhAۃ;A+sҋ^ܼ4yǾ`78u߷&[oaݚxth &RtDV=11|Uua>+~,u;,o4#9W,\P'S@@2򚤀3Ʌx+Z"͂SE, Kzmu2^ڐuj .s]4ugsQ|f&ot4!a9vQOř s +kgϪ'tyûv5|\z?wvqsDئeB0τGHRCH(FD"X@xܔڠx8ϱ7ـsb8wg<0UtNPuTիz"ÜE&J Ȁ=ȐBQV1UI/K~aਹ[{_07 14FQRʗcQ'G %|Dl$<C&ɥBUugFx )Xi݈L#v σY8|;;,Mge[X-}xmptE''ĒN[ѡ[.ήǢ-\8lXށ`Q(f +Qmn|.l} Q #KO,Ijʗ!rwk4RiB"7ZUVnÆu%eW:>7)T_OR>y/.}N8ɇoxԂÏVPKU6 +",-mYՄ(x??؃G.2/gNRuy;=s]{p>lS&{RmjQզ\8@4#c;Uv\VRR^^RRFϑ^?7o> +wl٣ _oB?E Ǜ Vu:,U;! hJ,P F,A%rSВ7A8$ +F&yYDze%{-d !؀^ٷiحYC9ڛ•ȃ_S^_gџ_!uIoӛn-/M} u+uШ>INXle] /(\غ. 'x>.za?^| b#1"+V+\G-1M1 ^66MV,0D] +ktbӯ*VhJO׸4at5v›8٪Sp!;"8c`Ò1۲·( mpBje!IDQBIdbR@%dUQ{Rb{+*d9rҟʣ:K%͒ѧe29Wmsl_ϱ1$ ˃U)$Yj!I?P',i)" 3Y5v' _UOy̳xGobͬd)CE,m<nլ [G AAת݈{Gw j-ڋ7UHST9UIե8=~'"y)~V{2 vݓӿ0 Fos]j}nъZW5?,GaҤnyg+׳Wluf0iD{WOpZf,UP#ܛ=4gKf_aO?]7^knK>n/`g'm`#/ިqTcj~(e<SJR5jkmz=dk,űT3,V/^u(ZZmq¯,)poKN|~G¤ϟ\ߎeX$%^;ihW;P9>*G*BR@*>$R2ʒ=O@|(o?z o[\U-=xU!5Wf>nF,_wS rtݦ+wv23^FL1[VZt-]_ 3 +dȊ)u0J0hn֨}!g%.6a’r!UnʖgȤJ#O# *>f3?L}mVWz[Ep&L{{>'32e1p0 ri7 s?a! F{gWFʷ?F_0Q""\]|GA$Aޭiсz!l:|U`KhAp1JFc (w bV:rH#J7CPWoFGYt0K_JO)=O6/1jDMVgYLuYE Ujȭ-<;^uξ>I[5dzvՁ D2?@ +O0uNuTzdsdUY')T$SAr55,A#Odzx,xQjY#TD D&V6z}' +ZZay cs|3!zPi2r#.xi ~Z&i2-!FdUǭc!VWl''؁/?#Ֆ5XŦ,K-D*pC1`b-FU^(Ʉi2p}S;muޣ!@8;x `V: "L,]䍢|&(NQe:KHHr\hG(QGQHFg+KrE?1]ɭ+ZaYaU\\di `vh73K]c(P~WwQǠSv(ZCņwW͢wX; +~j[ml =F[p<ϯ̩cW~T<6v1U4<ŕOTpqKMiʑ& Rt7v~ɽRm{7;j0+zGYc) +Duw#Oox#f~= ("݂6t^hRSM$} {o9f#79ލsܣh"7={cQ喋?T=Qŭe47zQ,u#2X( }KhzB3LnB)pG,ʇ{EP@dl!wZO4X4>EZk3Ka_ w7fh 1 TfhwBӏ*atg}wvtkT8Ap|(P9pZL.2PCϷ=, ާh̯:'iwj/.Ԏ֎\7.Moo/e\w # @G43xwзw/H;p<#i&?1y +J쉹(uԹׇ~ mZD +endstream +endobj +616 0 obj +<< +/Type /FontDescriptor +/FontName /ICOIPK+DejaVuSans +/FontFamily (DejaVu Sans) +/Flags 4 +/FontBBox [ 0 -14 472 560 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 560 +/StemV 80 +/StemH 80 +/FontFile2 612 0 R +>> +endobj +617 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /ICOIPK+DejaVuSans +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 42 [ 774 751 294 ] 54 [ 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] +/FontDescriptor 616 0 R +>> +endobj +618 0 obj +<< +/Length 702 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +27 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0052> <006f> +<0056> <0073> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +619 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /ICOIPK+DejaVuSans +/Encoding /Identity-H +/DescendantFonts [ 617 0 R ] +/ToUnicode 618 0 R +>> +endobj +620 0 obj +<< +/Type /FontDescriptor +/FontName /TGPMTG+Poppins +/FontFamily (Poppins) +/Flags 4 +/FontBBox [ -27 -260 122 795 ] +/ItalicAngle 0 +/Ascent 1049 +/Descent -349 +/CapHeight 795 +/StemV 80 +/StemH 80 +/FontFile2 613 0 R +>> +endobj +621 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /TGPMTG+Poppins +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] +/FontDescriptor 620 0 R +>> +endobj +622 0 obj +<< +/Length 1248 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +66 beginbfchar +<002b> <0048> +<0044> <0061> +<0055> <0072> +<0047> <0064> +<0048> <0065> +<0051> <006e> +<004c> <0069> +<004a> <0067> +<0003> <0020> +<002a> <0047> +<0058> <0075> +<005a> <0077> +<0057> <0074> +<004b> <0068> +<0026> <0043> +<002c> <0049> +<0036> <0053> +<0059> <0076> +<0014> <0031> +<0011> <002e> +<0019> <0036> +<0025> <0042> +<0046> <0063> +<0050> <006d> +<004e> <006b> +<0016> <0033> +<0017> <0034> +<0018> <0035> +<001a> <0037> +<0015> <0032> +<0013> <0030> +<0032> <004f> +<0052> <006f> +<0049> <0066> +<002e> <004b> +<004f> <006c> +<0035> <0052> +<0033> <0050> +<0056> <0073> +<0053> <0070> +<0024> <0041> +<0031> <004e> +<005c> <0079> +<0028> <0045> +<0037> <0054> +<0010> <002d> +<0045> <0062> +<0054> <0071> +<000b> <0028> +<000c> <0029> +<000f> <002c> +<001d> <003a> +<0039> <0056> +<001b> <0038> +<001c> <0039> +<0027> <0044> +<0029> <0046> +<00d1> <2022> +<005b> <0078> +<003a> <0057> +<0038> <0055> +<00ce> <201c> +<00cf> <201d> +<004d> <006a> +<002f> <004c> +<000a> <0027> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +623 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /TGPMTG+Poppins +/Encoding /Identity-H +/DescendantFonts [ 621 0 R ] +/ToUnicode 622 0 R +>> +endobj +624 0 obj +<< +/Type /FontDescriptor +/FontName /WKJFDI+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 5 +/FontBBox [ 0 -14 584 759 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 759 +/StemV 80 +/StemH 80 +/FontFile2 614 0 R +>> +endobj +625 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /WKJFDI+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] +/FontDescriptor 624 0 R +>> +endobj +626 0 obj +<< +/Length 674 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +25 beginbfchar +<0048> <0065> +<0057> <0074> +<0046> <0063> +<0047> <0064> +<0049> <0066> +<0044> <0061> +<0058> <0075> +<004f> <006c> +<0056> <0073> +<0055> <0072> +<0011> <002e> +<005c> <0079> +<0050> <006d> +<0042> <005f> +<0053> <0070> +<0052> <006f> +<004c> <0069> +<001d> <003a> +<0010> <002d> +<0051> <006e> +<0036> <0053> +<0059> <0076> +<0024> <0041> +<0037> <0054> +<004e> <006b> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +627 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /WKJFDI+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 625 0 R ] +/ToUnicode 626 0 R +>> +endobj +628 0 obj +<< +/Type /FontDescriptor +/FontName /TGTVMX+DejaVuSansMono +/FontFamily (DejaVu Sans Mono) +/Flags 4 +/FontBBox [ 0 -235 585 699 ] +/ItalicAngle 0 +/Ascent 928 +/Descent -235 +/CapHeight 699 +/StemV 80 +/StemH 80 +/FontFile2 615 0 R +>> +endobj +629 0 obj +<< +/Type /Font +/Subtype /CIDFontType2 +/BaseFont /TGTVMX+DejaVuSansMono +/CIDSystemInfo << +/Registry (Adobe) +/Ordering (Identity) +/Supplement 0 +>> +/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] +/FontDescriptor 628 0 R +>> +endobj +630 0 obj +<< +/Length 1500 +>> +stream +/CIDInit /ProcSet findresource begin +12 dict begin +begincmap +/CIDSystemInfo +<< /Registry (Adobe) +/Ordering (UCS) +/Supplement 0 +>> def +/CMapName /Adobe-Identity-UCS def +/CMapType 2 def +1 begincodespacerange +<0000> +endcodespacerange +84 beginbfchar +<0056> <0073> +<005c> <0079> +<0046> <0063> +<0057> <0074> +<004f> <006c> +<0012> <002f> +<0048> <0065> +<0011> <002e> +<0047> <0064> +<001c> <0039> +<0013> <0030> +<0010> <002d> +<004e> <006b> +<0058> <0075> +<0045> <0062> +<0052> <006f> +<0051> <006e> +<0049> <0066> +<0059> <0076> +<0050> <006d> +<0055> <0072> +<004c> <0069> +<0042> <005f> +<0020> <003d> +<0014> <0031> +<0053> <0070> +<0044> <0061> +<005b> <0078> +<0015> <0032> +<0018> <0035> +<0003> <0020> +<0016> <0033> +<0017> <0034> +<004a> <0067> +<0005> <0022> +<004b> <0068> +<001d> <003a> +<0036> <0053> +<0024> <0041> +<0037> <0054> +<0039> <0056> +<000e> <002b> +<0006> <0023> +<0004> <0021> +<0007> <0024> +<000b> <0028> +<004d> <006a> +<005e> <007b> +<003e> <005b> +<000d> <002a> +<0040> <005d> +<000a> <0027> +<0060> <007d> +<000c> <0029> +<001e> <003b> +<005a> <0077> +<0031> <004e> +<0033> <0050> +<001b> <0038> +<002c> <0049> +<0028> <0045> +<002e> <004b> +<000f> <002c> +<0035> <0052> +<0054> <0071> +<0027> <0044> +<0026> <0043> +<002f> <004c> +<002b> <0048> +<003a> <0057> +<002a> <0047> +<0030> <004d> +<0019> <0036> +<0032> <004f> +<003c> <0059> +<001a> <0037> +<005f> <007c> +<0038> <0055> +<0009> <0026> +<0029> <0046> +<005d> <007a> +<0025> <0042> +<0043> <0060> +<0008> <0025> +endbfchar +endcmap +CMapName currentdict /CMap defineresource pop +end +end +endstream +endobj +631 0 obj +<< +/Type /Font +/Subtype /Type0 +/BaseFont /TGTVMX+DejaVuSansMono +/Encoding /Identity-H +/DescendantFonts [ 629 0 R ] +/ToUnicode 630 0 R +>> +endobj +632 0 obj +<< +/ICOIPK 619 0 R +/TGPMTG 623 0 R +/WKJFDI 627 0 R +/TGTVMX 631 0 R +>> +endobj +xref +0 633 +0000000000 65535 f +0000000015 00000 n +0000000235 00000 n +0000000351 00000 n +0000027525 00000 n +0000027658 00000 n +0000030309 00000 n +0000030508 00000 n +0000034100 00000 n +0000034450 00000 n +0000034584 00000 n +0000034720 00000 n +0000034882 00000 n +0000035045 00000 n +0000035201 00000 n +0000035358 00000 n +0000035515 00000 n +0000035675 00000 n +0000035836 00000 n +0000035997 00000 n +0000036148 00000 n +0000036300 00000 n +0000036475 00000 n +0000036651 00000 n +0000036827 00000 n +0000036999 00000 n +0000037172 00000 n +0000037344 00000 n +0000037517 00000 n +0000037690 00000 n +0000042711 00000 n +0000043015 00000 n +0000043265 00000 n +0000043401 00000 n +0000043564 00000 n +0000043721 00000 n +0000043878 00000 n +0000044039 00000 n +0000044200 00000 n +0000044352 00000 n +0000044525 00000 n +0000044698 00000 n +0000044871 00000 n +0000045133 00000 n +0000045393 00000 n +0000050574 00000 n +0000050829 00000 n +0000051084 00000 n +0000051217 00000 n +0000051348 00000 n +0000051479 00000 n +0000051610 00000 n +0000051741 00000 n +0000056745 00000 n +0000057042 00000 n +0000057175 00000 n +0000057306 00000 n +0000057439 00000 n +0000057570 00000 n +0000057701 00000 n +0000057832 00000 n +0000057965 00000 n +0000058098 00000 n +0000058229 00000 n +0000058360 00000 n +0000058491 00000 n +0000058622 00000 n +0000063591 00000 n +0000063860 00000 n +0000063993 00000 n +0000064124 00000 n +0000064255 00000 n +0000064386 00000 n +0000064517 00000 n +0000064713 00000 n +0000064972 00000 n +0000065203 00000 n +0000070823 00000 n +0000071176 00000 n +0000071309 00000 n +0000071440 00000 n +0000071571 00000 n +0000071702 00000 n +0000071833 00000 n +0000071964 00000 n +0000072095 00000 n +0000072226 00000 n +0000072357 00000 n +0000072489 00000 n +0000072621 00000 n +0000072753 00000 n +0000072885 00000 n +0000073017 00000 n +0000073150 00000 n +0000073281 00000 n +0000073412 00000 n +0000073543 00000 n +0000073674 00000 n +0000073903 00000 n +0000079315 00000 n +0000079752 00000 n +0000079990 00000 n +0000080124 00000 n +0000080256 00000 n +0000080388 00000 n +0000080520 00000 n +0000080652 00000 n +0000080784 00000 n +0000080916 00000 n +0000081048 00000 n +0000081180 00000 n +0000081313 00000 n +0000081446 00000 n +0000081579 00000 n +0000081712 00000 n +0000081845 00000 n +0000081978 00000 n +0000082111 00000 n +0000082244 00000 n +0000082377 00000 n +0000082510 00000 n +0000082643 00000 n +0000082776 00000 n +0000082909 00000 n +0000083042 00000 n +0000083175 00000 n +0000083308 00000 n +0000083441 00000 n +0000083573 00000 n +0000088687 00000 n +0000089166 00000 n +0000089299 00000 n +0000089432 00000 n +0000089565 00000 n +0000089698 00000 n +0000089831 00000 n +0000089964 00000 n +0000090097 00000 n +0000090230 00000 n +0000090363 00000 n +0000090496 00000 n +0000090629 00000 n +0000090762 00000 n +0000090895 00000 n +0000091028 00000 n +0000091161 00000 n +0000091294 00000 n +0000091427 00000 n +0000091560 00000 n +0000091693 00000 n +0000091826 00000 n +0000091959 00000 n +0000092092 00000 n +0000092225 00000 n +0000092358 00000 n +0000092491 00000 n +0000092624 00000 n +0000092757 00000 n +0000092890 00000 n +0000093023 00000 n +0000093156 00000 n +0000093289 00000 n +0000093421 00000 n +0000093552 00000 n +0000098511 00000 n +0000098950 00000 n +0000099083 00000 n +0000099216 00000 n +0000099349 00000 n +0000099482 00000 n +0000099615 00000 n +0000099748 00000 n +0000099881 00000 n +0000100014 00000 n +0000100147 00000 n +0000100280 00000 n +0000100413 00000 n +0000100546 00000 n +0000100679 00000 n +0000100812 00000 n +0000100945 00000 n +0000101078 00000 n +0000101211 00000 n +0000101344 00000 n +0000101477 00000 n +0000101610 00000 n +0000101743 00000 n +0000101876 00000 n +0000102009 00000 n +0000102142 00000 n +0000102275 00000 n +0000102408 00000 n +0000102540 00000 n +0000102671 00000 n +0000107769 00000 n +0000108272 00000 n +0000108405 00000 n +0000108538 00000 n +0000108671 00000 n +0000108804 00000 n +0000108937 00000 n +0000109070 00000 n +0000109203 00000 n +0000109336 00000 n +0000109469 00000 n +0000109602 00000 n +0000109735 00000 n +0000109869 00000 n +0000110003 00000 n +0000110137 00000 n +0000110271 00000 n +0000110405 00000 n +0000110539 00000 n +0000110673 00000 n +0000110807 00000 n +0000110941 00000 n +0000111075 00000 n +0000111209 00000 n +0000111343 00000 n +0000111477 00000 n +0000111611 00000 n +0000111745 00000 n +0000111879 00000 n +0000112013 00000 n +0000112147 00000 n +0000112281 00000 n +0000112415 00000 n +0000112549 00000 n +0000112683 00000 n +0000112817 00000 n +0000112950 00000 n +0000113082 00000 n +0000117606 00000 n +0000118109 00000 n +0000118243 00000 n +0000118377 00000 n +0000118511 00000 n +0000118645 00000 n +0000118779 00000 n +0000118913 00000 n +0000119047 00000 n +0000119181 00000 n +0000119315 00000 n +0000119449 00000 n +0000119583 00000 n +0000119717 00000 n +0000119851 00000 n +0000119985 00000 n +0000120119 00000 n +0000120253 00000 n +0000120387 00000 n +0000120521 00000 n +0000120655 00000 n +0000120789 00000 n +0000120923 00000 n +0000121057 00000 n +0000121191 00000 n +0000121325 00000 n +0000121459 00000 n +0000121593 00000 n +0000121727 00000 n +0000121861 00000 n +0000121995 00000 n +0000122129 00000 n +0000122263 00000 n +0000122397 00000 n +0000122531 00000 n +0000122665 00000 n +0000122798 00000 n +0000122930 00000 n +0000127159 00000 n +0000127678 00000 n +0000127812 00000 n +0000127946 00000 n +0000128080 00000 n +0000128214 00000 n +0000128348 00000 n +0000128482 00000 n +0000128616 00000 n +0000128750 00000 n +0000128884 00000 n +0000129018 00000 n +0000129152 00000 n +0000129286 00000 n +0000129420 00000 n +0000129554 00000 n +0000129688 00000 n +0000129822 00000 n +0000129956 00000 n +0000130090 00000 n +0000130224 00000 n +0000130358 00000 n +0000130492 00000 n +0000130626 00000 n +0000130760 00000 n +0000130894 00000 n +0000131028 00000 n +0000131162 00000 n +0000131296 00000 n +0000131430 00000 n +0000131564 00000 n +0000131698 00000 n +0000131832 00000 n +0000131966 00000 n +0000132100 00000 n +0000132234 00000 n +0000132368 00000 n +0000132502 00000 n +0000132635 00000 n +0000132767 00000 n +0000137769 00000 n +0000138288 00000 n +0000138422 00000 n +0000138556 00000 n +0000138690 00000 n +0000138824 00000 n +0000138958 00000 n +0000139092 00000 n +0000139226 00000 n +0000139360 00000 n +0000139494 00000 n +0000139628 00000 n +0000139762 00000 n +0000139896 00000 n +0000140030 00000 n +0000140164 00000 n +0000140298 00000 n +0000140432 00000 n +0000140566 00000 n +0000140700 00000 n +0000140834 00000 n +0000140968 00000 n +0000141102 00000 n +0000141236 00000 n +0000141370 00000 n +0000141504 00000 n +0000141638 00000 n +0000141772 00000 n +0000141906 00000 n +0000142040 00000 n +0000142174 00000 n +0000142308 00000 n +0000142442 00000 n +0000142576 00000 n +0000142710 00000 n +0000142844 00000 n +0000142978 00000 n +0000143112 00000 n +0000143245 00000 n +0000143377 00000 n +0000148406 00000 n +0000148925 00000 n +0000149059 00000 n +0000149193 00000 n +0000149327 00000 n +0000149461 00000 n +0000149595 00000 n +0000149729 00000 n +0000149863 00000 n +0000149997 00000 n +0000150131 00000 n +0000150265 00000 n +0000150399 00000 n +0000150533 00000 n +0000150667 00000 n +0000150801 00000 n +0000150935 00000 n +0000151069 00000 n +0000151203 00000 n +0000151337 00000 n +0000151471 00000 n +0000151605 00000 n +0000151739 00000 n +0000151873 00000 n +0000152007 00000 n +0000152141 00000 n +0000152275 00000 n +0000152409 00000 n +0000152543 00000 n +0000152677 00000 n +0000152811 00000 n +0000152945 00000 n +0000153079 00000 n +0000153213 00000 n +0000153347 00000 n +0000153481 00000 n +0000153615 00000 n +0000153749 00000 n +0000153882 00000 n +0000154014 00000 n +0000159201 00000 n +0000159680 00000 n +0000159814 00000 n +0000159948 00000 n +0000160082 00000 n +0000160216 00000 n +0000160350 00000 n +0000160484 00000 n +0000160618 00000 n +0000160752 00000 n +0000160886 00000 n +0000161020 00000 n +0000161154 00000 n +0000161288 00000 n +0000161422 00000 n +0000161556 00000 n +0000161786 00000 n +0000161921 00000 n +0000162054 00000 n +0000162187 00000 n +0000162320 00000 n +0000162453 00000 n +0000162586 00000 n +0000162719 00000 n +0000162852 00000 n +0000162985 00000 n +0000163119 00000 n +0000163253 00000 n +0000163387 00000 n +0000163521 00000 n +0000163655 00000 n +0000163789 00000 n +0000163923 00000 n +0000164056 00000 n +0000164188 00000 n +0000169046 00000 n +0000169557 00000 n +0000169691 00000 n +0000169825 00000 n +0000169959 00000 n +0000170093 00000 n +0000170227 00000 n +0000170361 00000 n +0000170495 00000 n +0000170629 00000 n +0000170763 00000 n +0000170897 00000 n +0000171031 00000 n +0000171165 00000 n +0000171299 00000 n +0000171433 00000 n +0000171567 00000 n +0000171701 00000 n +0000171835 00000 n +0000171969 00000 n +0000172103 00000 n +0000172237 00000 n +0000172371 00000 n +0000172505 00000 n +0000172639 00000 n +0000172773 00000 n +0000172907 00000 n +0000173041 00000 n +0000173175 00000 n +0000173309 00000 n +0000173443 00000 n +0000173577 00000 n +0000173711 00000 n +0000173845 00000 n +0000173979 00000 n +0000174113 00000 n +0000174247 00000 n +0000174380 00000 n +0000174512 00000 n +0000179215 00000 n +0000179694 00000 n +0000179828 00000 n +0000179962 00000 n +0000180096 00000 n +0000180230 00000 n +0000180364 00000 n +0000180498 00000 n +0000180632 00000 n +0000180766 00000 n +0000180900 00000 n +0000181034 00000 n +0000181168 00000 n +0000181302 00000 n +0000181436 00000 n +0000181570 00000 n +0000181704 00000 n +0000181838 00000 n +0000181972 00000 n +0000182106 00000 n +0000182240 00000 n +0000182374 00000 n +0000182508 00000 n +0000182642 00000 n +0000182776 00000 n +0000182910 00000 n +0000183044 00000 n +0000183178 00000 n +0000183312 00000 n +0000183446 00000 n +0000183580 00000 n +0000183714 00000 n +0000183848 00000 n +0000183981 00000 n +0000184113 00000 n +0000189306 00000 n +0000189785 00000 n +0000189919 00000 n +0000190053 00000 n +0000190187 00000 n +0000190321 00000 n +0000190455 00000 n +0000190589 00000 n +0000190723 00000 n +0000190857 00000 n +0000190991 00000 n +0000191125 00000 n +0000191259 00000 n +0000191394 00000 n +0000191529 00000 n +0000191664 00000 n +0000191799 00000 n +0000191934 00000 n +0000192069 00000 n +0000192204 00000 n +0000192339 00000 n +0000192474 00000 n +0000192609 00000 n +0000192744 00000 n +0000192879 00000 n +0000193014 00000 n +0000193149 00000 n +0000193284 00000 n +0000193419 00000 n +0000193554 00000 n +0000193689 00000 n +0000193824 00000 n +0000193959 00000 n +0000194093 00000 n +0000194226 00000 n +0000199366 00000 n +0000199749 00000 n +0000199884 00000 n +0000200019 00000 n +0000200154 00000 n +0000200289 00000 n +0000200424 00000 n +0000200559 00000 n +0000200694 00000 n +0000200829 00000 n +0000200964 00000 n +0000201097 00000 n +0000201230 00000 n +0000201363 00000 n +0000201496 00000 n +0000201629 00000 n +0000201762 00000 n +0000201895 00000 n +0000202028 00000 n +0000202162 00000 n +0000202296 00000 n +0000202430 00000 n +0000202563 00000 n +0000207539 00000 n +0000208010 00000 n +0000208144 00000 n +0000208278 00000 n +0000208412 00000 n +0000208546 00000 n +0000208680 00000 n +0000208814 00000 n +0000208948 00000 n +0000209082 00000 n +0000209216 00000 n +0000209350 00000 n +0000209484 00000 n +0000209618 00000 n +0000209752 00000 n +0000209887 00000 n +0000210020 00000 n +0000210153 00000 n +0000210286 00000 n +0000210419 00000 n +0000210552 00000 n +0000210685 00000 n +0000210818 00000 n +0000210951 00000 n +0000211085 00000 n +0000211219 00000 n +0000211353 00000 n +0000211487 00000 n +0000211621 00000 n +0000211755 00000 n +0000211889 00000 n +0000212023 00000 n +0000212157 00000 n +0000212290 00000 n +0000215522 00000 n +0000215769 00000 n +0000215903 00000 n +0000216037 00000 n +0000216171 00000 n +0000216305 00000 n +0000216476 00000 n +0000216630 00000 n +0000216745 00000 n +0000216911 00000 n +0000217100 00000 n +0000217229 00000 n +0000217422 00000 n +0000217595 00000 n +0000217779 00000 n +0000217938 00000 n +0000218117 00000 n +0000218294 00000 n +0000218486 00000 n +0000218704 00000 n +0000218916 00000 n +0000218978 00000 n +0000225626 00000 n +0000229868 00000 n +0000234832 00000 n +0000246576 00000 n +0000246808 00000 n +0000247198 00000 n +0000247953 00000 n +0000248103 00000 n +0000248332 00000 n +0000248864 00000 n +0000250166 00000 n +0000250313 00000 n +0000250554 00000 n +0000250927 00000 n +0000251654 00000 n +0000251808 00000 n +0000252050 00000 n +0000252644 00000 n +0000254198 00000 n +0000254352 00000 n +trailer +<< +/Size 633 +/Root 3 0 R +/Info 2 0 R +>> +startxref +254439 +%%EOF diff --git a/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md new file mode 100644 index 00000000000..51a6df997f8 --- /dev/null +++ b/content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/_index.md @@ -0,0 +1,641 @@ +--- +title: Hardening Guide with CIS v1.6 Benchmark +weight: 100 +--- + +This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.6.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. + +This hardening guide is intended to be used for RKE clusters and associated with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +| --- | --- | --- | +| Rancher v2.6.3 | Benchmark v1.6 | Kubernetes v1.18, v1.19, v1.20 and v1.21 | + +[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf). + +- [Overview](#overview) +- [Configure Kernel Runtime Parameters](#configure-kernel-runtime-parameters) +- [Configure `etcd` user and group](#configure-etcd-user-and-group) +- [Configure `default` service account](#configure-default-service-account) +- [Configure Network Policy](#configure-network-policy) +- [Reference Hardened RKE `cluster.yml` Configuration](#reference-hardened-rke-cluster-yml-configuration) +- [Reference Hardened RKE Template Configuration](#reference-hardened-rke-template-configuration) +- [Reference Hardened **cloud-config** Configuration](#reference-hardened-cloud-config-configuration) + +### Overview + +This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.6.3 with Kubernetes v1.18 up to v1.21 or provisioning a RKE cluster with Kubernetes v1.18 up to v.21 to be used within Rancher v2.6.3. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). + +For more details about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.6]({{}}/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/). + +#### Known Issues + +- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS v1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. +- When setting the `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided]({{}}/rancher/v2.6/en/admin-settings/pod-security-policies/) by Rancher, Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS v1.6 check 5.1.5 requires that the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +### Configure Kernel Runtime Parameters + +The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: + +```ini +vm.overcommit_memory=1 +vm.panic_on_oom=0 +kernel.panic=10 +kernel.panic_on_oops=1 +kernel.keys.root_maxbytes=25000000 +``` + +Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings. + +### Configure `etcd` user and group + +A user account and group for the **etcd** service is required to be setup before installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time. + +#### Create `etcd` user and group + +To create the **etcd** user and group run the following console commands. The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. + +```bash +groupadd --gid 52034 etcd +useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: + +```yaml +services: + etcd: + gid: 52034 + uid: 52034 +``` + +### Configure `default` Service Account + +#### Set `automountServiceAccountToken` to `false` for `default` service accounts + +Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments. + +For each namespace including **default** and **kube-system** on a standard RKE install, the **default** service account must include this value: + +```yaml +automountServiceAccountToken: false +``` + +Save the following configuration to a file called `account_update.yaml`. + +```yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: default +automountServiceAccountToken: false +``` + +Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do + kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)" +done +``` + +### Configure Network Policy + +#### Ensure that all Namespaces have Network Policies defined + +Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate only with those they are supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. + +Network Policies are namespace scoped. When a network policy is introduced to a given namespace, all traffic not allowed by the policy is denied. However, if there are no network policies in a namespace all traffic will be allowed into and out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses [Canal](https://github.com/projectcalico/canal) to provide the policy enforcement. Additional information about CNI providers can be found [here](https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/). + +Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a **permissive** example is provided below. If you want to allow all traffic to all pods in a namespace (even if policies are added that cause some pods to be treated as “isolated”), you can create a policy that explicitly allows all traffic in that namespace. Save the following configuration as `default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) about network policies can be found on the Kubernetes site. + +> This `NetworkPolicy` is just an example and is not recommended for production use. + +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress +``` + +Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. + +```bash +#!/bin/bash -e + +for namespace in $(kubectl get namespaces -A -o=jsonpath="{.items[*]['metadata.name']}"); do + kubectl apply -f default-allow-all.yaml -n ${namespace} +done +``` + +Execute this script to apply the `default-allow-all.yaml` configuration with the **permissive** `NetworkPolicy` to all namespaces. + +### Reference Hardened RKE `cluster.yml` Configuration + +The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install of Rancher Kubernetes Engine (RKE). RKE install [documentation]({{}}/rke/latest/en/installation/) is provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration in RKE can be found [here]({{}}/rke/latest/en/config-options/nodes/). + +> For a Kubernetes v1.18 cluster, the configuration `spec.volumes: 'ephemeral'` should be removed from the `PodSecurityPolicy`, since it's not supported in this Kubernetes release. + +```yaml +# If you intend to deploy Kubernetes in an air-gapped environment, +# please consult the documentation on how to configure custom RKE images. +# https://rancher.com/docs/rke/latest/en/installation/ . + +# The nodes directive is required and will vary depending on your environment. +# Documentation for node configuration can be found here: +# https://rancher.com/docs/rke/latest/en/config-options/nodes/ +nodes: [] +services: + etcd: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + external_urls: [] + ca_cert: "" + cert: "" + key: "" + path: "" + uid: 52034 + gid: 52034 + snapshot: false + retention: "" + creation: "" + backup_config: null + kube-api: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + service_cluster_ip_range: "" + service_node_port_range: "" + pod_security_policy: true + always_pull_images: false + secrets_encryption_config: + enabled: true + custom_config: null + audit_log: + enabled: true + configuration: null + admission_configuration: null + event_rate_limit: + enabled: true + configuration: null + kube-controller: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_cidr: "" + service_cluster_ip_range: "" + scheduler: + image: "" + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + kubelet: + image: "" + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] + cluster_domain: cluster.local + infra_container_image: "" + cluster_dns_server: "" + fail_swap_on: false + generate_serving_certificate: true + kubeproxy: + image: "" + extra_args: {} + extra_binds: [] + extra_env: [] + win_extra_args: {} + win_extra_binds: [] + win_extra_env: [] +network: + plugin: "" + options: {} + mtu: 0 + node_selector: {} + update_strategy: null +authentication: + strategy: "" + sans: [] + webhook: null +addons: | + # Upstream Kubernetes restricted PSP policy + # https://github.com/kubernetes/website/blob/564baf15c102412522e9c8fc6ef2b5ff5b6e766c/content/en/examples/policy/restricted-psp.yaml + apiVersion: policy/v1beta1 + kind: PodSecurityPolicy + metadata: + name: restricted-noroot + spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + # Allow core volume types. + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use. + - 'csi' + - 'persistentVolumeClaim' + - 'ephemeral' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Require the container to run without root privileges. + rule: 'MustRunAsNonRoot' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: psp:restricted-noroot + rules: + - apiGroups: + - extensions + resourceNames: + - restricted-noroot + resources: + - podsecuritypolicies + verbs: + - use + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: psp:restricted-noroot + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp:restricted-noroot + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:serviceaccounts + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + metadata: + name: default-allow-all + spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: default + automountServiceAccountToken: false +addons_include: [] +system_images: + etcd: "" + alpine: "" + nginx_proxy: "" + cert_downloader: "" + kubernetes_services_sidecar: "" + kubedns: "" + dnsmasq: "" + kubedns_sidecar: "" + kubedns_autoscaler: "" + coredns: "" + coredns_autoscaler: "" + nodelocal: "" + kubernetes: "" + flannel: "" + flannel_cni: "" + calico_node: "" + calico_cni: "" + calico_controllers: "" + calico_ctl: "" + calico_flexvol: "" + canal_node: "" + canal_cni: "" + canal_controllers: "" + canal_flannel: "" + canal_flexvol: "" + weave_node: "" + weave_cni: "" + pod_infra_container: "" + ingress: "" + ingress_backend: "" + metrics_server: "" + windows_pod_infra_container: "" +ssh_key_path: "" +ssh_cert_path: "" +ssh_agent_auth: false +authorization: + mode: "" + options: {} +ignore_docker_version: false +kubernetes_version: "" +private_registries: [] +ingress: + provider: "" + options: {} + node_selector: {} + extra_args: {} + dns_policy: "" + extra_envs: [] + extra_volumes: [] + extra_volume_mounts: [] + update_strategy: null + http_port: 0 + https_port: 0 + network_mode: "" +cluster_name: +cloud_provider: + name: "" +prefix_path: "" +win_prefix_path: "" +addon_job_timeout: 0 +bastion_host: + address: "" + port: "" + user: "" + ssh_key: "" + ssh_key_path: "" + ssh_cert: "" + ssh_cert_path: "" +monitoring: + provider: "" + options: {} + node_selector: {} + update_strategy: null + replicas: null +restore: + restore: false + snapshot_name: "" +dns: null +upgrade_strategy: + max_unavailable_worker: "" + max_unavailable_controlplane: "" + drain: null + node_drain_input: null +``` + +### Reference Hardened RKE Template Configuration + +The reference RKE template provides the configuration needed to achieve a hardened install of Kubernetes. RKE templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher [documentation]({{}}/rancher/v2.6/en/installation) for additional installation and RKE template details. + +```yaml +# +# Cluster Config +# +default_pod_security_policy_template_id: restricted-noroot +docker_root_dir: /var/lib/docker +enable_cluster_alerting: false +enable_cluster_monitoring: false +enable_network_policy: true +local_cluster_auth_endpoint: + enabled: true +name: '' +# +# Rancher Config +# +rancher_kubernetes_engine_config: + addon_job_timeout: 45 + authentication: + strategy: x509 + dns: + nodelocal: + ip_address: '' + node_selector: null + update_strategy: {} + enable_cri_dockerd: false + ignore_docker_version: true +# +# # Currently only nginx ingress provider is supported. +# # To disable ingress controller, set `provider: none` +# # To enable ingress on specific nodes, use the node_selector, eg: +# provider: nginx +# node_selector: +# app: ingress +# + ingress: + default_backend: false + default_ingress_class: true + http_port: 0 + https_port: 0 + provider: nginx + kubernetes_version: v1.21.8-rancher1-1 + monitoring: + provider: metrics-server + replicas: 1 +# +# If you are using calico on AWS +# +# network: +# plugin: calico +# calico_network_provider: +# cloud_provider: aws +# +# # To specify flannel interface +# +# network: +# plugin: flannel +# flannel_network_provider: +# iface: eth1 +# +# # To specify flannel interface for canal plugin +# +# network: +# plugin: canal +# canal_network_provider: +# iface: eth1 +# + network: + mtu: 0 + options: + flannel_backend_type: vxlan + plugin: canal + rotate_encryption_key: false +# +# services: +# kube-api: +# service_cluster_ip_range: 10.43.0.0/16 +# kube-controller: +# cluster_cidr: 10.42.0.0/16 +# service_cluster_ip_range: 10.43.0.0/16 +# kubelet: +# cluster_domain: cluster.local +# cluster_dns_server: 10.43.0.10 +# + services: + scheduler: + extra_args: + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + etcd: + backup_config: + enabled: true + interval_hours: 12 + retention: 6 + safe_timestamp: false + timeout: 300 + creation: 12h + extra_args: + election-timeout: 5000 + heartbeat-interval: 500 + retention: 72h + snapshot: false + uid: 52034 + gid: 52034 + kube_api: + always_pull_images: false + audit_log: + enabled: true + event_rate_limit: + enabled: true + pod_security_policy: true + secrets_encryption_config: + enabled: true + service_node_port_range: 30000-32767 + kube-controller: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + bind-address: 127.0.0.1 + kubelet: + extra_args: + feature-gates: RotateKubeletServerCertificate=true + protect-kernel-defaults: true + tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 + fail_swap_on: false + generate_serving_certificate: true + ssh_agent_auth: false + upgrade_strategy: + max_unavailable_controlplane: '1' + max_unavailable_worker: 10% +windows_prefered_cluster: false +``` + +### Reference Hardened **cloud-config** Configuration + +A **cloud-config** configuration file is generally used in cloud infrastructure environments to allow for configuration management of compute instances. The reference config configures SUSE Linux Enterprise Server (SLES), openSUSE Leap, Red Hat Enterprise Linux (RHEL) and Ubuntu operating system level settings needed before installing Kubernetes. + +#### Reference Hardened **cloud-config** for SUSE Linux Enterprise Server 15 (SLES 15) and openSUSE Leap 15 + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +ssh_pwauth: false +runcmd: +# Docker should already be installed in SLES 15 SP3 +- zypper install docker containerd +- systemctl daemon-reload +- systemctl enable docker.service +- systemctl start --no-block docker.service +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` + +#### Reference Hardened **cloud-config** for Red Hat Enterprise Linux 8 (RHEL 8) and Ubuntu 20.04 LTS + +```yaml +#cloud-config +system_info: + default_user: + groups: + - docker +write_files: +- path: "/etc/sysctl.d/90-kubelet.conf" + owner: root:root + permissions: '0644' + content: | + vm.overcommit_memory=1 + vm.panic_on_oom=0 + kernel.panic=10 + kernel.panic_on_oops=1 + kernel.keys.root_maxbytes=25000000 +package_update: true +ssh_pwauth: false +runcmd: +# Install Docker from Rancher's Docker installation scripts - github.com/rancher/install-docker +- curl https://releases.rancher.com/install-docker/20.10.sh | sh +- sysctl -p /etc/sysctl.d/90-kubelet.conf +- groupadd --gid 52034 etcd +- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd --shell /usr/sbin/nologin +``` diff --git a/content/rancher/v2.6/en/security/hardening-guides/_index.md b/content/rancher/v2.6/en/security/hardening-guides/_index.md index a3635419be5..ea4e969f058 100644 --- a/content/rancher/v2.6/en/security/hardening-guides/_index.md +++ b/content/rancher/v2.6/en/security/hardening-guides/_index.md @@ -1,6 +1,6 @@ --- title: Self-Assessment and Hardening Guides for Rancher v2.6 -shortTitle: Rancher v2.6 Guides +shortTitle: Rancher v2.6 Hardening Guides weight: 1 aliases: - /rancher/v2.6/en/security/rancher-2.5/ @@ -10,4 +10,56 @@ aliases: - /rancher/v2.6/en/security/rancher-2.5/1.6-benchmark-2.5/ --- -Rancher v2.6 hardening guides are currently being updated. For the time being, please consult [Rancher v2.5 self-assessment and hardening guides]({{}}/rancher/v2.5/en/security/rancher-2.5) for more information. +Rancher provides specific security hardening guides for each supported Rancher's Kubernetes distributions. + +- [Rancher Kubernetes Distributions](#rancher-kubernetes-distributions) +- [Hardening Guides and Benchmark Versions](#hardening-guides-and-benchmark-versions) + - [RKE Guides](#rke-guides) + - [RKE2 Guides](#rke2-guides) + - [K3s Guides](#k3s) +- [Rancher with SELinux](#rancher-with-selinux) + +# Rancher Kubernetes Distributions + +Rancher uses the following Kubernetes distributions: + +- [**RKE**]({{}}/rke/latest/en/), Rancher Kubernetes Engine, is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers. +- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector. +- [**K3s**]({{}}/k3s/latest/en/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory of upstream Kubernetes, all in a binary of less than 100 MB. + +To harden a Kubernetes cluster outside of Rancher's distributions, refer to your Kubernetes provider docs. + +# Hardening Guides and Benchmark Versions + +These guides have been tested along with the Rancher v2.6 release. Each self-assessment guide is accompanied with a hardening guide and tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can choose to use the existing guides until a newer version is added. + +### RKE Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18, v1.19, v1.20 and v1.21 | CIS v1.6 | [Link](./1.6-benchmark-2.6) | [Link](./1.6-hardening-2.6) | + +> **Notes** +> +> - Kubernetes v1.22 is currently in experimental mode in Rancher v2.6.3. +> - CIS v1.20 benchmark version for Kubernetes v1.19 and v1.20 is not yet released as a profile in Rancher's CIS Benchmark chart. + +### RKE2 Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | +| --- | --- | --- | --- | +| Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) | +| Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) | + +### K3s Guides + +| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide | +| --- | --- | --- | --- | +| Kubernetes v1.17, v1.18, & v1.19 | CIS v1.5 | [Link]({{}}/k3s/latest/en/security/self_assessment/) | [Link]({{}}/k3s/latest/en/security/hardening_guide/) | + + +# Rancher with SELinux + +[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on RHEL and CentOS. + +To use Rancher with SELinux, we recommend installing the `rancher-selinux` RPM according to the instructions on [this page.]({{}}/rancher/v2.6/en/security/selinux/#installing-the-rancher-selinux-rpm) diff --git a/content/rancher/v2.6/en/virtualization-admin/_index.md b/content/rancher/v2.6/en/virtualization-admin/_index.md index f37ffb8b951..19c517f7c3d 100644 --- a/content/rancher/v2.6/en/virtualization-admin/_index.md +++ b/content/rancher/v2.6/en/virtualization-admin/_index.md @@ -25,6 +25,8 @@ To navigate to the Harvester cluster, click **☰ > Virtualization Management**. The [Harvester node driver](https://docs.harvesterhci.io/v0.3/rancher/node-driver/) is marked as `tech preview` on RKE and RKE2 options in Rancher. This will be the case both on the Create page and once the driver is already enabled. The node driver is available whether or not the Harvester feature flag is enabled. Note that the node driver is off by default. Users may create RKE or RKE2 clusters on Harvester only from the Cluster Management page. +Harvester allows `.ISO` images to be uploaded and displayed through the Harvester UI, but this is not supported in the Rancher UI. This is because `.ISO` images usually require additional setup that interferes with a clean deployment (without requiring user intervention), and they are not typically used in cloud environments. + Click [here]({{}}/rancher/v2.6/en/admin-settings/drivers/#node-drivers) for more information on node drivers in Rancher. ### Limitations diff --git a/scripts/converters/css/style-portrait.css b/scripts/converters/css/style-portrait.css index e6bcd2303ef..ab19e788e28 100644 --- a/scripts/converters/css/style-portrait.css +++ b/scripts/converters/css/style-portrait.css @@ -238,7 +238,7 @@ h2 { font-size:1.5em; } -h3 {font-size:1.4em;} +h3 {font-size:1.2em;} h4 {font-size:1.3em; line-height:30px; } @@ -283,7 +283,7 @@ nav ul li a { nav ul li a::after {content: target-counter(attr(href url), page, decimal); float:right;margin-right:10px;} nav ul li ul {list-style-type: none; border-left-style: dashed; border-left-width: 1px; border-color: #000; margin-top:1.5em;} nav ul li ul li {margin-left:-.5em;color:#ff0000;} -nav ul li ul li a {border:none;font-family:PoppinsExtraLight;margin-top:-1.5em;} +nav ul li ul li a {border:none;font-family:PoppinsExtraLight;font-size:.75em;margin-bottom:1.8em;} nav ul li ul li a::after {font-size:.75em;} nav code {background:none;} nav a{text-decoration:none;outline:none;color:#000;} diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh index 6e087588c3f..a7d5d473313 100755 --- a/scripts/converters/scripts/results_to_md.sh +++ b/scripts/converters/scripts/results_to_md.sh @@ -19,7 +19,7 @@ get_id_text() { get_section_ids() { id=${1} - jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} + jq -r --arg id "${id}" '.[] | select(.id==$id) | .checks[].id' ${results_file} | sort -V } get_section_desc() { @@ -53,12 +53,11 @@ for id in $(get_ids); do test_desc=$(echo ${result} | jq -r '.description') audit=$(echo ${result} | jq -r '.audit') audit_config=$(echo ${result} | jq -r '.audit_config') - actual_value=$(echo ${result} | jq -r '.actual_value_per_node."cis-aio-0"') + actual_value=$(echo ${result} | jq -r '.actual_value_per_node[]') type=$(echo ${result} | jq -r '.test_type') status=$(echo ${result} | jq -r '.state') remediation=$(echo ${result} | jq -r '.remediation') expected_result=$(echo ${result} | jq -r '.expected_result') -# echo "#### ${test} ${test_desc}" echo if [ "${type}" = "skip" ]; then echo "**Result:** Not Applicable" @@ -76,7 +75,7 @@ for id in $(get_ids); do if [[ ${audit} =~ ".sh" ]]; then audit_script=$(basename $(echo ${audit} | cut -d ' ' -f1)) test_helper="${test_helpers}/${audit_script}" - echo "**Audit Script:** ${audit_script}" + echo "**Audit Script:** \`${audit_script}\`" echo echo '```bash' cat ${test_helper} @@ -106,6 +105,14 @@ for id in $(get_ids); do echo '```' echo fi + if [ ! -z "${expected_result}" ]; then + echo "**Expected Result**:" + echo + echo '```console' + echo ${expected_result} + echo '```' + echo + fi if [ ! -z "${actual_value}" ] && [ "${status}" != "PASS" ] && [ "${type}" != "skip" ] && [ "${type}" != "manual" ]; then echo "**Returned Value**:" echo @@ -114,14 +121,6 @@ for id in $(get_ids); do echo '```' echo fi - if [ ! -z "${expected_result}" ]; then - echo "**Expected result**:" - echo - echo '```console' - echo ${expected_result} - echo '```' - echo - fi done done done